Declare a module service "kernel_mac_support" when MAC support is

enabled and the kernel provides the MAC registration and entry point
service.  Declare a dependency on that module service for any
MAC module registered using mac_policy.h.  For now, hard code the
version as 1, but once we've come up with a versioning policy, we'll
move to a #define of some sort.  In the mean time, this will prevent
loading a MAC module when 'options MAC' isn't present, which (due to
a bug in the kernel linker) can result if the MAC module is preloaded
via loader.conf.

This particular evil recommended by:	peter
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI LAbs

9 files changed, 65 insertions, 0 deletions

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index f38c017..7d279aa 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -481,6 +481,7 @@ struct mac_policy_conf {
 		mac_policy_modevent,					\
 		&mpname##_mac_policy_conf				\
 	};								\
+	MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1);		\
 	DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY,		\
 	    SI_ORDER_MIDDLE)
 
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 6544f01..547647c 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -54,6 +54,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/mac.h>
+#include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -87,6 +88,13 @@
 
 #ifdef MAC
 
+/*
+ * Declare that the kernel provides MAC support, version 1.  This permits
+ * modules to refuse to be loaded if the necessary support isn't present,
+ * even if it's pre-boot.
+ */
+MODULE_VERSION(kernel_mac_support, 1);
+
 SYSCTL_DECL(_security);
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,