diff options
author | rwatson <rwatson@FreeBSD.org> | 2007-10-29 13:33:06 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2007-10-29 13:33:06 +0000 |
commit | a4265719055fe445116eb2743b6aacf518bb1a8d (patch) | |
tree | b5d3ede5fbbf1cb40c13deb6bb8e406ce58b639e /sys/security/mac_test/mac_test.c | |
parent | 17e940f736d56194ae75e4a2963c775a59f0a3f6 (diff) | |
download | FreeBSD-src-a4265719055fe445116eb2743b6aacf518bb1a8d.zip FreeBSD-src-a4265719055fe445116eb2743b6aacf518bb1a8d.tar.gz |
Resort TrustedBSD MAC Framework policy entry point implementations and
declarations to match the object, operation sort order in the framework
itself.
Obtained from: TrustedBSD Project
Diffstat (limited to 'sys/security/mac_test/mac_test.c')
-rw-r--r-- | sys/security/mac_test/mac_test.c | 2499 |
1 files changed, 1256 insertions, 1243 deletions
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c index 2486716..ff0c215 100644 --- a/sys/security/mac_test/mac_test.c +++ b/sys/security/mac_test/mac_test.c @@ -149,217 +149,109 @@ SYSCTL_NODE(_security_mac_test, OID_AUTO, counter, CTLFLAG_RW, 0, } while (0) /* - * Label operations. + * Functions that span multiple entry points. */ -COUNTER_DECL(bpfdesc_init_label); -static void -test_bpfdesc_init_label(struct label *label) -{ - - LABEL_INIT(label, MAGIC_BPF); - COUNTER_INC(bpfdesc_init_label); -} - -COUNTER_DECL(cred_init_label); -static void -test_cred_init_label(struct label *label) -{ - - LABEL_INIT(label, MAGIC_CRED); - COUNTER_INC(cred_init_label); -} - -COUNTER_DECL(devfs_init_label); -static void -test_devfs_init_label(struct label *label) +COUNTER_DECL(internalize_label); +static int +test_internalize_label(struct label *label, char *element_name, + char *element_data, int *claimed) { - LABEL_INIT(label, MAGIC_DEVFS); - COUNTER_INC(devfs_init_label); -} - -COUNTER_DECL(ifnet_init_label); -static void -test_ifnet_init_label(struct label *label) -{ + LABEL_NOTFREE(label); + COUNTER_INC(internalize_label); - LABEL_INIT(label, MAGIC_IFNET); - COUNTER_INC(ifnet_init_label); + return (0); } -COUNTER_DECL(inpcb_init_label); +/* + * Object-specific entry point implementations are sorted alphabetically by + * object type name and then by operation. + */ +COUNTER_DECL(bpfdesc_check_receive); static int -test_inpcb_init_label(struct label *label, int flag) +test_bpfdesc_check_receive(struct bpf_d *bpf_d, struct label *bpflabel, + struct ifnet *ifp, struct label *ifplabel) { - if (flag & M_WAITOK) - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "test_inpcb_init_label() at %s:%d", __FILE__, - __LINE__); + LABEL_CHECK(bpflabel, MAGIC_BPF); + LABEL_CHECK(ifplabel, MAGIC_IFNET); + COUNTER_INC(bpfdesc_check_receive); - LABEL_INIT(label, MAGIC_INPCB); - COUNTER_INC(inpcb_init_label); return (0); } -COUNTER_DECL(sysvmsg_init_label); -static void -test_sysvmsg_init_label(struct label *label) -{ - LABEL_INIT(label, MAGIC_SYSV_MSG); - COUNTER_INC(sysvmsg_init_label); -} - -COUNTER_DECL(sysvmsq_init_label); +COUNTER_DECL(bpfdesc_create); static void -test_sysvmsq_init_label(struct label *label) +test_bpfdesc_create(struct ucred *cred, struct bpf_d *bpf_d, + struct label *bpflabel) { - LABEL_INIT(label, MAGIC_SYSV_MSQ); - COUNTER_INC(sysvmsq_init_label); -} -COUNTER_DECL(sysvsem_init_label); -static void -test_sysvsem_init_label(struct label *label) -{ - LABEL_INIT(label, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_init_label); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(bpflabel, MAGIC_BPF); + COUNTER_INC(bpfdesc_create); } -COUNTER_DECL(sysvshm_init_label); +COUNTER_DECL(bpfdesc_create_mbuf); static void -test_sysvshm_init_label(struct label *label) -{ - LABEL_INIT(label, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_init_label); -} - -COUNTER_DECL(ipq_init_label); -static int -test_ipq_init_label(struct label *label, int flag) +test_bpfdesc_create_mbuf(struct bpf_d *bpf_d, struct label *bpflabel, + struct mbuf *mbuf, struct label *mbuflabel) { - if (flag & M_WAITOK) - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "test_ipq_init_label() at %s:%d", __FILE__, - __LINE__); - - LABEL_INIT(label, MAGIC_IPQ); - COUNTER_INC(ipq_init_label); - return (0); + LABEL_CHECK(bpflabel, MAGIC_BPF); + LABEL_CHECK(mbuflabel, MAGIC_MBUF); + COUNTER_INC(bpfdesc_create_mbuf); } -COUNTER_DECL(mbuf_init_label); -static int -test_mbuf_init_label(struct label *label, int flag) +COUNTER_DECL(bpfdesc_destroy_label); +static void +test_bpfdesc_destroy_label(struct label *label) { - if (flag & M_WAITOK) - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "test_mbuf_init_label() at %s:%d", __FILE__, - __LINE__); - - LABEL_INIT(label, MAGIC_MBUF); - COUNTER_INC(mbuf_init_label); - return (0); + LABEL_DESTROY(label, MAGIC_BPF); + COUNTER_INC(bpfdesc_destroy_label); } -COUNTER_DECL(mount_init_label); +COUNTER_DECL(bpfdesc_init_label); static void -test_mount_init_label(struct label *label) +test_bpfdesc_init_label(struct label *label) { - LABEL_INIT(label, MAGIC_MOUNT); - COUNTER_INC(mount_init_label); + LABEL_INIT(label, MAGIC_BPF); + COUNTER_INC(bpfdesc_init_label); } -COUNTER_DECL(socket_init_label); +COUNTER_DECL(cred_check_relabel); static int -test_socket_init_label(struct label *label, int flag) +test_cred_check_relabel(struct ucred *cred, struct label *newlabel) { - if (flag & M_WAITOK) - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "test_socket_init_label() at %s:%d", __FILE__, - __LINE__); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(newlabel, MAGIC_CRED); + COUNTER_INC(cred_check_relabel); - LABEL_INIT(label, MAGIC_SOCKET); - COUNTER_INC(socket_init_label); return (0); } -COUNTER_DECL(socketpeer_init_label); +COUNTER_DECL(cred_check_visible); static int -test_socketpeer_init_label(struct label *label, int flag) -{ - - if (flag & M_WAITOK) - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "test_socketpeer_init_label() at %s:%d", __FILE__, - __LINE__); - - LABEL_INIT(label, MAGIC_SOCKET); - COUNTER_INC(socketpeer_init_label); - return (0); -} - -COUNTER_DECL(pipe_init_label); -static void -test_pipe_init_label(struct label *label) -{ - - LABEL_INIT(label, MAGIC_PIPE); - COUNTER_INC(pipe_init_label); -} - -COUNTER_DECL(posixsem_init_label); -static void -test_posixsem_init_label(struct label *label) -{ - - LABEL_INIT(label, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_init_label); -} - -COUNTER_DECL(proc_init_label); -static void -test_proc_init_label(struct label *label) +test_cred_check_visible(struct ucred *u1, struct ucred *u2) { - LABEL_INIT(label, MAGIC_PROC); - COUNTER_INC(proc_init_label); -} - -COUNTER_DECL(syncache_init_label); -static int -test_syncache_init_label(struct label *label, int flag) -{ + LABEL_CHECK(u1->cr_label, MAGIC_CRED); + LABEL_CHECK(u2->cr_label, MAGIC_CRED); + COUNTER_INC(cred_check_visible); - if (flag & M_WAITOK) - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "test_syncache_init_label() at %s:%d", __FILE__, - __LINE__); - LABEL_INIT(label, MAGIC_SYNCACHE); - COUNTER_INC(syncache_init_label); return (0); } -COUNTER_DECL(vnode_init_label); -static void -test_vnode_init_label(struct label *label) -{ - - LABEL_INIT(label, MAGIC_VNODE); - COUNTER_INC(vnode_init_label); -} - -COUNTER_DECL(bpfdesc_destroy_label); +COUNTER_DECL(cred_copy_label); static void -test_bpfdesc_destroy_label(struct label *label) +test_cred_copy_label(struct label *src, struct label *dest) { - LABEL_DESTROY(label, MAGIC_BPF); - COUNTER_INC(bpfdesc_destroy_label); + LABEL_CHECK(src, MAGIC_CRED); + LABEL_CHECK(dest, MAGIC_CRED); + COUNTER_INC(cred_copy_label); } COUNTER_DECL(cred_destroy_label); @@ -371,175 +263,139 @@ test_cred_destroy_label(struct label *label) COUNTER_INC(cred_destroy_label); } -COUNTER_DECL(devfs_destroy_label); -static void -test_devfs_destroy_label(struct label *label) -{ - - LABEL_DESTROY(label, MAGIC_DEVFS); - COUNTER_INC(devfs_destroy_label); -} - -COUNTER_DECL(ifnet_destroy_label); -static void -test_ifnet_destroy_label(struct label *label) -{ - - LABEL_DESTROY(label, MAGIC_IFNET); - COUNTER_INC(ifnet_destroy_label); -} - -COUNTER_DECL(inpcb_destroy_label); -static void -test_inpcb_destroy_label(struct label *label) -{ - - LABEL_DESTROY(label, MAGIC_INPCB); - COUNTER_INC(inpcb_destroy_label); -} - -COUNTER_DECL(syncache_destroy_label); -static void -test_syncache_destroy_label(struct label *label) +COUNTER_DECL(cred_externalize_label); +static int +test_cred_externalize_label(struct label *label, char *element_name, + struct sbuf *sb, int *claimed) { - LABEL_DESTROY(label, MAGIC_SYNCACHE); - COUNTER_INC(syncache_destroy_label); -} - -COUNTER_DECL(sysvmsg_destroy_label); -static void -test_sysvmsg_destroy_label(struct label *label) -{ + LABEL_CHECK(label, MAGIC_CRED); + COUNTER_INC(cred_externalize_label); - LABEL_DESTROY(label, MAGIC_SYSV_MSG); - COUNTER_INC(sysvmsg_destroy_label); + return (0); } -COUNTER_DECL(sysvmsq_destroy_label); +COUNTER_DECL(cred_init_label); static void -test_sysvmsq_destroy_label(struct label *label) +test_cred_init_label(struct label *label) { - LABEL_DESTROY(label, MAGIC_SYSV_MSQ); - COUNTER_INC(sysvmsq_destroy_label); + LABEL_INIT(label, MAGIC_CRED); + COUNTER_INC(cred_init_label); } -COUNTER_DECL(sysvsem_destroy_label); +COUNTER_DECL(cred_relabel); static void -test_sysvsem_destroy_label(struct label *label) +test_cred_relabel(struct ucred *cred, struct label *newlabel) { - LABEL_DESTROY(label, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_destroy_label); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(newlabel, MAGIC_CRED); + COUNTER_INC(cred_relabel); } -COUNTER_DECL(sysvshm_destroy_label); +COUNTER_DECL(devfs_create_device); static void -test_sysvshm_destroy_label(struct label *label) +test_devfs_create_device(struct ucred *cred, struct mount *mp, + struct cdev *dev, struct devfs_dirent *de, struct label *delabel) { - LABEL_DESTROY(label, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_destroy_label); + if (cred != NULL) + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(delabel, MAGIC_DEVFS); + COUNTER_INC(devfs_create_device); } -COUNTER_DECL(ipq_destroy_label); +COUNTER_DECL(devfs_create_directory); static void -test_ipq_destroy_label(struct label *label) +test_devfs_create_directory(struct mount *mp, char *dirname, + int dirnamelen, struct devfs_dirent *de, struct label *delabel) { - LABEL_DESTROY(label, MAGIC_IPQ); - COUNTER_INC(ipq_destroy_label); + LABEL_CHECK(delabel, MAGIC_DEVFS); + COUNTER_INC(devfs_create_directory); } -COUNTER_DECL(mbuf_destroy_label); +COUNTER_DECL(devfs_create_symlink); static void -test_mbuf_destroy_label(struct label *label) +test_devfs_create_symlink(struct ucred *cred, struct mount *mp, + struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, + struct label *delabel) { - /* - * If we're loaded dynamically, there may be mbufs in flight that - * didn't have label storage allocated for them. Handle this - * gracefully. - */ - if (label == NULL) - return; - - LABEL_DESTROY(label, MAGIC_MBUF); - COUNTER_INC(mbuf_destroy_label); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(ddlabel, MAGIC_DEVFS); + LABEL_CHECK(delabel, MAGIC_DEVFS); + COUNTER_INC(devfs_create_symlink); } -COUNTER_DECL(mount_destroy_label); +COUNTER_DECL(devfs_destroy_label); static void -test_mount_destroy_label(struct label *label) +test_devfs_destroy_label(struct label *label) { - LABEL_DESTROY(label, MAGIC_MOUNT); - COUNTER_INC(mount_destroy_label); + LABEL_DESTROY(label, MAGIC_DEVFS); + COUNTER_INC(devfs_destroy_label); } -COUNTER_DECL(socket_destroy_label); +COUNTER_DECL(devfs_init_label); static void -test_socket_destroy_label(struct label *label) +test_devfs_init_label(struct label *label) { - LABEL_DESTROY(label, MAGIC_SOCKET); - COUNTER_INC(socket_destroy_label); + LABEL_INIT(label, MAGIC_DEVFS); + COUNTER_INC(devfs_init_label); } -COUNTER_DECL(socketpeer_destroy_label); +COUNTER_DECL(devfs_update); static void -test_socketpeer_destroy_label(struct label *label) +test_devfs_update(struct mount *mp, struct devfs_dirent *devfs_dirent, + struct label *direntlabel, struct vnode *vp, struct label *vplabel) { - LABEL_DESTROY(label, MAGIC_SOCKET); - COUNTER_INC(socketpeer_destroy_label); + LABEL_CHECK(direntlabel, MAGIC_DEVFS); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(devfs_update); } -COUNTER_DECL(pipe_destroy_label); +COUNTER_DECL(devfs_vnode_associate); static void -test_pipe_destroy_label(struct label *label) +test_devfs_vnode_associate(struct mount *mp, struct label *mplabel, + struct devfs_dirent *de, struct label *delabel, struct vnode *vp, + struct label *vplabel) { - LABEL_DESTROY(label, MAGIC_PIPE); - COUNTER_INC(pipe_destroy_label); + LABEL_CHECK(mplabel, MAGIC_MOUNT); + LABEL_CHECK(delabel, MAGIC_DEVFS); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(devfs_vnode_associate); } -COUNTER_DECL(posixsem_destroy_label); -static void -test_posixsem_destroy_label(struct label *label) +COUNTER_DECL(ifnet_check_relabel); +static int +test_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, + struct label *ifplabel, struct label *newlabel) { - LABEL_DESTROY(label, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_destroy_label); -} - -COUNTER_DECL(proc_destroy_label); -static void -test_proc_destroy_label(struct label *label) -{ + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(ifplabel, MAGIC_IFNET); + LABEL_CHECK(newlabel, MAGIC_IFNET); + COUNTER_INC(ifnet_check_relabel); - LABEL_DESTROY(label, MAGIC_PROC); - COUNTER_INC(proc_destroy_label); + return (0); } -COUNTER_DECL(vnode_destroy_label); -static void -test_vnode_destroy_label(struct label *label) +COUNTER_DECL(ifnet_check_transmit); +static int +test_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, + struct mbuf *m, struct label *mbuflabel) { - LABEL_DESTROY(label, MAGIC_VNODE); - COUNTER_INC(vnode_destroy_label); -} - -COUNTER_DECL(cred_copy_label); -static void -test_cred_copy_label(struct label *src, struct label *dest) -{ + LABEL_CHECK(ifplabel, MAGIC_IFNET); + LABEL_CHECK(mbuflabel, MAGIC_MBUF); + COUNTER_INC(ifnet_check_transmit); - LABEL_CHECK(src, MAGIC_CRED); - LABEL_CHECK(dest, MAGIC_CRED); - COUNTER_INC(cred_copy_label); + return (0); } COUNTER_DECL(ifnet_copy_label); @@ -552,56 +408,33 @@ test_ifnet_copy_label(struct label *src, struct label *dest) COUNTER_INC(ifnet_copy_label); } -COUNTER_DECL(mbuf_copy_label); -static void -test_mbuf_copy_label(struct label *src, struct label *dest) -{ - - LABEL_CHECK(src, MAGIC_MBUF); - LABEL_CHECK(dest, MAGIC_MBUF); - COUNTER_INC(mbuf_copy_label); -} - -COUNTER_DECL(pipe_copy_label); +COUNTER_DECL(ifnet_create); static void -test_pipe_copy_label(struct label *src, struct label *dest) +test_ifnet_create(struct ifnet *ifp, struct label *ifplabel) { - LABEL_CHECK(src, MAGIC_PIPE); - LABEL_CHECK(dest, MAGIC_PIPE); - COUNTER_INC(pipe_copy_label); + LABEL_CHECK(ifplabel, MAGIC_IFNET); + COUNTER_INC(ifnet_create); } -COUNTER_DECL(socket_copy_label); +COUNTER_DECL(ifnet_create_mbuf); static void -test_socket_copy_label(struct label *src, struct label *dest) +test_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, + struct mbuf *m, struct label *mbuflabel) { - LABEL_CHECK(src, MAGIC_SOCKET); - LABEL_CHECK(dest, MAGIC_SOCKET); - COUNTER_INC(socket_copy_label); + LABEL_CHECK(ifplabel, MAGIC_IFNET); + LABEL_CHECK(mbuflabel, MAGIC_MBUF); + COUNTER_INC(ifnet_create_mbuf); } -COUNTER_DECL(vnode_copy_label); +COUNTER_DECL(ifnet_destroy_label); static void -test_vnode_copy_label(struct label *src, struct label *dest) -{ - - LABEL_CHECK(src, MAGIC_VNODE); - LABEL_CHECK(dest, MAGIC_VNODE); - COUNTER_INC(vnode_copy_label); -} - -COUNTER_DECL(cred_externalize_label); -static int -test_cred_externalize_label(struct label *label, char *element_name, - struct sbuf *sb, int *claimed) +test_ifnet_destroy_label(struct label *label) { - LABEL_CHECK(label, MAGIC_CRED); - COUNTER_INC(cred_externalize_label); - - return (0); + LABEL_DESTROY(label, MAGIC_IFNET); + COUNTER_INC(ifnet_destroy_label); } COUNTER_DECL(ifnet_externalize_label); @@ -616,482 +449,317 @@ test_ifnet_externalize_label(struct label *label, char *element_name, return (0); } -COUNTER_DECL(pipe_externalize_label); -static int -test_pipe_externalize_label(struct label *label, char *element_name, - struct sbuf *sb, int *claimed) +COUNTER_DECL(ifnet_init_label); +static void +test_ifnet_init_label(struct label *label) { - LABEL_CHECK(label, MAGIC_PIPE); - COUNTER_INC(pipe_externalize_label); - - return (0); + LABEL_INIT(label, MAGIC_IFNET); + COUNTER_INC(ifnet_init_label); } -COUNTER_DECL(socket_externalize_label); -static int -test_socket_externalize_label(struct label *label, char *element_name, - struct sbuf *sb, int *claimed) +COUNTER_DECL(ifnet_relabel); +static void +test_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, + struct label *ifplabel, struct label *newlabel) { - LABEL_CHECK(label, MAGIC_SOCKET); - COUNTER_INC(socket_externalize_label); - - return (0); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(ifplabel, MAGIC_IFNET); + LABEL_CHECK(newlabel, MAGIC_IFNET); + COUNTER_INC(ifnet_relabel); } -COUNTER_DECL(socketpeer_externalize_label); +COUNTER_DECL(inpcb_check_deliver); static int -test_socketpeer_externalize_label(struct label *label, char *element_name, - struct sbuf *sb, int *claimed) +test_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, + struct mbuf *m, struct label *mlabel) { - LABEL_CHECK(label, MAGIC_SOCKET); - COUNTER_INC(socketpeer_externalize_label); + LABEL_CHECK(inplabel, MAGIC_INPCB); + LABEL_CHECK(mlabel, MAGIC_MBUF); + COUNTER_INC(inpcb_check_deliver); return (0); } -COUNTER_DECL(vnode_externalize_label); -static int -test_vnode_externalize_label(struct label *label, char *element_name, - struct sbuf *sb, int *claimed) +COUNTER_DECL(inpcb_create); +static void +test_inpcb_create(struct socket *so, struct label *solabel, + struct inpcb *inp, struct label *inplabel) { - LABEL_CHECK(label, MAGIC_VNODE); - COUNTER_INC(vnode_externalize_label); - - return (0); + LABEL_CHECK(solabel, MAGIC_SOCKET); + LABEL_CHECK(inplabel, MAGIC_INPCB); + COUNTER_INC(inpcb_create); } -COUNTER_DECL(internalize_label); -static int -test_internalize_label(struct label *label, char *element_name, - char *element_data, int *claimed) +COUNTER_DECL(inpcb_create_mbuf); +static void +test_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, + struct mbuf *m, struct label *mlabel) { - LABEL_NOTFREE(label); - COUNTER_INC(internalize_label); - - return (0); + LABEL_CHECK(inplabel, MAGIC_INPCB); + LABEL_CHECK(mlabel, MAGIC_MBUF); + COUNTER_INC(inpcb_create_mbuf); } -/* - * Labeling event operations: file system objects, and things that look - * a lot like file system objects. - */ -COUNTER_DECL(devfs_vnode_associate); +COUNTER_DECL(inpcb_destroy_label); static void -test_devfs_vnode_associate(struct mount *mp, struct label *mplabel, - struct devfs_dirent *de, struct label *delabel, struct vnode *vp, - struct label *vplabel) +test_inpcb_destroy_label(struct label *label) { - LABEL_CHECK(mplabel, MAGIC_MOUNT); - LABEL_CHECK(delabel, MAGIC_DEVFS); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(devfs_vnode_associate); + LABEL_DESTROY(label, MAGIC_INPCB); + COUNTER_INC(inpcb_destroy_label); } -COUNTER_DECL(vnode_associate_extattr); +COUNTER_DECL(inpcb_init_label); static int -test_vnode_associate_extattr(struct mount *mp, struct label *mplabel, - struct vnode *vp, struct label *vplabel) +test_inpcb_init_label(struct label *label, int flag) { - LABEL_CHECK(mplabel, MAGIC_MOUNT); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(vnode_associate_extattr); + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "test_inpcb_init_label() at %s:%d", __FILE__, + __LINE__); + LABEL_INIT(label, MAGIC_INPCB); + COUNTER_INC(inpcb_init_label); return (0); } -COUNTER_DECL(vnode_associate_singlelabel); -static void -test_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, - struct vnode *vp, struct label *vplabel) -{ - - LABEL_CHECK(mplabel, MAGIC_MOUNT); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(vnode_associate_singlelabel); -} - -COUNTER_DECL(devfs_create_device); +COUNTER_DECL(inpcb_sosetlabel); static void -test_devfs_create_device(struct ucred *cred, struct mount *mp, - struct cdev *dev, struct devfs_dirent *de, struct label *delabel) +test_inpcb_sosetlabel(struct socket *so, struct label *solabel, + struct inpcb *inp, struct label *inplabel) { - if (cred != NULL) - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(delabel, MAGIC_DEVFS); - COUNTER_INC(devfs_create_device); + LABEL_CHECK(solabel, MAGIC_SOCKET); + LABEL_CHECK(inplabel, MAGIC_INPCB); + COUNTER_INC(inpcb_sosetlabel); } -COUNTER_DECL(devfs_create_directory); +COUNTER_DECL(ipq_create); static void -test_devfs_create_directory(struct mount *mp, char *dirname, - int dirnamelen, struct devfs_dirent *de, struct label *delabel) +test_ipq_create(struct mbuf *fragment, struct label *fragmentlabel, + struct ipq *ipq, struct label *ipqlabel) { - LABEL_CHECK(delabel, MAGIC_DEVFS); - COUNTER_INC(devfs_create_directory); + LABEL_CHECK(fragmentlabel, MAGIC_MBUF); + LABEL_CHECK(ipqlabel, MAGIC_IPQ); + COUNTER_INC(ipq_create); } -COUNTER_DECL(devfs_create_symlink); +COUNTER_DECL(ipq_destroy_label); static void -test_devfs_create_symlink(struct ucred *cred, struct mount *mp, - struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, - struct label *delabel) +test_ipq_destroy_label(struct label *label) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(ddlabel, MAGIC_DEVFS); - LABEL_CHECK(delabel, MAGIC_DEVFS); - COUNTER_INC(devfs_create_symlink); + LABEL_DESTROY(label, MAGIC_IPQ); + COUNTER_INC(ipq_destroy_label); } -COUNTER_DECL(vnode_create_extattr); +COUNTER_DECL(ipq_init_label); static int -test_vnode_create_extattr(struct ucred *cred, struct mount *mp, - struct label *mplabel, struct vnode *dvp, struct label *dvplabel, - struct vnode *vp, struct label *vplabel, struct componentname *cnp) +test_ipq_init_label(struct label *label, int flag) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(mplabel, MAGIC_MOUNT); - LABEL_CHECK(dvplabel, MAGIC_VNODE); - COUNTER_INC(vnode_create_extattr); + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "test_ipq_init_label() at %s:%d", __FILE__, + __LINE__); + LABEL_INIT(label, MAGIC_IPQ); + COUNTER_INC(ipq_init_label); return (0); } -COUNTER_DECL(mount_create); -static void -test_mount_create(struct ucred *cred, struct mount *mp, - struct label *mplabel) -{ - - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(mplabel, MAGIC_MOUNT); - COUNTER_INC(mount_create); -} - -COUNTER_DECL(vnode_relabel); -static void -test_vnode_relabel(struct ucred *cred, struct vnode *vp, - struct label *vplabel, struct label *label) -{ - - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(vplabel, MAGIC_VNODE); - LABEL_CHECK(label, MAGIC_VNODE); - COUNTER_INC(vnode_relabel); -} - -COUNTER_DECL(vnode_setlabel_extattr); +COUNTER_DECL(ipq_match); static int -test_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, - struct label *vplabel, struct label *intlabel) +test_ipq_match(struct mbuf *fragment, struct label *fragmentlabel, + struct ipq *ipq, struct label *ipqlabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(vplabel, MAGIC_VNODE); - LABEL_CHECK(intlabel, MAGIC_VNODE); - COUNTER_INC(vnode_setlabel_extattr); + LABEL_CHECK(fragmentlabel, MAGIC_MBUF); + LABEL_CHECK(ipqlabel, MAGIC_IPQ); + COUNTER_INC(ipq_match); - return (0); + return (1); } -COUNTER_DECL(devfs_update); +COUNTER_DECL(ipq_reassemble); static void -test_devfs_update(struct mount *mp, struct devfs_dirent *devfs_dirent, - struct label *direntlabel, struct vnode *vp, struct label *vplabel) +test_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, + struct mbuf *datagram, struct label *datagramlabel) { - LABEL_CHECK(direntlabel, MAGIC_DEVFS); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(devfs_update); + LABEL_CHECK(ipqlabel, MAGIC_IPQ); + LABEL_CHECK(datagramlabel, MAGIC_MBUF); + COUNTER_INC(ipq_reassemble); } -/* - * Labeling event operations: IPC object. - */ -COUNTER_DECL(socket_create_mbuf); +COUNTER_DECL(ipq_update); static void -test_socket_create_mbuf(struct socket *so, struct label *socketlabel, - struct mbuf *m, struct label *mbuflabel) +test_ipq_update(struct mbuf *fragment, struct label *fragmentlabel, + struct ipq *ipq, struct label *ipqlabel) { - LABEL_CHECK(socketlabel, MAGIC_SOCKET); - LABEL_CHECK(mbuflabel, MAGIC_MBUF); - COUNTER_INC(socket_create_mbuf); + LABEL_CHECK(fragmentlabel, MAGIC_MBUF); + LABEL_CHECK(ipqlabel, MAGIC_IPQ); + COUNTER_INC(ipq_update); } -COUNTER_DECL(socket_create); -static void -test_socket_create(struct ucred *cred, struct socket *socket, - struct label *socketlabel) +COUNTER_DECL(kenv_check_dump); +static int +test_kenv_check_dump(struct ucred *cred) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(socketlabel, MAGIC_SOCKET); - COUNTER_INC(socket_create); -} - -COUNTER_DECL(pipe_create); -static void -test_pipe_create(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel) -{ + COUNTER_INC(kenv_check_dump); - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - COUNTER_INC(pipe_create); + return (0); } -COUNTER_DECL(posixsem_create); -static void -test_posixsem_create(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +COUNTER_DECL(kenv_check_get); +static int +test_kenv_check_get(struct ucred *cred, char *name) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_create); -} - -COUNTER_DECL(socket_newconn); -static void -test_socket_newconn(struct socket *oldsocket, - struct label *oldsocketlabel, struct socket *newsocket, - struct label *newsocketlabel) -{ + COUNTER_INC(kenv_check_get); - LABEL_CHECK(oldsocketlabel, MAGIC_SOCKET); - LABEL_CHECK(newsocketlabel, MAGIC_SOCKET); - COUNTER_INC(socket_newconn); + return (0); } -COUNTER_DECL(socket_relabel); -static void -test_socket_relabel(struct ucred *cred, struct socket *socket, - struct label *socketlabel, struct label *newlabel) +COUNTER_DECL(kenv_check_set); +static int +test_kenv_check_set(struct ucred *cred, char *name, char *value) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(newlabel, MAGIC_SOCKET); - COUNTER_INC(socket_relabel); -} - -COUNTER_DECL(pipe_relabel); -static void -test_pipe_relabel(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel, struct label *newlabel) -{ + COUNTER_INC(kenv_check_set); - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - LABEL_CHECK(newlabel, MAGIC_PIPE); - COUNTER_INC(pipe_relabel); + return (0); } -COUNTER_DECL(socketpeer_set_from_mbuf); -static void -test_socketpeer_set_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, - struct socket *socket, struct label *socketpeerlabel) +COUNTER_DECL(kenv_check_unset); +static int +test_kenv_check_unset(struct ucred *cred, char *name) { - LABEL_CHECK(mbuflabel, MAGIC_MBUF); - LABEL_CHECK(socketpeerlabel, MAGIC_SOCKET); - COUNTER_INC(socketpeer_set_from_mbuf); -} - -/* - * Labeling event operations: network objects. - */ -COUNTER_DECL(socketpeer_set_from_socket); -static void -test_socketpeer_set_from_socket(struct socket *oldsocket, - struct label *oldsocketlabel, struct socket *newsocket, - struct label *newsocketpeerlabel) -{ + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + COUNTER_INC(kenv_check_unset); - LABEL_CHECK(oldsocketlabel, MAGIC_SOCKET); - LABEL_CHECK(newsocketpeerlabel, MAGIC_SOCKET); - COUNTER_INC(socketpeer_set_from_socket); + return (0); } -COUNTER_DECL(bpfdesc_create); -static void -test_bpfdesc_create(struct ucred *cred, struct bpf_d *bpf_d, - struct label *bpflabel) +COUNTER_DECL(kld_check_load); +static int +test_kld_check_load(struct ucred *cred, struct vnode *vp, + struct label *label) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(bpflabel, MAGIC_BPF); - COUNTER_INC(bpfdesc_create); -} - -COUNTER_DECL(ipq_reassemble); -static void -test_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, - struct mbuf *datagram, struct label *datagramlabel) -{ - - LABEL_CHECK(ipqlabel, MAGIC_IPQ); - LABEL_CHECK(datagramlabel, MAGIC_MBUF); - COUNTER_INC(ipq_reassemble); -} - -COUNTER_DECL(netinet_fragment); -static void -test_netinet_fragment(struct mbuf *datagram, struct label *datagramlabel, - struct mbuf *fragment, struct label *fragmentlabel) -{ + LABEL_CHECK(label, MAGIC_VNODE); + COUNTER_INC(kld_check_load); - LABEL_CHECK(datagramlabel, MAGIC_MBUF); - LABEL_CHECK(fragmentlabel, MAGIC_MBUF); - COUNTER_INC(netinet_fragment); + return (0); } -COUNTER_DECL(ifnet_create); -static void -test_ifnet_create(struct ifnet *ifp, struct label *ifplabel) +COUNTER_DECL(kld_check_stat); +static int +test_kld_check_stat(struct ucred *cred) { - LABEL_CHECK(ifplabel, MAGIC_IFNET); - COUNTER_INC(ifnet_create); -} - -COUNTER_DECL(inpcb_create); -static void -test_inpcb_create(struct socket *so, struct label *solabel, - struct inpcb *inp, struct label *inplabel) -{ + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + COUNTER_INC(kld_check_stat); - LABEL_CHECK(solabel, MAGIC_SOCKET); - LABEL_CHECK(inplabel, MAGIC_INPCB); - COUNTER_INC(inpcb_create); + return (0); } -COUNTER_DECL(syncache_create); +COUNTER_DECL(mbuf_copy_label); static void -test_syncache_create(struct label *label, struct inpcb *inp) +test_mbuf_copy_label(struct label *src, struct label *dest) { - LABEL_CHECK(label, MAGIC_SYNCACHE); - COUNTER_INC(syncache_create); + LABEL_CHECK(src, MAGIC_MBUF); + LABEL_CHECK(dest, MAGIC_MBUF); + COUNTER_INC(mbuf_copy_label); } -COUNTER_DECL(syncache_create_mbuf); +COUNTER_DECL(mbuf_destroy_label); static void -test_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, - struct label *mlabel) +test_mbuf_destroy_label(struct label *label) { - LABEL_CHECK(sc_label, MAGIC_SYNCACHE); - LABEL_CHECK(mlabel, MAGIC_MBUF); - COUNTER_INC(syncache_create_mbuf); -} - -COUNTER_DECL(sysvmsg_create); -static void -test_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, - struct label *msqlabel, struct msg *msgptr, struct label *msglabel) -{ + /* + * If we're loaded dynamically, there may be mbufs in flight that + * didn't have label storage allocated for them. Handle this + * gracefully. + */ + if (label == NULL) + return; - LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); - LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ); - COUNTER_INC(sysvmsg_create); + LABEL_DESTROY(label, MAGIC_MBUF); + COUNTER_INC(mbuf_destroy_label); } -COUNTER_DECL(sysvmsq_create); -static void -test_sysvmsq_create(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqlabel) +COUNTER_DECL(mbuf_init_label); +static int +test_mbuf_init_label(struct label *label, int flag) { - LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ); - COUNTER_INC(sysvmsq_create); -} - -COUNTER_DECL(sysvsem_create); -static void -test_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, - struct label *semalabel) -{ + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "test_mbuf_init_label() at %s:%d", __FILE__, + __LINE__); - LABEL_CHECK(semalabel, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_create); + LABEL_INIT(label, MAGIC_MBUF); + COUNTER_INC(mbuf_init_label); + return (0); } -COUNTER_DECL(sysvshm_create); -static void -test_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, - struct label *shmlabel) +COUNTER_DECL(mount_check_stat); +static int +test_mount_check_stat(struct ucred *cred, struct mount *mp, + struct label *mplabel) { - LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_create); -} - -COUNTER_DECL(ipq_create); -static void -test_ipq_create(struct mbuf *fragment, struct label *fragmentlabel, - struct ipq *ipq, struct label *ipqlabel) -{ + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(mplabel, MAGIC_MOUNT); + COUNTER_INC(mount_check_stat); - LABEL_CHECK(fragmentlabel, MAGIC_MBUF); - LABEL_CHECK(ipqlabel, MAGIC_IPQ); - COUNTER_INC(ipq_create); + return (0); } -COUNTER_DECL(inpcb_create_mbuf); +COUNTER_DECL(mount_create); static void -test_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, - struct mbuf *m, struct label *mlabel) +test_mount_create(struct ucred *cred, struct mount *mp, + struct label *mplabel) { - LABEL_CHECK(inplabel, MAGIC_INPCB); - LABEL_CHECK(mlabel, MAGIC_MBUF); - COUNTER_INC(inpcb_create_mbuf); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(mplabel, MAGIC_MOUNT); + COUNTER_INC(mount_create); } -COUNTER_DECL(bpfdesc_create_mbuf); +COUNTER_DECL(mount_destroy_label); static void -test_bpfdesc_create_mbuf(struct bpf_d *bpf_d, struct label *bpflabel, - struct mbuf *mbuf, struct label *mbuflabel) +test_mount_destroy_label(struct label *label) { - LABEL_CHECK(bpflabel, MAGIC_BPF); - LABEL_CHECK(mbuflabel, MAGIC_MBUF); - COUNTER_INC(bpfdesc_create_mbuf); + LABEL_DESTROY(label, MAGIC_MOUNT); + COUNTER_INC(mount_destroy_label); } -COUNTER_DECL(ifnet_create_mbuf); +COUNTER_DECL(mount_init_label); static void -test_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, - struct mbuf *m, struct label *mbuflabel) -{ - - LABEL_CHECK(ifplabel, MAGIC_IFNET); - LABEL_CHECK(mbuflabel, MAGIC_MBUF); - COUNTER_INC(ifnet_create_mbuf); -} - -COUNTER_DECL(ipq_match); -static int -test_ipq_match(struct mbuf *fragment, struct label *fragmentlabel, - struct ipq *ipq, struct label *ipqlabel) +test_mount_init_label(struct label *label) { - LABEL_CHECK(fragmentlabel, MAGIC_MBUF); - LABEL_CHECK(ipqlabel, MAGIC_IPQ); - COUNTER_INC(ipq_match); - - return (1); + LABEL_INIT(label, MAGIC_MOUNT); + COUNTER_INC(mount_init_label); } COUNTER_DECL(netatalk_aarp_send); @@ -1116,6 +784,17 @@ test_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel, COUNTER_INC(netinet_arp_send); } +COUNTER_DECL(netinet_fragment); +static void +test_netinet_fragment(struct mbuf *datagram, struct label *datagramlabel, + struct mbuf *fragment, struct label *fragmentlabel) +{ + + LABEL_CHECK(datagramlabel, MAGIC_MBUF); + LABEL_CHECK(fragmentlabel, MAGIC_MBUF); + COUNTER_INC(netinet_fragment); +} + COUNTER_DECL(netinet_icmp_reply); static void test_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, @@ -1167,1077 +846,1270 @@ test_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel, COUNTER_INC(netinet6_nd6_send); } -COUNTER_DECL(ifnet_relabel); -static void -test_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, - struct label *ifplabel, struct label *newlabel) +COUNTER_DECL(pipe_check_ioctl); +static int +test_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(ifplabel, MAGIC_IFNET); - LABEL_CHECK(newlabel, MAGIC_IFNET); - COUNTER_INC(ifnet_relabel); -} - -COUNTER_DECL(ipq_update); -static void -test_ipq_update(struct mbuf *fragment, struct label *fragmentlabel, - struct ipq *ipq, struct label *ipqlabel) -{ + LABEL_CHECK(pipelabel, MAGIC_PIPE); + COUNTER_INC(pipe_check_ioctl); - LABEL_CHECK(fragmentlabel, MAGIC_MBUF); - LABEL_CHECK(ipqlabel, MAGIC_IPQ); - COUNTER_INC(ipq_update); + return (0); } -COUNTER_DECL(inpcb_sosetlabel); -static void -test_inpcb_sosetlabel(struct socket *so, struct label *solabel, - struct inpcb *inp, struct label *inplabel) +COUNTER_DECL(pipe_check_poll); +static int +test_pipe_check_poll(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel) { - LABEL_CHECK(solabel, MAGIC_SOCKET); - LABEL_CHECK(inplabel, MAGIC_INPCB); - COUNTER_INC(inpcb_sosetlabel); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + COUNTER_INC(pipe_check_poll); + + return (0); } -/* - * Labeling event operations: processes. - */ -COUNTER_DECL(vnode_execve_transition); -static void -test_vnode_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *filelabel, - struct label *interpvplabel, struct image_params *imgp, - struct label *execlabel) +COUNTER_DECL(pipe_check_read); +static int +test_pipe_check_read(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel) { - LABEL_CHECK(old->cr_label, MAGIC_CRED); - LABEL_CHECK(new->cr_label, MAGIC_CRED); - LABEL_CHECK(filelabel, MAGIC_VNODE); - LABEL_CHECK(interpvplabel, MAGIC_VNODE); - LABEL_CHECK(execlabel, MAGIC_CRED); - COUNTER_INC(vnode_execve_transition); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + COUNTER_INC(pipe_check_read); + + return (0); } -COUNTER_DECL(vnode_execve_will_transition); +COUNTER_DECL(pipe_check_relabel); static int -test_vnode_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *filelabel, struct label *interpvplabel, - struct image_params *imgp, struct label *execlabel) +test_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel, struct label *newlabel) { - LABEL_CHECK(old->cr_label, MAGIC_CRED); - LABEL_CHECK(filelabel, MAGIC_VNODE); - LABEL_CHECK(interpvplabel, MAGIC_VNODE); - LABEL_CHECK(execlabel, MAGIC_CRED); - COUNTER_INC(vnode_execve_will_transition); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + LABEL_CHECK(newlabel, MAGIC_PIPE); + COUNTER_INC(pipe_check_relabel); return (0); } -COUNTER_DECL(proc_create_swapper); -static void -test_proc_create_swapper(struct ucred *cred) +COUNTER_DECL(pipe_check_stat); +static int +test_pipe_check_stat(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_create_swapper); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + COUNTER_INC(pipe_check_stat); + + return (0); } -COUNTER_DECL(proc_create_init); -static void -test_proc_create_init(struct ucred *cred) +COUNTER_DECL(pipe_check_write); +static int +test_pipe_check_write(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_create_init); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + COUNTER_INC(pipe_check_write); + + return (0); } -COUNTER_DECL(cred_relabel); +COUNTER_DECL(pipe_copy_label); static void -test_cred_relabel(struct ucred *cred, struct label *newlabel) +test_pipe_copy_label(struct label *src, struct label *dest) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(newlabel, MAGIC_CRED); - COUNTER_INC(cred_relabel); + LABEL_CHECK(src, MAGIC_PIPE); + LABEL_CHECK(dest, MAGIC_PIPE); + COUNTER_INC(pipe_copy_label); } -COUNTER_DECL(thread_userret); +COUNTER_DECL(pipe_create); static void -test_thread_userret(struct thread *td) +test_pipe_create(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel) { - COUNTER_INC(thread_userret); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + COUNTER_INC(pipe_create); } -/* - * Label cleanup/flush operations - */ -COUNTER_DECL(sysvmsg_cleanup); +COUNTER_DECL(pipe_destroy_label); static void -test_sysvmsg_cleanup(struct label *msglabel) +test_pipe_destroy_label(struct label *label) { - LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); - COUNTER_INC(sysvmsg_cleanup); + LABEL_DESTROY(label, MAGIC_PIPE); + COUNTER_INC(pipe_destroy_label); } -COUNTER_DECL(sysvmsq_cleanup); -static void -test_sysvmsq_cleanup(struct label *msqlabel) +COUNTER_DECL(pipe_externalize_label); +static int +test_pipe_externalize_label(struct label *label, char *element_name, + struct sbuf *sb, int *claimed) { - LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ); - COUNTER_INC(sysvmsq_cleanup); + LABEL_CHECK(label, MAGIC_PIPE); + COUNTER_INC(pipe_externalize_label); + + return (0); } -COUNTER_DECL(sysvsem_cleanup); +COUNTER_DECL(pipe_init_label); static void -test_sysvsem_cleanup(struct label *semalabel) +test_pipe_init_label(struct label *label) { - LABEL_CHECK(semalabel, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_cleanup); + LABEL_INIT(label, MAGIC_PIPE); + COUNTER_INC(pipe_init_label); } -COUNTER_DECL(sysvshm_cleanup); +COUNTER_DECL(pipe_relabel); static void -test_sysvshm_cleanup(struct label *shmlabel) +test_pipe_relabel(struct ucred *cred, struct pipepair *pp, + struct label *pipelabel, struct label *newlabel) { - LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_cleanup); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(pipelabel, MAGIC_PIPE); + LABEL_CHECK(newlabel, MAGIC_PIPE); + COUNTER_INC(pipe_relabel); } -/* - * Access control checks. - */ -COUNTER_DECL(bpfdesc_check_receive); +COUNTER_DECL(posixsem_check_destroy); static int -test_bpfdesc_check_receive(struct bpf_d *bpf_d, struct label *bpflabel, - struct ifnet *ifp, struct label *ifplabel) +test_posixsem_check_destroy(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { - LABEL_CHECK(bpflabel, MAGIC_BPF); - LABEL_CHECK(ifplabel, MAGIC_IFNET); - COUNTER_INC(bpfdesc_check_receive); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_check_destroy); return (0); } -COUNTER_DECL(cred_check_relabel); +COUNTER_DECL(posixsem_check_getvalue); static int -test_cred_check_relabel(struct ucred *cred, struct label *newlabel) +test_posixsem_check_getvalue(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(newlabel, MAGIC_CRED); - COUNTER_INC(cred_check_relabel); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_check_getvalue); return (0); } -COUNTER_DECL(cred_check_visible); +COUNTER_DECL(posixsem_check_open); static int -test_cred_check_visible(struct ucred *u1, struct ucred *u2) +test_posixsem_check_open(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { - LABEL_CHECK(u1->cr_label, MAGIC_CRED); - LABEL_CHECK(u2->cr_label, MAGIC_CRED); - COUNTER_INC(cred_check_visible); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_check_open); return (0); } -COUNTER_DECL(ifnet_check_relabel); +COUNTER_DECL(posixsem_check_post); static int -test_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, - struct label *ifplabel, struct label *newlabel) +test_posixsem_check_post(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(ifplabel, MAGIC_IFNET); - LABEL_CHECK(newlabel, MAGIC_IFNET); - COUNTER_INC(ifnet_check_relabel); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_check_post); return (0); } -COUNTER_DECL(ifnet_check_transmit); +COUNTER_DECL(posixsem_check_unlink); static int -test_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, - struct mbuf *m, struct label *mbuflabel) +test_posixsem_check_unlink(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { - LABEL_CHECK(ifplabel, MAGIC_IFNET); - LABEL_CHECK(mbuflabel, MAGIC_MBUF); - COUNTER_INC(ifnet_check_transmit); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_check_unlink); return (0); } -COUNTER_DECL(inpcb_check_deliver); +COUNTER_DECL(posixsem_check_wait); static int -test_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, - struct mbuf *m, struct label *mlabel) +test_posixsem_check_wait(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { - LABEL_CHECK(inplabel, MAGIC_INPCB); - LABEL_CHECK(mlabel, MAGIC_MBUF); - COUNTER_INC(inpcb_check_deliver); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_check_wait); return (0); } -COUNTER_DECL(sysvmsq_check_msgmsq); -static int -test_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, - struct label *msglabel, struct msqid_kernel *msqkptr, - struct label *msqklabel) +COUNTER_DECL(posixsem_create); +static void +test_posixsem_create(struct ucred *cred, struct ksem *ks, + struct label *kslabel) { - LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); - LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msgmsq); + LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_create); +} - return (0); +COUNTER_DECL(posixsem_destroy_label); +static void +test_posixsem_destroy_label(struct label *label) +{ + + LABEL_DESTROY(label, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_destroy_label); } -COUNTER_DECL(sysvmsq_check_msgrcv); +COUNTER_DECL(posixsem_init_label); +static void +test_posixsem_init_label(struct label *label) +{ + + LABEL_INIT(label, MAGIC_POSIX_SEM); + COUNTER_INC(posixsem_init_label); +} + +COUNTER_DECL(proc_check_debug); static int -test_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, - struct label *msglabel) +test_proc_check_debug(struct ucred *cred, struct proc *p) { - LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msgrcv); + LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); + COUNTER_INC(proc_check_debug); return (0); } -COUNTER_DECL(sysvmsq_check_msgrmid); +COUNTER_DECL(proc_check_sched); static int -test_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, - struct label *msglabel) +test_proc_check_sched(struct ucred *cred, struct proc *p) { - LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msgrmid); + LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); + COUNTER_INC(proc_check_sched); return (0); } -COUNTER_DECL(sysvmsq_check_msqget); +COUNTER_DECL(proc_check_signal); static int -test_sysvmsq_check_msqget(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel) +test_proc_check_signal(struct ucred *cred, struct proc *p, int signum) { - LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msqget); + LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); + COUNTER_INC(proc_check_signal); return (0); } -COUNTER_DECL(sysvmsq_check_msqsnd); +COUNTER_DECL(proc_check_setaudit); static int -test_sysvmsq_check_msqsnd(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel) +test_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai) { - LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msqsnd); + COUNTER_INC(proc_check_setaudit); return (0); } -COUNTER_DECL(sysvmsq_check_msqrcv); +COUNTER_DECL(proc_check_setaudit_addr); static int -test_sysvmsq_check_msqrcv(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel) +test_proc_check_setaudit_addr(struct ucred *cred, + struct auditinfo_addr *aia) { - LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msqrcv); + COUNTER_INC(proc_check_setaudit_addr); return (0); } -COUNTER_DECL(sysvmsq_check_msqctl); +COUNTER_DECL(proc_check_setauid); static int -test_sysvmsq_check_msqctl(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd) +test_proc_check_setauid(struct ucred *cred, uid_t auid) { - LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(sysvmsq_check_msqctl); + COUNTER_INC(proc_check_setauid); return (0); } -COUNTER_DECL(sysvsem_check_semctl); +COUNTER_DECL(proc_check_setegid); static int -test_sysvsem_check_semctl(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel, int cmd) +test_proc_check_setegid(struct ucred *cred, gid_t egid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_check_semctl); + COUNTER_INC(proc_check_setegid); - return (0); + return (0); } -COUNTER_DECL(sysvsem_check_semget); +COUNTER_DECL(proc_check_euid); static int -test_sysvsem_check_semget(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel) +test_proc_check_seteuid(struct ucred *cred, uid_t euid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_check_semget); + COUNTER_INC(proc_check_euid); return (0); } -COUNTER_DECL(sysvsem_check_semop); +COUNTER_DECL(proc_check_setregid); static int -test_sysvsem_check_semop(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel, size_t accesstype) +test_proc_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM); - COUNTER_INC(sysvsem_check_semop); + COUNTER_INC(proc_check_setregid); return (0); } -COUNTER_DECL(sysvshm_check_shmat); +COUNTER_DECL(proc_check_setreuid); static int -test_sysvshm_check_shmat(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) +test_proc_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_check_shmat); + COUNTER_INC(proc_check_setreuid); - return (0); + return (0); } -COUNTER_DECL(sysvshm_check_shmctl); +COUNTER_DECL(proc_check_setgid); static int -test_sysvshm_check_shmctl(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd) +test_proc_check_setgid(struct