summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--lib/libc/posix1e/Makefile.inc27
-rw-r--r--lib/libc/posix1e/mac.3140
-rw-r--r--lib/libc/posix1e/mac_biba.c218
-rw-r--r--lib/libc/posix1e/mac_free.373
-rw-r--r--lib/libc/posix1e/mac_free.c45
-rw-r--r--lib/libc/posix1e/mac_get.3108
-rw-r--r--lib/libc/posix1e/mac_get.c101
-rw-r--r--lib/libc/posix1e/mac_internal.h50
-rw-r--r--lib/libc/posix1e/mac_is_present.373
-rw-r--r--lib/libc/posix1e/mac_is_present_np.373
-rw-r--r--lib/libc/posix1e/mac_is_present_np.c86
-rw-r--r--lib/libc/posix1e/mac_mls.c218
-rw-r--r--lib/libc/posix1e/mac_sebsd.c67
-rw-r--r--lib/libc/posix1e/mac_set.3124
-rw-r--r--lib/libc/posix1e/mac_set.c56
-rw-r--r--lib/libc/posix1e/mac_te.c70
-rw-r--r--lib/libc/posix1e/mac_text.3169
-rw-r--r--lib/libc/posix1e/mac_text.c182
18 files changed, 1878 insertions, 2 deletions
diff --git a/lib/libc/posix1e/Makefile.inc b/lib/libc/posix1e/Makefile.inc
index f042e6d..abac906 100644
--- a/lib/libc/posix1e/Makefile.inc
+++ b/lib/libc/posix1e/Makefile.inc
@@ -18,7 +18,16 @@ SRCS+= acl_calc_mask.c \
acl_support.c \
acl_to_text.c \
acl_valid.c \
- extattr.c
+ extattr.c \
+ mac_biba.c \
+ mac_free.c \
+ mac_is_present_np.c \
+ mac_get.c \
+ mac_mls.c \
+ mac_sebsd.c \
+ mac_set.c \
+ mac_te.c \
+ mac_text.c
.if ${LIB} == "c"
@@ -48,6 +57,12 @@ MAN+= acl.3 \
acl_to_text.3 \
acl_valid.3 \
extattr.3 \
+ mac.3 \
+ mac_free.3 \
+ mac_is_present_np.3 \
+ mac_get.3 \
+ mac_set.3 \
+ mac_text.3 \
posix1e.3
MLINKS+=acl_delete.3 acl_delete_def_file.3 \
@@ -62,6 +77,14 @@ MLINKS+=acl_delete.3 acl_delete_def_file.3 \
acl_valid.3 acl_valid_file_np.3 \
acl_valid.3 acl_valid_fd_np.3 \
extattr.3 extattr_namespace_to_string.3 \
- extattr.3 extattr_string_to_namespace.3
+ extattr.3 extattr_string_to_namespace.3 \
+ mac_get.3 mac_get_fd.3 \
+ mac_get.3 mac_get_file.3 \
+ mac_get.3 mac_get_proc.3 \
+ mac_set.3 mac_set_fd.3 \
+ mac_set.3 mac_set_file.3 \
+ mac_set.3 mac_set_proc.3 \
+ mac_text.3 mac_from_text.3 \
+ mac_text.3 mac_to_text.3
.endif
diff --git a/lib/libc/posix1e/mac.3 b/lib/libc/posix1e/mac.3
new file mode 100644
index 0000000..c6a70d0
--- /dev/null
+++ b/lib/libc/posix1e/mac.3
@@ -0,0 +1,140 @@
+.\" Copyright (c) 2001 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd December 21, 2001
+.Dt MAC 3
+.Sh NAME
+.Nm mac
+.Nd introduction to the POSIX.1e MAC security API
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/mac.h
+.Pp
+In the kernel configuration file:
+.Cd "options MAC"
+.Sh DESCRIPTION
+.Fx
+permits administrators to define Mandatory Access Control labels
+defining levels for the privacy and integrity of data,
+overriding discretionary policies
+for those objects.
+Not all objects currently provide support for MAC labels,
+and MAC support must be explicitly enabled by the administrator.
+The library calls include routines to retrieve, duplicate,
+and set MAC labels associated with files and processes.
+.Pp
+POSIX.1e describes a set of MAC manipulation routines
+to manage the contents of MAC labels,
+as well as their relationships with
+files and processes;
+almost all of these support routines
+are implemented in
+.Fx .
