Introduce a MAC label reference in 'struct inpcb', which caches

the   MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols.  This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.

This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.

For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks.  Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.

Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.

Reviewed by:	sam, bms
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

1 files changed, 7 insertions, 0 deletions

diff --git a/sys/sys/mac.h b/sys/sys/mac.h
index 8cb20ad..81dad5a 100644
--- a/sys/sys/mac.h
+++ b/sys/sys/mac.h
@@ -110,7 +110,9 @@ struct componentname;
 struct devfs_dirent;
 struct ifnet;
 struct ifreq;
+struct inpcb;
 struct image_params;
+struct inpcb;
 struct ipq;
 struct m_tag;
 struct mbuf;
@@ -137,6 +139,7 @@ void	mac_init_bpfdesc(struct bpf_d *);
 void	mac_init_cred(struct ucred *);
 void	mac_init_devfsdirent(struct devfs_dirent *);
 void	mac_init_ifnet(struct ifnet *);
+int	mac_init_inpcb(struct inpcb *, int flag);
 int	mac_init_ipq(struct ipq *, int flag);
 int	mac_init_socket(struct socket *, int flag);
 void	mac_init_pipe(struct pipe *);
@@ -151,6 +154,7 @@ void	mac_destroy_bpfdesc(struct bpf_d *);
 void	mac_destroy_cred(struct ucred *);
 void	mac_destroy_devfsdirent(struct devfs_dirent *);
 void	mac_destroy_ifnet(struct ifnet *);
+void	mac_destroy_inpcb(struct inpcb *);
 void	mac_destroy_ipq(struct ipq *);
 void	mac_destroy_socket(struct socket *);
 void	mac_destroy_pipe(struct pipe *);
@@ -205,6 +209,7 @@ void	mac_create_pipe(struct ucred *cred, struct pipe *pipe);
  */
 void	mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d);
 void	mac_create_ifnet(struct ifnet *ifp);
+void	mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp);
 void	mac_create_ipq(struct mbuf *fragment, struct ipq *ipq);
 void	mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram);
 void	mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment);
@@ -219,6 +224,7 @@ int	mac_fragment_match(struct mbuf *fragment, struct ipq *ipq);
 void	mac_reflect_mbuf_icmp(struct mbuf *m);
 void	mac_reflect_mbuf_tcp(struct mbuf *m);
 void	mac_update_ipq(struct mbuf *fragment, struct ipq *ipq);
+void	mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
 
 /*
  * Labeling event operations: processes.
@@ -239,6 +245,7 @@ void	mac_thread_userret(struct thread *td);
 int	mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
 int	mac_check_cred_visible(struct ucred *u1, struct ucred *u2);
 int	mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m);
+int	mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m);
 int	mac_check_kenv_dump(struct ucred *cred);
 int	mac_check_kenv_get(struct ucred *cred, char *name);
 int	mac_check_kenv_set(struct ucred *cred, char *name, char *value);