ucred *cred, gid_t gid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_check_shmctl); + COUNTER_INC(proc_check_setgid); - return (0); + return (0); } -COUNTER_DECL(sysvshm_check_shmdt); +COUNTER_DECL(proc_check_setgroups); static int -test_sysvshm_check_shmdt(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel) +test_proc_check_setgroups(struct ucred *cred, int ngroups, + gid_t *gidset) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_check_shmdt); + COUNTER_INC(proc_check_setgroups); return (0); } -COUNTER_DECL(sysvshm_check_shmget); +COUNTER_DECL(proc_check_setresgid); static int -test_sysvshm_check_shmget(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) +test_proc_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid, + gid_t sgid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); - COUNTER_INC(sysvshm_check_shmget); + COUNTER_INC(proc_check_setresgid); return (0); } -COUNTER_DECL(kenv_check_dump); +COUNTER_DECL(proc_check_setresuid); static int -test_kenv_check_dump(struct ucred *cred) +test_proc_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid, + uid_t suid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(kenv_check_dump); + COUNTER_INC(proc_check_setresuid); return (0); } -COUNTER_DECL(kenv_check_get); +COUNTER_DECL(proc_check_setuid); static int -test_kenv_check_get(struct ucred *cred, char *name) +test_proc_check_setuid(struct ucred *cred, uid_t uid) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(kenv_check_get); + COUNTER_INC(proc_check_setuid); return (0); } -COUNTER_DECL(kenv_check_set); +COUNTER_DECL(proc_check_wait); static int -test_kenv_check_set(struct ucred *cred, char *name, char *value) +test_proc_check_wait(struct ucred *cred, struct proc *p) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(kenv_check_set); + LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); + COUNTER_INC(proc_check_wait); return (0); } -COUNTER_DECL(kenv_check_unset); -static int -test_kenv_check_unset(struct ucred *cred, char *name) +COUNTER_DECL(proc_create_init); +static void +test_proc_create_init(struct ucred *cred) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(kenv_check_unset); - - return (0); + COUNTER_INC(proc_create_init); } -COUNTER_DECL(kld_check_load); -static int -test_kld_check_load(struct ucred *cred, struct vnode *vp, - struct label *label) +COUNTER_DECL(proc_create_swapper); +static void +test_proc_create_swapper(struct ucred *cred) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(label, MAGIC_VNODE); - COUNTER_INC(kld_check_load); + COUNTER_INC(proc_create_swapper); +} - return (0); +COUNTER_DECL(proc_destroy_label); +static void +test_proc_destroy_label(struct label *label) +{ + + LABEL_DESTROY(label, MAGIC_PROC); + COUNTER_INC(proc_destroy_label); } -COUNTER_DECL(kld_check_stat); +COUNTER_DECL(proc_init_label); +static void +test_proc_init_label(struct label *label) +{ + + LABEL_INIT(label, MAGIC_PROC); + COUNTER_INC(proc_init_label); +} + +COUNTER_DECL(socket_check_accept); static int -test_kld_check_stat(struct ucred *cred) +test_socket_check_accept(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(kld_check_stat); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_accept); return (0); } -COUNTER_DECL(mount_check_stat); +COUNTER_DECL(socket_check_bind); static int -test_mount_check_stat(struct ucred *cred, struct mount *mp, - struct label *mplabel) +test_socket_check_bind(struct ucred *cred, struct socket *so, + struct label *solabel, struct sockaddr *sa) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(mplabel, MAGIC_MOUNT); - COUNTER_INC(mount_check_stat); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_bind); return (0); } -COUNTER_DECL(pipe_check_ioctl); +COUNTER_DECL(socket_check_connect); static int -test_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) +test_socket_check_connect(struct ucred *cred, struct socket *so, + struct label *solabel, struct sockaddr *sa) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - COUNTER_INC(pipe_check_ioctl); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_connect); return (0); } -COUNTER_DECL(pipe_check_poll); +COUNTER_DECL(socket_check_deliver); static int -test_pipe_check_poll(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel) +test_socket_check_deliver(struct socket *so, struct label *solabel, + struct mbuf *m, struct label *mlabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - COUNTER_INC(pipe_check_poll); + LABEL_CHECK(solabel, MAGIC_SOCKET); + LABEL_CHECK(mlabel, MAGIC_MBUF); + COUNTER_INC(socket_check_deliver); return (0); } -COUNTER_DECL(pipe_check_read); +COUNTER_DECL(socket_check_listen); static int -test_pipe_check_read(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel) +test_socket_check_listen(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - COUNTER_INC(pipe_check_read); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_listen); return (0); } -COUNTER_DECL(pipe_check_relabel); +COUNTER_DECL(socket_check_poll); static int -test_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel, struct label *newlabel) +test_socket_check_poll(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - LABEL_CHECK(newlabel, MAGIC_PIPE); - COUNTER_INC(pipe_check_relabel); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_poll); return (0); } -COUNTER_DECL(pipe_check_stat); +COUNTER_DECL(socket_check_receive); static int -test_pipe_check_stat(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel) +test_socket_check_receive(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - COUNTER_INC(pipe_check_stat); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_receive); return (0); } -COUNTER_DECL(pipe_check_write); +COUNTER_DECL(socket_check_relabel); static int -test_pipe_check_write(struct ucred *cred, struct pipepair *pp, - struct label *pipelabel) +test_socket_check_relabel(struct ucred *cred, struct socket *so, + struct label *solabel, struct label *newlabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(pipelabel, MAGIC_PIPE); - COUNTER_INC(pipe_check_write); + LABEL_CHECK(solabel, MAGIC_SOCKET); + LABEL_CHECK(newlabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_relabel); return (0); } -COUNTER_DECL(posixsem_check_destroy); +COUNTER_DECL(socket_check_send); static int -test_posixsem_check_destroy(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +test_socket_check_send(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_check_destroy); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_send); return (0); } -COUNTER_DECL(posixsem_check_getvalue); +COUNTER_DECL(socket_check_stat); static int -test_posixsem_check_getvalue(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +test_socket_check_stat(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_check_getvalue); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_stat); return (0); } -COUNTER_DECL(posixsem_check_open); +COUNTER_DECL(socket_check_visible); static int -test_posixsem_check_open(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +test_socket_check_visible(struct ucred *cred, struct socket *so, + struct label *solabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_check_open); + LABEL_CHECK(solabel, MAGIC_SOCKET); + COUNTER_INC(socket_check_visible); return (0); } -COUNTER_DECL(posixsem_check_post); -static int -test_posixsem_check_post(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +COUNTER_DECL(socket_copy_label); +static void +test_socket_copy_label(struct label *src, struct label *dest) +{ + + LABEL_CHECK(src, MAGIC_SOCKET); + LABEL_CHECK(dest, MAGIC_SOCKET); + COUNTER_INC(socket_copy_label); +} + +COUNTER_DECL(socket_create); +static void +test_socket_create(struct ucred *cred, struct socket *socket, + struct label *socketlabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_check_post); + LABEL_CHECK(socketlabel, MAGIC_SOCKET); + COUNTER_INC(socket_create); +} - return (0); +COUNTER_DECL(socket_create_mbuf); +static void +test_socket_create_mbuf(struct socket *so, struct label *socketlabel, + struct mbuf *m, struct label *mbuflabel) +{ + + LABEL_CHECK(socketlabel, MAGIC_SOCKET); + LABEL_CHECK(mbuflabel, MAGIC_MBUF); + COUNTER_INC(socket_create_mbuf); } -COUNTER_DECL(posixsem_check_unlink); +COUNTER_DECL(socket_destroy_label); +static void +test_socket_destroy_label(struct label *label) +{ + + LABEL_DESTROY(label, MAGIC_SOCKET); + COUNTER_INC(socket_destroy_label); +} + +COUNTER_DECL(socket_externalize_label); static int -test_posixsem_check_unlink(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +test_socket_externalize_label(struct label *label, char *element_name, + struct sbuf *sb, int *claimed) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_check_unlink); + LABEL_CHECK(label, MAGIC_SOCKET); + COUNTER_INC(socket_externalize_label); return (0); } -COUNTER_DECL(posixsem_check_wait); +COUNTER_DECL(socket_init_label); static int -test_posixsem_check_wait(struct ucred *cred, struct ksem *ks, - struct label *kslabel) +test_socket_init_label(struct label *label, int flag) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(kslabel, MAGIC_POSIX_SEM); - COUNTER_INC(posixsem_check_wait); + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "test_socket_init_label() at %s:%d", __FILE__, + __LINE__); + LABEL_INIT(label, MAGIC_SOCKET); + COUNTER_INC(socket_init_label); return (0); } -COUNTER_DECL(proc_check_debug); -static int -test_proc_check_debug(struct ucred *cred, struct proc *p) +COUNTER_DECL(socket_newconn); +static void +test_socket_newconn(struct socket *oldsocket, + struct label *oldsocketlabel, struct socket *newsocket, + struct label *newsocketlabel) +{ + + LABEL_CHECK(oldsocketlabel, MAGIC_SOCKET); + LABEL_CHECK(newsocketlabel, MAGIC_SOCKET); + COUNTER_INC(socket_newconn); +} + +COUNTER_DECL(socket_relabel); +static void +test_socket_relabel(struct ucred *cred, struct socket *socket, + struct label *socketlabel, struct label *newlabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_debug); + LABEL_CHECK(newlabel, MAGIC_SOCKET); + COUNTER_INC(socket_relabel); +} - return (0); +COUNTER_DECL(socketpeer_destroy_label); +static void +test_socketpeer_destroy_label(struct label *label) +{ + + LABEL_DESTROY(label, MAGIC_SOCKET); + COUNTER_INC(socketpeer_destroy_label); } -COUNTER_DECL(proc_check_sched); +COUNTER_DECL(socketpeer_externalize_label); static int -test_proc_check_sched(struct ucred *cred, struct proc *p) +test_socketpeer_externalize_label(struct label *label, char *element_name, + struct sbuf *sb, int *claimed) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_sched); + LABEL_CHECK(label, MAGIC_SOCKET); + COUNTER_INC(socketpeer_externalize_label); return (0); } -COUNTER_DECL(proc_check_signal); +COUNTER_DECL(socketpeer_init_label); static int -test_proc_check_signal(struct ucred *cred, struct proc *p, int signum) +test_socketpeer_init_label(struct label *label, int flag) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_signal); + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "test_socketpeer_init_label() at %s:%d", __FILE__, + __LINE__); + LABEL_INIT(label, MAGIC_SOCKET); + COUNTER_INC(socketpeer_init_label); return (0); } -COUNTER_DECL(proc_check_setaudit); -static int -test_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai) +COUNTER_DECL(socketpeer_set_from_mbuf); +static void +test_socketpeer_set_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, + struct socket *socket, struct label *socketpeerlabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setaudit); + LABEL_CHECK(mbuflabel, MAGIC_MBUF); + LABEL_CHECK(socketpeerlabel, MAGIC_SOCKET); + COUNTER_INC(socketpeer_set_from_mbuf); +} - return (0); +COUNTER_DECL(socketpeer_set_from_socket); +static void +test_socketpeer_set_from_socket(struct socket *oldsocket, + struct label *oldsocketlabel, struct socket *newsocket, + struct label *newsocketpeerlabel) +{ + + LABEL_CHECK(oldsocketlabel, MAGIC_SOCKET); + LABEL_CHECK(newsocketpeerlabel, MAGIC_SOCKET); + COUNTER_INC(socketpeer_set_from_socket); } -COUNTER_DECL(proc_check_setaudit_addr); -static int -test_proc_check_setaudit_addr(struct ucred *cred, - struct auditinfo_addr *aia) +COUNTER_DECL(syncache_create); +static void +test_syncache_create(struct label *label, struct inpcb *inp) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setaudit_addr); + LABEL_CHECK(label, MAGIC_SYNCACHE); + COUNTER_INC(syncache_create); +} - return (0); +COUNTER_DECL(syncache_create_mbuf); +static void +test_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, + struct label *mlabel) +{ + + LABEL_CHECK(sc_label, MAGIC_SYNCACHE); + LABEL_CHECK(mlabel, MAGIC_MBUF); + COUNTER_INC(syncache_create_mbuf); } -COUNTER_DECL(proc_check_setauid); -static int -test_proc_check_setauid(struct ucred *cred, uid_t auid) +COUNTER_DECL(syncache_destroy_label); +static void +test_syncache_destroy_label(struct label *label) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setauid); + LABEL_DESTROY(label, MAGIC_SYNCACHE); + COUNTER_INC(syncache_destroy_label); +} + +COUNTER_DECL(syncache_init_label); +static int +test_syncache_init_label(struct label *label, int flag) +{ + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "test_syncache_init_label() at %s:%d", __FILE__, + __LINE__); + LABEL_INIT(label, MAGIC_SYNCACHE); + COUNTER_INC(syncache_init_label); return (0); } -COUNTER_DECL(proc_check_setuid); +COUNTER_DECL(system_check_acct); static int -test_proc_check_setuid(struct ucred *cred, uid_t uid) +test_system_check_acct(struct ucred *cred, struct vnode *vp, + struct label *vplabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setuid); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(system_check_acct); return (0); } -COUNTER_DECL(proc_check_euid); +COUNTER_DECL(system_check_audit); static int -test_proc_check_seteuid(struct ucred *cred, uid_t euid) +test_system_check_audit(struct ucred *cred, void *record, int length) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_euid); + COUNTER_INC(system_check_audit); return (0); } -COUNTER_DECL(proc_check_setgid); +COUNTER_DECL(system_check_auditctl); static int -test_proc_check_setgid(struct ucred *cred, gid_t gid) +test_system_check_auditctl(struct ucred *cred, struct vnode *vp, + struct label *vplabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setgid); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(system_check_auditctl); return (0); } -COUNTER_DECL(proc_check_setegid); +COUNTER_DECL(system_check_auditon); static int -test_proc_check_setegid(struct ucred *cred, gid_t egid) +test_system_check_auditon(struct ucred *cred, int cmd) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setegid); + COUNTER_INC(system_check_auditon); return (0); } -COUNTER_DECL(proc_check_setgroups); +COUNTER_DECL(system_check_reboot); static int -test_proc_check_setgroups(struct ucred *cred, int ngroups, - gid_t *gidset) +test_system_check_reboot(struct ucred *cred, int how) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setgroups); + COUNTER_INC(system_check_reboot); return (0); } -COUNTER_DECL(proc_check_setreuid); +COUNTER_DECL(system_check_swapoff); static int -test_proc_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid) +test_system_check_swapoff(struct ucred *cred, struct vnode *vp, + struct label *vplabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setreuid); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(system_check_swapoff); return (0); } -COUNTER_DECL(proc_check_setregid); +COUNTER_DECL(system_check_swapon); static int -test_proc_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid) +test_system_check_swapon(struct ucred *cred, struct vnode *vp, + struct label *vplabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setregid); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(system_check_swapon); return (0); } -COUNTER_DECL(proc_check_setresuid); +COUNTER_DECL(system_check_sysctl); static int -test_proc_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid, - uid_t suid) +test_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, + void *arg1, int arg2, struct sysctl_req *req) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setresuid); + COUNTER_INC(system_check_sysctl); return (0); } -COUNTER_DECL(proc_check_setresgid); -static int -test_proc_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid, - gid_t sgid) +COUNTER_DECL(sysvmsg_cleanup); +static void +test_sysvmsg_cleanup(struct label *msglabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_setresgid); + LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); + COUNTER_INC(sysvmsg_cleanup); +} - return (0); +COUNTER_DECL(sysvmsg_create); +static void +test_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqlabel, struct msg *msgptr, struct label *msglabel) +{ + + LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); + LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ); + COUNTER_INC(sysvmsg_create); } -COUNTER_DECL(proc_check_wait); -static int -test_proc_check_wait(struct ucred *cred, struct proc *p) +COUNTER_DECL(sysvmsg_destroy_label); +static void +test_sysvmsg_destroy_label(struct label *label) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED); - COUNTER_INC(proc_check_wait); + LABEL_DESTROY(label, MAGIC_SYSV_MSG); + COUNTER_INC(sysvmsg_destroy_label); +} - return (0); +COUNTER_DECL(sysvmsg_init_label); +static void +test_sysvmsg_init_label(struct label *label) +{ + LABEL_INIT(label, MAGIC_SYSV_MSG); + COUNTER_INC(sysvmsg_init_label); } -COUNTER_DECL(socket_check_accept); +COUNTER_DECL(sysvmsq_check_msgmsq); static int -test_socket_check_accept(struct ucred *cred, struct socket *so, - struct label *solabel) +test_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, + struct label *msglabel, struct msqid_kernel *msqkptr, + struct label *msqklabel) { + LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); + LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_accept); + COUNTER_INC(sysvmsq_check_msgmsq); - return (0); + return (0); } -COUNTER_DECL(socket_check_bind); +COUNTER_DECL(sysvmsq_check_msgrcv); static int -test_socket_check_bind(struct ucred *cred, struct socket *so, - struct label *solabel, struct sockaddr *sa) +test_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, + struct label *msglabel) { + LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_bind); + COUNTER_INC(sysvmsq_check_msgrcv); return (0); } -COUNTER_DECL(socket_check_connect); +COUNTER_DECL(sysvmsq_check_msgrmid); static int -test_socket_check_connect(struct ucred *cred, struct socket *so, - struct label *solabel, struct sockaddr *sa) +test_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, + struct label *msglabel) { + LABEL_CHECK(msglabel, MAGIC_SYSV_MSG); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_connect); + COUNTER_INC(sysvmsq_check_msgrmid); return (0); } -COUNTER_DECL(socket_check_deliver); +COUNTER_DECL(sysvmsq_check_msqget); static int -test_socket_check_deliver(struct socket *so, struct label *solabel, - struct mbuf *m, struct label *mlabel) +test_sysvmsq_check_msqget(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel) { - LABEL_CHECK(solabel, MAGIC_SOCKET); - LABEL_CHECK(mlabel, MAGIC_MBUF); - COUNTER_INC(socket_check_deliver); + LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + COUNTER_INC(sysvmsq_check_msqget); return (0); } -COUNTER_DECL(socket_check_listen); +COUNTER_DECL(sysvmsq_check_msqsnd); static int -test_socket_check_listen(struct ucred *cred, struct socket *so, - struct label *solabel) +test_sysvmsq_check_msqsnd(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel) { + LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_listen); + COUNTER_INC(sysvmsq_check_msqsnd); return (0); } -COUNTER_DECL(socket_check_poll); +COUNTER_DECL(sysvmsq_check_msqrcv); static int -test_socket_check_poll(struct ucred *cred, struct socket *so, - struct label *solabel) +test_sysvmsq_check_msqrcv(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel) { + LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_poll); + COUNTER_INC(sysvmsq_check_msqrcv); return (0); } -COUNTER_DECL(socket_check_receive); +COUNTER_DECL(sysvmsq_check_msqctl); static int -test_socket_check_receive(struct ucred *cred, struct socket *so, - struct label *solabel) +test_sysvmsq_check_msqctl(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd) { + LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ); LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_receive); + COUNTER_INC(sysvmsq_check_msqctl); return (0); } -COUNTER_DECL(socket_check_relabel); -static int -test_socket_check_relabel(struct ucred *cred, struct socket *so, - struct label *solabel, struct label *newlabel) +COUNTER_DECL(sysvmsq_cleanup); +static void +test_sysvmsq_cleanup(struct label *msqlabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - LABEL_CHECK(newlabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_relabel); + LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ); + COUNTER_INC(sysvmsq_cleanup); +} - return (0); +COUNTER_DECL(sysvmsq_create); +static void +test_sysvmsq_create(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqlabel) +{ + + LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ); + COUNTER_INC(sysvmsq_create); } -COUNTER_DECL(socket_check_send); -static int -test_socket_check_send(struct ucred *cred, struct socket *so, - struct label *solabel) +COUNTER_DECL(sysvmsq_destroy_label); +static void +test_sysvmsq_destroy_label(struct label *label) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_send); + LABEL_DESTROY(label, MAGIC_SYSV_MSQ); + COUNTER_INC(sysvmsq_destroy_label); +} - return (0); +COUNTER_DECL(sysvmsq_init_label); +static void +test_sysvmsq_init_label(struct label *label) +{ + LABEL_INIT(label, MAGIC_SYSV_MSQ); + COUNTER_INC(sysvmsq_init_label); } -COUNTER_DECL(socket_check_stat); +COUNTER_DECL(sysvsem_check_semctl); static int -test_socket_check_stat(struct ucred *cred, struct socket *so, - struct label *solabel) +test_sysvsem_check_semctl(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel, int cmd) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_stat); + LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_check_semctl); - return (0); + return (0); } -COUNTER_DECL(socket_check_visible); +COUNTER_DECL(sysvsem_check_semget); static int -test_socket_check_visible(struct ucred *cred, struct socket *so, - struct label *solabel) +test_sysvsem_check_semget(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(solabel, MAGIC_SOCKET); - COUNTER_INC(socket_check_visible); + LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_check_semget); return (0); } -COUNTER_DECL(system_check_acct); +COUNTER_DECL(sysvsem_check_semop); static int -test_system_check_acct(struct ucred *cred, struct vnode *vp, - struct label *vplabel) +test_sysvsem_check_semop(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel, size_t accesstype) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(system_check_acct); + LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_check_semop); return (0); } -COUNTER_DECL(system_check_audit); -static int -test_system_check_audit(struct ucred *cred, void *record, int length) +COUNTER_DECL(sysvsem_cleanup); +static void +test_sysvsem_cleanup(struct label *semalabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(system_check_audit); + LABEL_CHECK(semalabel, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_cleanup); +} - return (0); +COUNTER_DECL(sysvsem_create); +static void +test_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, + struct label *semalabel) +{ + + LABEL_CHECK(semalabel, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_create); } -COUNTER_DECL(system_check_auditctl); -static int -test_system_check_auditctl(struct ucred *cred, struct vnode *vp, - struct label *vplabel) +COUNTER_DECL(sysvsem_destroy_label); +static void +test_sysvsem_destroy_label(struct label *label) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(system_check_auditctl); + LABEL_DESTROY(label, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_destroy_label); +} - return (0); +COUNTER_DECL(sysvsem_init_label); +static void +test_sysvsem_init_label(struct label *label) +{ + LABEL_INIT(label, MAGIC_SYSV_SEM); + COUNTER_INC(sysvsem_init_label); } -COUNTER_DECL(system_check_auditon); +COUNTER_DECL(sysvshm_check_shmat); static int -test_system_check_auditon(struct ucred *cred, int cmd) +test_sysvshm_check_shmat(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(system_check_auditon); + LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_check_shmat); - return (0); + return (0); } -COUNTER_DECL(system_check_reboot); +COUNTER_DECL(sysvshm_check_shmctl); static int -test_system_check_reboot(struct ucred *cred, int how) +test_sysvshm_check_shmctl(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(system_check_reboot); + LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_check_shmctl); - return (0); + return (0); } -COUNTER_DECL(system_check_swapoff); +COUNTER_DECL(sysvshm_check_shmdt); static int -test_system_check_swapoff(struct ucred *cred, struct vnode *vp, - struct label *vplabel) +test_sysvshm_check_shmdt(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(system_check_swapoff); + LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_check_shmdt); return (0); } -COUNTER_DECL(system_check_swapon); +COUNTER_DECL(sysvshm_check_shmget); static int -test_system_check_swapon(struct ucred *cred, struct vnode *vp, - struct label *vplabel) +test_sysvshm_check_shmget(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) { LABEL_CHECK(cred->cr_label, MAGIC_CRED); - LABEL_CHECK(vplabel, MAGIC_VNODE); - COUNTER_INC(system_check_swapon); + LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_check_shmget); return (0); } -COUNTER_DECL(system_check_sysctl); +COUNTER_DECL(sysvshm_cleanup); +static void +test_sysvshm_cleanup(struct label *shmlabel) +{ + + LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_cleanup); +} + +COUNTER_DECL(sysvshm_create); +static void +test_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, + struct label *shmlabel) +{ + + LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_create); +} + +COUNTER_DECL(sysvshm_destroy_label); +static void +test_sysvshm_destroy_label(struct label *label) +{ + + LABEL_DESTROY(label, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_destroy_label); +} + +COUNTER_DECL(sysvshm_init_label); +static void +test_sysvshm_init_label(struct label *label) +{ + LABEL_INIT(label, MAGIC_SYSV_SHM); + COUNTER_INC(sysvshm_init_label); +} + +COUNTER_DECL(thread_userret); +static void +test_thread_userret(struct thread *td) +{ + + COUNTER_INC(thread_userret); +} + +COUNTER_DECL(vnode_associate_extattr); static int -test_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, - void *arg1, int arg2, struct sysctl_req *req) +test_vnode_associate_extattr(struct mount *mp, struct label *mplabel, + struct vnode *vp, struct label *vplabel) { - LABEL_CHECK(cred->cr_label, MAGIC_CRED); - COUNTER_INC(system_check_sysctl); + LABEL_CHECK(mplabel, MAGIC_MOUNT); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(vnode_associate_extattr); return (0); } +COUNTER_DECL(vnode_associate_singlelabel); +static void +test_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, + struct vnode *vp, struct label *vplabel) +{ + + LABEL_CHECK(mplabel, MAGIC_MOUNT); + LABEL_CHECK(vplabel, MAGIC_VNODE); + COUNTER_INC(vnode_associate_singlelabel); +} + COUNTER_DECL(vnode_check_access); static int test_vnode_check_access(struct ucred *cred, struct vnode *vp, @@ -2662,176 +2534,257 @@ test_vnode_check_write(struct ucred *active_cred, return (0); } +COUNTER_DECL(vnode_copy_label); +static void +test_vnode_copy_label(struct label *src, struct label *dest) +{ + + LABEL_CHECK(src, MAGIC_VNODE); + LABEL_CHECK(dest, MAGIC_VNODE); + COUNTER_INC(vnode_copy_label); +} + +COUNTER_DECL(vnode_create_extattr); +static int +test_vnode_create_extattr(struct ucred *cred, struct mount *mp, + struct label *mplabel, struct vnode *dvp, struct label *dvplabel, + struct vnode *vp, struct label *vplabel, struct componentname *cnp) +{ + + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(mplabel, MAGIC_MOUNT); + LABEL_CHECK(dvplabel, MAGIC_VNODE); + COUNTER_INC(vnode_create_extattr); + + return (0); +} + +COUNTER_DECL(vnode_destroy_label); +static void +test_vnode_destroy_label(struct label *label) +{ + + LABEL_DESTROY(label, MAGIC_VNODE); + COUNTER_INC(vnode_destroy_label); +} + +COUNTER_DECL(vnode_execve_transition); +static void +test_vnode_execve_transition(struct ucred *old, struct ucred *new, + struct vnode *vp, struct label *filelabel, + struct label *interpvplabel, struct image_params *imgp, + struct label *execlabel) +{ + + LABEL_CHECK(old->cr_label, MAGIC_CRED); + LABEL_CHECK(new->cr_label, MAGIC_CRED); + LABEL_CHECK(filelabel, MAGIC_VNODE); + LABEL_CHECK(interpvplabel, MAGIC_VNODE); + LABEL_CHECK(execlabel, MAGIC_CRED); + COUNTER_INC(vnode_execve_transition); +} + +COUNTER_DECL(vnode_execve_will_transition); +static int +test_vnode_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *filelabel, struct label *interpvplabel, + struct image_params *imgp, struct label *execlabel) +{ + + LABEL_CHECK(old->cr_label, MAGIC_CRED); + LABEL_CHECK(filelabel, MAGIC_VNODE); + LABEL_CHECK(interpvplabel, MAGIC_VNODE); + LABEL_CHECK(execlabel, MAGIC_CRED); + COUNTER_INC(vnode_execve_will_transition); + + return (0); +} + +COUNTER_DECL(vnode_externalize_label); +static int +test_vnode_externalize_label(struct label *label, char *element_name, + struct sbuf *sb, int *claimed) +{ + + LABEL_CHECK(label, MAGIC_VNODE); + COUNTER_INC(vnode_externalize_label); + + return (0); +} + +COUNTER_DECL(vnode_init_label); +static void +test_vnode_init_label(struct label *label) +{ + + LABEL_INIT(label, MAGIC_VNODE); + COUNTER_INC(vnode_init_label); +} + +COUNTER_DECL(vnode_relabel); +static void +test_vnode_relabel(struct ucred *cred, struct vnode *vp, + struct label *vplabel, struct label *label) +{ + + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(vplabel, MAGIC_VNODE); + LABEL_CHECK(label, MAGIC_VNODE); + COUNTER_INC(vnode_relabel); +} + +COUNTER_DECL(vnode_setlabel_extattr); +static int +test_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, + struct label *vplabel, struct label *intlabel) +{ + + LABEL_CHECK(cred->cr_label, MAGIC_CRED); + LABEL_CHECK(vplabel, MAGIC_VNODE); + LABEL_CHECK(intlabel, MAGIC_VNODE); + COUNTER_INC(vnode_setlabel_extattr); + + return (0); +} + static struct mac_policy_ops test_ops = { - .mpo_bpfdesc_init_label = test_bpfdesc_init_label, - .mpo_cred_init_label = test_cred_init_label, - .mpo_devfs_init_label = test_devfs_init_label, - .mpo_ifnet_init_label = test_ifnet_init_label, - .mpo_syncache_init_label = test_syncache_init_label, - .mpo_sysvmsg_init_label = test_sysvmsg_init_label, - .mpo_sysvmsq_init_label = test_sysvmsq_init_label, - .mpo_sysvsem_init_label = test_sysvsem_init_label, - .mpo_sysvshm_init_label = test_sysvshm_init_label, - .mpo_inpcb_init_label = test_inpcb_init_label, - .mpo_ipq_init_label = test_ipq_init_label, - .mpo_mbuf_init_label = test_mbuf_init_label, - .mpo_mount_init_label = test_mount_init_label, - .mpo_pipe_init_label = test_pipe_init_label, - .mpo_posixsem_init_label = test_posixsem_init_label, - .mpo_proc_init_label = test_proc_init_label, - .mpo_socket_init_label = test_socket_init_label, - .mpo_socketpeer_init_label = test_socketpeer_init_label, - .mpo_vnode_init_label = test_vnode_init_label, + .mpo_bpfdesc_check_receive = test_bpfdesc_check_receive, + .mpo_bpfdesc_create = test_bpfdesc_create, + .mpo_bpfdesc_create_mbuf = test_bpfdesc_create_mbuf, .mpo_bpfdesc_destroy_label = test_bpfdesc_destroy_label, - .mpo_cred_destroy_label = test_cred_destroy_label, - .mpo_devfs_destroy_label = test_devfs_destroy_label, - .mpo_ifnet_destroy_label = test_ifnet_destroy_label, - .mpo_syncache_destroy_label = test_syncache_destroy_label, - .mpo_sysvmsg_destroy_label = test_sysvmsg_destroy_label, - .mpo_sysvmsq_destroy_label = - test_sysvmsq_destroy_label, - .mpo_sysvsem_destroy_label = test_sysvsem_destroy_label, - .mpo_sysvshm_destroy_label = test_sysvshm_destroy_label, - .mpo_inpcb_destroy_label = test_inpcb_destroy_label, - .mpo_ipq_destroy_label = test_ipq_destroy_label, - .mpo_mbuf_destroy_label = test_mbuf_destroy_label, - .mpo_mount_destroy_label = test_mount_destroy_label, - .mpo_pipe_destroy_label = test_pipe_destroy_label, - .mpo_posixsem_destroy_label = test_posixsem_destroy_label, - .mpo_proc_destroy_label = test_proc_destroy_label, - .mpo_socket_destroy_label = test_socket_destroy_label, - .mpo_socketpeer_destroy_label = test_socketpeer_destroy_label, - .mpo_vnode_destroy_label = test_vnode_destroy_label, + .mpo_bpfdesc_init_label = test_bpfdesc_init_label, + + .mpo_cred_check_relabel = test_cred_check_relabel, + .mpo_cred_check_visible = test_cred_check_visible, .mpo_cred_copy_label = test_cred_copy_label, - .mpo_ifnet_copy_label = test_ifnet_copy_label, - .mpo_mbuf_copy_label = test_mbuf_copy_label, - .mpo_pipe_copy_label = test_pipe_copy_label, - .mpo_socket_copy_label = test_socket_copy_label, - .mpo_vnode_copy_label = test_vnode_copy_label, + .mpo_cred_destroy_label = test_cred_destroy_label, .mpo_cred_externalize_label = test_cred_externalize_label, - .mpo_ifnet_externalize_label = test_ifnet_externalize_label, - .mpo_pipe_externalize_label = test_pipe_externalize_label, - .mpo_socket_externalize_label = test_socket_externalize_label, - .mpo_socketpeer_externalize_label = test_socketpeer_externalize_label, - .mpo_vnode_externalize_label = test_vnode_externalize_label, + .mpo_cred_init_label = test_cred_init_label, .mpo_cred_internalize_label = test_internalize_label, - .mpo_ifnet_internalize_label = test_internalize_label, - .mpo_pipe_internalize_label = test_internalize_label, - .mpo_socket_internalize_label = test_internalize_label, - .mpo_vnode_internalize_label = test_internalize_label, - .mpo_devfs_vnode_associate = test_devfs_vnode_associate, - .mpo_vnode_associate_extattr = test_vnode_associate_extattr, - .mpo_vnode_associate_singlelabel = test_vnode_associate_singlelabel, + .mpo_cred_relabel = test_cred_relabel, + .mpo_devfs_create_device = test_devfs_create_device, .mpo_devfs_create_directory = test_devfs_create_directory, .mpo_devfs_create_symlink = test_devfs_create_symlink, - .mpo_vnode_create_extattr = test_vnode_create_extattr, - .mpo_mount_create = test_mount_create, - .mpo_vnode_relabel = test_vnode_relabel, - .mpo_vnode_setlabel_extattr = test_vnode_setlabel_extattr, + .mpo_devfs_destroy_label = test_devfs_destroy_label, + .mpo_devfs_init_label = test_devfs_init_label, .mpo_devfs_update = test_devfs_update, - .mpo_socket_create_mbuf = test_socket_create_mbuf, - .mpo_pipe_create = test_pipe_create, - .mpo_posixsem_create = test_posixsem_create, - .mpo_socket_create = test_socket_create, - .mpo_socket_newconn = test_socket_newconn, - .mpo_pipe_relabel = test_pipe_relabel, - .mpo_socket_relabel = test_socket_relabel, - .mpo_socketpeer_set_from_mbuf = test_socketpeer_set_from_mbuf, - .mpo_socketpeer_set_from_socket = test_socketpeer_set_from_socket, - .mpo_bpfdesc_create = test_bpfdesc_create, + .mpo_devfs_vnode_associate = test_devfs_vnode_associate, + + .mpo_ifnet_check_relabel = test_ifnet_check_relabel, + .mpo_ifnet_check_transmit = test_ifnet_check_transmit, + .mpo_ifnet_copy_label = test_ifnet_copy_label, .mpo_ifnet_create = test_ifnet_create, + .mpo_ifnet_create_mbuf = test_ifnet_create_mbuf, + .mpo_ifnet_destroy_label = test_ifnet_destroy_label, + .mpo_ifnet_externalize_label = test_ifnet_externalize_label, + .mpo_ifnet_init_label = test_ifnet_init_label, + .mpo_ifnet_internalize_label = test_internalize_label, + .mpo_ifnet_relabel = test_ifnet_relabel, + + .mpo_syncache_destroy_label = test_syncache_destroy_label, + .mpo_syncache_init_label = test_syncache_init_label, + + .mpo_sysvmsg_destroy_label = test_sysvmsg_destroy_label, + .mpo_sysvmsg_init_label = test_sysvmsg_init_label, + + .mpo_sysvmsq_destroy_label = test_sysvmsq_destroy_label, + .mpo_sysvmsq_init_label = test_sysvmsq_init_label, + + .mpo_sysvsem_destroy_label = test_sysvsem_destroy_label, + .mpo_sysvsem_init_label = test_sysvsem_init_label, + + .mpo_sysvshm_destroy_label = test_sysvshm_destroy_label, + .mpo_sysvshm_init_label = test_sysvshm_init_label, + + .mpo_inpcb_check_deliver = test_inpcb_check_deliver, .mpo_inpcb_create = test_inpcb_create, - .mpo_syncache_create = test_syncache_create, - .mpo_syncache_create_mbuf = test_syncache_create_mbuf, - .mpo_sysvmsg_create = test_sysvmsg_create, - .mpo_sysvmsq_create = test_sysvmsq_create, - .mpo_sysvsem_create = test_sysvsem_create, - .mpo_sysvshm_create = test_sysvshm_create, - .mpo_ipq_reassemble = test_ipq_reassemble, - .mpo_netinet_fragment = test_netinet_fragment, - .mpo_ipq_create = test_ipq_create, .mpo_inpcb_create_mbuf = test_inpcb_create_mbuf, - .mpo_bpfdesc_create_mbuf = test_bpfdesc_create_mbuf, - .mpo_ifnet_create_mbuf = test_ifnet_create_mbuf, + .mpo_inpcb_destroy_label = test_inpcb_destroy_label, + .mpo_inpcb_init_label = test_inpcb_init_label, + .mpo_inpcb_sosetlabel = test_inpcb_sosetlabel, + + .mpo_ipq_create = test_ipq_create, + .mpo_ipq_destroy_label = test_ipq_destroy_label, + .mpo_ipq_init_label = test_ipq_init_label, .mpo_ipq_match = test_ipq_match, - .mpo_netatalk_aarp_send = test_netatalk_aarp_send, - .mpo_netinet_arp_send = test_netinet_arp_send, - .mpo_netinet_icmp_reply = test_netinet_icmp_reply, - .mpo_netinet_icmp_replyinplace = test_netinet_icmp_replyinplace, - .mpo_netinet_igmp_send = test_netinet_igmp_send, - .mpo_netinet_tcp_reply = test_netinet_tcp_reply, - .mpo_netinet6_nd6_send = test_netinet6_nd6_send, - .mpo_ifnet_relabel = test_ifnet_relabel, + .mpo_ipq_reassemble = test_ipq_reassemble, .mpo_ipq_update = test_ipq_update, - .mpo_inpcb_sosetlabel = test_inpcb_sosetlabel, - .mpo_vnode_execve_transition = test_vnode_execve_transition, - .mpo_vnode_execve_will_transition = - test_vnode_execve_will_transition, - .mpo_proc_create_swapper = test_proc_create_swapper, - .mpo_proc_create_init = test_proc_create_init, - .mpo_cred_relabel = test_cred_relabel, - .mpo_thread_userret = test_thread_userret, - .mpo_sysvmsg_cleanup = test_sysvmsg_cleanup, - .mpo_sysvmsq_cleanup = test_sysvmsq_cleanup, - .mpo_sysvsem_cleanup = test_sysvsem_cleanup, - .mpo_sysvshm_cleanup = test_sysvshm_cleanup, - .mpo_bpfdesc_check_receive = test_bpfdesc_check_receive, - .mpo_cred_check_relabel = test_cred_check_relabel, - .mpo_cred_check_visible = test_cred_check_visible, - .mpo_ifnet_check_relabel = test_ifnet_check_relabel, - .mpo_ifnet_check_transmit = test_ifnet_check_transmit, - .mpo_inpcb_check_deliver = test_inpcb_check_deliver, - .mpo_sysvmsq_check_msgmsq = test_sysvmsq_check_msgmsq, - .mpo_sysvmsq_check_msgrcv = test_sysvmsq_check_msgrcv, - .mpo_sysvmsq_check_msgrmid = test_sysvmsq_check_msgrmid, - .mpo_sysvmsq_check_msqget = test_sysvmsq_check_msqget, - .mpo_sysvmsq_check_msqsnd = test_sysvmsq_check_msqsnd, - .mpo_sysvmsq_check_msqrcv = test_sysvmsq_check_msqrcv, - .mpo_sysvmsq_check_msqctl = test_sysvmsq_check_msqctl, - .mpo_sysvsem_check_semctl = test_sysvsem_check_semctl, - .mpo_sysvsem_check_semget = test_sysvsem_check_semget, - .mpo_sysvsem_check_semop = test_sysvsem_check_semop, - .mpo_sysvshm_check_shmat = test_sysvshm_check_shmat, - .mpo_sysvshm_check_shmctl = test_sysvshm_check_shmctl, - .mpo_sysvshm_check_shmdt = test_sysvshm_check_shmdt, - .mpo_sysvshm_check_shmget = test_sysvshm_check_shmget, + .mpo_kenv_check_dump = test_kenv_check_dump, .mpo_kenv_check_get = test_kenv_check_get, .mpo_kenv_check_set = test_kenv_check_set, .mpo_kenv_check_unset = test_kenv_check_unset, + .mpo_kld_check_load = test_kld_check_load, .mpo_kld_check_stat = test_kld_check_stat, + + .mpo_mbuf_copy_label = test_mbuf_copy_label, + .mpo_mbuf_destroy_label = test_mbuf_destroy_label, + .mpo_mbuf_init_label = test_mbuf_init_label, + .mpo_mount_check_stat = test_mount_check_stat, + .mpo_mount_create = test_mount_create, + .mpo_mount_destroy_label = test_mount_destroy_label, + .mpo_mount_init_label = test_mount_init_label, + + .mpo_netatalk_aarp_send = test_netatalk_aarp_send, + + .mpo_netinet_arp_send = test_netinet_arp_send, + .mpo_netinet_fragment = test_netinet_fragment, + .mpo_netinet_icmp_reply = test_netinet_icmp_reply, + .mpo_netinet_icmp_replyinplace = test_netinet_icmp_replyinplace, + .mpo_netinet_igmp_send = test_netinet_igmp_send, + .mpo_netinet_tcp_reply = test_netinet_tcp_reply, + + .mpo_netinet6_nd6_send = test_netinet6_nd6_send, + .mpo_pipe_check_ioctl = test_pipe_check_ioctl, .mpo_pipe_check_poll = test_pipe_check_poll, .mpo_pipe_check_read = test_pipe_check_read, .mpo_pipe_check_relabel = test_pipe_check_relabel, .mpo_pipe_check_stat = test_pipe_check_stat, .mpo_pipe_check_write = test_pipe_check_write, + .mpo_pipe_copy_label = test_pipe_copy_label, + .mpo_pipe_create = test_pipe_create, + .mpo_pipe_destroy_label = test_pipe_destroy_label, + .mpo_pipe_externalize_label = test_pipe_externalize_label, + .mpo_pipe_init_label = test_pipe_init_label, + .mpo_pipe_internalize_label = test_internalize_label, + .mpo_pipe_relabel = test_pipe_relabel, + .mpo_posixsem_check_destroy = test_posixsem_check_destroy, .mpo_posixsem_check_getvalue = test_posixsem_check_getvalue, .mpo_posixsem_check_open = test_posixsem_check_open, .mpo_posixsem_check_post = test_posixsem_check_post, .mpo_posixsem_check_unlink = test_posixsem_check_unlink, .mpo_posixsem_check_wait = test_posixsem_check_wait, + .mpo_posixsem_create = test_posixsem_create, + .mpo_posixsem_destroy_label = test_posixsem_destroy_label, + .mpo_posixsem_init_label = test_posixsem_init_label, + .mpo_proc_check_debug = test_proc_check_debug, .mpo_proc_check_sched = test_proc_check_sched, .mpo_proc_check_setaudit = test_proc_check_setaudit, .mpo_proc_check_setaudit_addr = test_proc_check_setaudit_addr, .mpo_proc_check_setauid = test_proc_check_setauid, - .mpo_proc_check_setuid = test_proc_check_setuid, .mpo_proc_check_seteuid = test_proc_check_seteuid, - .mpo_proc_check_setgid = test_proc_check_setgid, .mpo_proc_check_setegid = test_proc_check_setegid, + .mpo_proc_check_setgid = test_proc_check_setgid, .mpo_proc_check_setgroups = test_proc_check_setgroups, - .mpo_proc_check_setreuid = test_proc_check_setreuid, .mpo_proc_check_setregid = test_proc_check_setregid, - .mpo_proc_check_setresuid = test_proc_check_setresuid, .mpo_proc_check_setresgid = test_proc_check_setresgid, + .mpo_proc_check_setresuid = test_proc_check_setresuid, + .mpo_proc_check_setreuid = test_proc_check_setreuid, + .mpo_proc_check_setuid = test_proc_check_setuid, .mpo_proc_check_signal = test_proc_check_signal, .mpo_proc_check_wait = test_proc_check_wait, + .mpo_proc_create_init = test_proc_create_init, + .mpo_proc_create_swapper = test_proc_create_swapper, + .mpo_proc_destroy_label = test_proc_destroy_label, + .mpo_proc_init_label = test_proc_init_label, + .mpo_socket_check_accept = test_socket_check_accept, .mpo_socket_check_bind = test_socket_check_bind, .mpo_socket_check_connect = test_socket_check_connect, @@ -2843,6 +2796,25 @@ static struct mac_policy_ops test_ops = .mpo_socket_check_send = test_socket_check_send, .mpo_socket_check_stat = test_socket_check_stat, .mpo_socket_check_visible = test_socket_check_visible, + .mpo_socket_copy_label = test_socket_copy_label, + .mpo_socket_create = test_socket_create, + .mpo_socket_create_mbuf = test_socket_create_mbuf, + .mpo_socket_destroy_label = test_socket_destroy_label, + .mpo_socket_externalize_label = test_socket_externalize_label, + .mpo_socket_init_label = test_socket_init_label, + .mpo_socket_internalize_label = test_internalize_label, + .mpo_socket_newconn = test_socket_newconn, + .mpo_socket_relabel = test_socket_relabel, + + .mpo_socketpeer_destroy_label = test_socketpeer_destroy_label, + .mpo_socketpeer_externalize_label = test_socketpeer_externalize_label, + .mpo_socketpeer_init_label = test_socketpeer_init_label, + .mpo_socketpeer_set_from_mbuf = test_socketpeer_set_from_mbuf, + .mpo_socketpeer_set_from_socket = test_socketpeer_set_from_socket, + + .mpo_syncache_create = test_syncache_create, + .mpo_syncache_create_mbuf = test_syncache_create_mbuf, + .mpo_system_check_acct = test_system_check_acct, .mpo_system_check_audit = test_system_check_audit, .mpo_system_check_auditctl = test_system_check_auditctl, @@ -2851,7 +2823,38 @@ static struct mac_policy_ops test_ops = .mpo_system_check_swapoff = test_system_check_swapoff, .mpo_system_check_swapon = test_system_check_swapon, .mpo_system_check_sysctl = test_system_check_sysctl, + .mpo_vnode_check_access = test_vnode_check_access, + .mpo_sysvmsg_cleanup = test_sysvmsg_cleanup, + .mpo_sysvmsg_create = test_sysvmsg_create, + + .mpo_sysvmsq_check_msgmsq = test_sysvmsq_check_msgmsq, + .mpo_sysvmsq_check_msgrcv = test_sysvmsq_check_msgrcv, + .mpo_sysvmsq_check_msgrmid = test_sysvmsq_check_msgrmid, + .mpo_sysvmsq_check_msqget = test_sysvmsq_check_msqget, + .mpo_sysvmsq_check_msqsnd = test_sysvmsq_check_msqsnd, + .mpo_sysvmsq_check_msqrcv = test_sysvmsq_check_msqrcv, + .mpo_sysvmsq_check_msqctl = test_sysvmsq_check_msqctl, + .mpo_sysvmsq_cleanup = test_sysvmsq_cleanup, + .mpo_sysvmsq_create = test_sysvmsq_create, + + .mpo_sysvsem_check_semctl = test_sysvsem_check_semctl, + .mpo_sysvsem_check_semget = test_sysvsem_check_semget, + .mpo_sysvsem_check_semop = test_sysvsem_check_semop, + .mpo_sysvsem_cleanup = test_sysvsem_cleanup, + .mpo_sysvsem_create = test_sysvsem_create, + + .mpo_sysvshm_check_shmat = test_sysvshm_check_shmat, + .mpo_sysvshm_check_shmctl = test_sysvshm_check_shmctl, + .mpo_sysvshm_check_shmdt = test_sysvshm_check_shmdt, + .mpo_sysvshm_check_shmget = test_sysvshm_check_shmget, + .mpo_sysvshm_cleanup = test_sysvshm_cleanup, + .mpo_sysvshm_create = test_sysvshm_create, + + .mpo_thread_userret = test_thread_userret, + + .mpo_vnode_associate_extattr = test_vnode_associate_extattr, + .mpo_vnode_associate_singlelabel = test_vnode_associate_singlelabel, .mpo_vnode_check_chdir = test_vnode_check_chdir, .mpo_vnode_check_chroot = test_vnode_check_chroot, .mpo_vnode_check_create = test_vnode_check_create, @@ -2882,6 +2885,16 @@ static struct mac_policy_ops test_ops = .mpo_vnode_check_stat = test_vnode_check_stat, .mpo_vnode_check_unlink = test_vnode_check_unlink, .mpo_vnode_check_write = test_vnode_check_write, + .mpo_vnode_copy_label = test_vnode_copy_label, + .mpo_vnode_create_extattr = test_vnode_create_extattr, + .mpo_vnode_destroy_label = test_vnode_destroy_label, + .mpo_vnode_execve_transition = test_vnode_execve_transition, + .mpo_vnode_execve_will_transition = test_vnode_execve_will_transition, + .mpo_vnode_externalize_label = test_vnode_externalize_label, + .mpo_vnode_init_label = test_vnode_init_label, + .mpo_vnode_internalize_label = test_internalize_label, + .mpo_vnode_relabel = test_vnode_relabel, + .mpo_vnode_setlabel_extattr = test_vnode_setlabel_extattr, }; MAC_POLICY_SET(&test_ops, mac_test, "TrustedBSD MAC/Test", |