+.Pp
+Available functions, sorted by behavior, include:
+.Bl -tag -width indent
+.It Fn mac_get_fd
+This function is described in
+.Xr mac_get 3 ,
+and may be used to retrieve the
+MAC label associated with
+a specific file descriptor.
+.It Fn mac_get_file
+This function is described in
+.Xr mac_get 3 ,
+and may be used to retrieve the
+MAC label associated with
+a named file.
+.It Fn mac_get_proc
+This function is described in
+.Xr mac_get 3 ,
+and may be used to retrieve the
+MAC label associated with
+the calling process.
+.It Fn mac_set_fd
+This function is described in
+.Xr mac_set 3 ,
+and may be used to set the
+MAC label associated with
+a specific file descriptor.
+.It Fn mac_set_file
+This function is described in
+.Xr mac_set 3 ,
+and may be used to set the
+MAC label associated with
+a named file.
+.It Fn mac_set_proc
+This function is described in
+.Xr mac_set 3 ,
+and may be used to set the
+MAC label associated with
+the calling process.
+.It Fn mac_free
+This function is described in
+.Xr mac_free 3 ,
+and may be used to free
+userland working MAC label storage.
+.It Fn mac_from_text
+This function is described in
+.Xr mac_text 3 ,
+and may be used to convert
+a text-form MAC label
+into a working
+.Vt mac_t .
+.It Fn mac_to_text
+This function is described in
+.Xr mac_text 3 ,
+and may be used to convert a
+.Vt mac_t
+into a text-form MAC label.
+.El
+.Sh IMPLEMENTATION NOTES
+.Fx Ns 's
+support for POSIX.1e interfaces and features
+is still under development
+at this time.
+.Sh SEE ALSO
+.Xr mac_free 3 ,
+.Xr mac_get 3 ,
+.Xr mac_set 3 ,
+.Xr mac_text 3
+.Sh STANDARDS
+POSIX.1e is described in IEEE POSIX.1e draft 17.
+Discussion of the draft
+continues on the cross-platform POSIX.1e implementation mailing list.
+To join this list, see the
+.Fx
+POSIX.1e implementation page
+for more information.
diff --git a/lib/libc/posix1e/mac_biba.c b/lib/libc/posix1e/mac_biba.c
new file mode 100644
index 0000000..7d32480
--- /dev/null
+++ b/lib/libc/posix1e/mac_biba.c
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * This software was developed for the FreeBSD Project in part by NAI Labs,
+ * the Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <security/mac_biba/mac_biba.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * Biba labels take the following format:
+ * [optional bibasingle][optional bibarange]
+ * bibasingle: {low,0-65535,high,equal}
+ * bibarange: ([bibasingle]-[bibasingle])
+ */
+
+/*
+ * Extract mac_biba_element contents from a string.
+ */
+static int
+mac_biba_element_from_string(char *string, struct mac_biba_element *element)
+{
+ unsigned long value;
+ char *endp;
+ int error;
+
+ if (strcmp(string, "low") == 0) {
+ element->mbe_type = MAC_BIBA_TYPE_LOW;
+ element->mbe_grade = 0;
+ error = 0;
+ } else if (strcmp(string, "high") == 0) {
+ element->mbe_type = MAC_BIBA_TYPE_HIGH;
+ element->mbe_grade = 0;
+ error = 0;
+ } else if (strcmp(string, "equal") == 0) {
+ element->mbe_type = MAC_BIBA_TYPE_EQUAL;
+ element->mbe_grade = 0;
+ error = 0;
+ } else {
+ value = strtoul(string, &endp, 10);
+ if (*endp == '\0' && value == (u_short) value) {
+ element->mbe_type = MAC_BIBA_TYPE_GRADE;
+ element->mbe_grade = value;
+ error = 0;
+ } else
+ error = EINVAL;
+ }
+
+ return (error);
+}
+
+/*
+ * Destructively convert a string into a mac_biba.
+ */
+int
+mac_biba_label_from_string(char *string, struct mac *label)
+{
+ char *string_single, *string_rangelow, *string_rangehigh;
+ int error;
+
+ bzero(&label->m_biba, sizeof(label->m_biba));
+
+ /*
+ * Is a '(' present?, if so check for last character of ')', and
+ * split into single and range strings after nulling the '(' and
+ * ')'. Reject if appropriate.
+ */
+
+ string_single = strsep(&string, "(");
+ if (*string_single == '\0' && string == NULL) {
+ /* No interesting elements to parse, flags already zero'd. */
+ return (0);
+ }
+ if (string != NULL) {
+ /* If a '(' was present, last character must be ')'. */
+ if (*string == '\0')
+ return (EINVAL);
+ if (string[strlen(string)-1] != ')')
+ return (EINVAL);
+ string[strlen(string)-1] = '\0';
+ }
+
+ /*
+ * If range is present, split range into rangelow and rangehigh
+ * based on '-', if present, and nul it. Process range elements.
+ * Reject if appropriate.
+ */
+ if (string != NULL) {
+ string_rangehigh = string;
+ string_rangelow = strsep(&string_rangehigh, "-");
+ if (*string_rangelow == '\0' || string_rangehigh == NULL)
+ return (EINVAL);
+ error = mac_biba_element_from_string(string_rangelow,
+ &label->m_biba.mb_rangelow);
+ if (error)
+ return (error);
+ error = mac_biba_element_from_string(string_rangehigh,
+ &label->m_biba.mb_rangehigh);
+ if (error)
+ return (error);
+ label->m_biba.mb_flags |= MAC_BIBA_FLAG_RANGE;
+ }
+
+ /*
+ * If single is present, process single and reject if needed.
+ */
+ if (*string_single != '\0') {
+ error = mac_biba_element_from_string(string_single,
+ &label->m_biba.mb_single);
+ if (error)
+ return (error);
+ label->m_biba.mb_flags |= MAC_BIBA_FLAG_SINGLE;
+ }
+
+ return (0);
+}
+
+static char *
+mac_biba_string_from_element(struct mac_biba_element *element)
+{
+ char *string;
+
+ switch(element->mbe_type) {
+ case MAC_BIBA_TYPE_LOW:
+ return (strdup("low"));
+
+ case MAC_BIBA_TYPE_HIGH:
+ return (strdup("high"));
+
+ case MAC_BIBA_TYPE_EQUAL:
+ return (strdup("equal"));
+
+ case MAC_BIBA_TYPE_GRADE:
+ asprintf(&string, "%d", element->mbe_grade);
+ return (string);
+
+ default:
+ return (strdup("invalid"));
+ }
+}
+
+char *
+mac_biba_string_from_label(struct mac *label)
+{
+ char *format_string = NULL;
+ char *string = NULL, *string_single = NULL, *string_rangelow = NULL;
+ char *string_rangehigh = NULL;
+
+ if (label->m_biba.mb_flags & MAC_BIBA_FLAG_SINGLE) {
+ string_single = mac_biba_string_from_element(
+ &label->m_biba.mb_single);
+ }
+ if (label->m_biba.mb_flags & MAC_BIBA_FLAG_RANGE) {
+ string_rangelow = mac_biba_string_from_element(
+ &label->m_biba.mb_rangelow);
+ string_rangehigh = mac_biba_string_from_element(
+ &label->m_biba.mb_rangehigh);
+ }
+
+ if (string_rangelow && string_single) {
+ asprintf(&string, "%s(%s-%s)", string_single, string_rangelow,
+ string_rangehigh);
+ } else if (string_rangelow) {
+ asprintf(&string, "(%s-%s)", string_rangelow,
+ string_rangehigh);
+ } else if (string_single) {
+ asprintf(&string, "%s", string_single);
+ } else
+ string = strdup("");
+
+ if (string_single)
+ free(string_single);
+ if (string_rangelow)
+ free(string_rangelow);
+ if (string_rangehigh)
+ free(string_rangehigh);
+
+ return (string);
+}
diff --git a/lib/libc/posix1e/mac_free.3 b/lib/libc/posix1e/mac_free.3
new file mode 100644
index 0000000..a29be1a
--- /dev/null
+++ b/lib/libc/posix1e/mac_free.3
@@ -0,0 +1,73 @@
+.\" Copyright (c) 2001 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd December 21, 2001
+.Dt MAC_FREE 3
+.Os
+.Sh NAME
+.Nm mac_free
+.Nd free MAC label
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/mac.h
+.Ft int
+.Fn mac_free "void *buf_p"
+.Sh DESCRIPTION
+The
+.Fn mac_free
+function frees the storage allocated to contain either a
+.Vt mac_t
+or a
+.Vt char * ,
+as allocated by the
+.Fn mac_to_text
+function.
+.Sh RETURN VALUES
+The
+.Fn mac_free
+function always returns 0.
+.Sh SEE ALSO
+.Xr mac 3 ,
+.Xr mac_get 3 ,
+.Xr mac_set 3 ,
+.Xr mac_text 3
+.Sh STANDARDS
+POSIX.1e is described in IEEE POSIX.1e draft 17.
+Discussion of the draft
+continues on the cross-platform POSIX.1e implementation mailing list.
+To join this list, see the
+.Fx
+POSIX.1e implementation page
+for more information.
diff --git a/lib/libc/posix1e/mac_free.c b/lib/libc/posix1e/mac_free.c
new file mode 100644
index 0000000..696ef42
--- /dev/null
+++ b/lib/libc/posix1e/mac_free.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <stdlib.h>
+
+int
+mac_free(void *buf_p)
+{
+
+ free(buf_p);
+ return (0);
+}
diff --git a/lib/libc/posix1e/mac_get.3 b/lib/libc/posix1e/mac_get.3
new file mode 100644
index 0000000..505aed0
--- /dev/null
+++ b/lib/libc/posix1e/mac_get.3
@@ -0,0 +1,108 @@
+.\" Copyright (c) 2001 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd December 21, 2001
+.Dt MAC_GET 3
+.Sh NAME
+.Nm mac_get_file ,
+.Nm mac_get_fd ,
+.Nm mac_get_proc
+.Nd get the label of a file, socket, socket peer or process
+.Sh SYNOPSIS
+.In sys/mac.h
+.Ft mac_t
+.Fn mac_get_file "const char *path_p"
+.Ft mac_t
+.Fn mac_get_fd "int fd"
+.Ft mac_t
+.Fn mac_get_proc
+.Sh DESCRIPTION
+The
+.Fn mac_get_file
+and
+.Fn mac_get_fd
+functions return the MAC label associated
+with the file referenced by
+the pathname pointed to by
+.Fa path_p
+or the file descriptor specified by
+.Fa fd ,
+respectively. Note this function will
+fail on socket descriptors. For information on
+getting MAC labels on socket descriptors see
+.Xr getsockopt 2 .
+The
+.Fn mac_get_proc
+function returns a MAC label associated
+with the requesting process.
+.Sh ERRORS
+.Bl -tag -width Er
+.It Bq Er EACCES
+A component of
+.Fa path_p
+is not searchable,
+or MAC read access to the file
+is denied.
+.It Bq Er ENAMETOOLONG
+The pathname pointed to by
+.Fa path_p
+exceeds
+.Dv PATH_MAX ,
+or a component of the pathname exceeds
+.Dv NAME_MAX .
+.It Bq Er ENOENT
+A component of
+.Fa path_p
+does not exist.
+.It Bq Er ENOMEM
+Insufficient memory is available
+to allocate a new MAC label structure.
+.It Bq Er ENOTDIR
+A component of
+.Fa path_p
+is not a directory.
+.El
+.Sh SEE ALSO
+.Xr mac 3 ,
+.Xr mac_free 3 ,
+.Xr mac_text 3 ,
+.Xr mac_set 3
+.Sh STANDARDS
+POSIX.1e is described in IEEE POSIX.1e draft 17.
+Discussion of the draft
+continues on the cross-platform POSIX.1e implementation mailing list.
+To join this list, see the
+.Fx
+POSIX.1e implementation page
+for more information.
diff --git a/lib/libc/posix1e/mac_get.c b/lib/libc/posix1e/mac_get.c
new file mode 100644
index 0000000..f983ec1
--- /dev/null
+++ b/lib/libc/posix1e/mac_get.c
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <errno.h>
+#include <stdlib.h>
+
+mac_t
+mac_get_file(const char *path_p)
+{
+ struct mac *label;
+ int error;
+
+ label = (mac_t) malloc(sizeof(*label));
+ if (label == NULL) {
+ errno = ENOMEM;
+ return (NULL);
+ }
+
+ error = __mac_get_file(path_p, label);
+ if (error) {
+ mac_free(label);
+ return (NULL);
+ }
+
+ return (label);
+}
+
+mac_t
+mac_get_fd(int fd)
+{
+ struct mac *label;
+ int error;
+
+ label = (mac_t) malloc(sizeof(*label));
+ if (label == NULL) {
+ errno = ENOMEM;
+ return (NULL);
+ }
+
+ error = __mac_get_fd(fd, label);
+ if (error) {
+ mac_free(label);
+ return (NULL);
+ }
+
+ return (label);
+}
+
+mac_t
+mac_get_proc()
+{
+ struct mac *label;
+ int error;
+
+ label = (mac_t) malloc(sizeof(*label));
+ if (label == NULL) {
+ errno = ENOMEM;
+ return (NULL);
+ }
+
+ error = __mac_get_proc(label);
+ if (error) {
+ mac_free(label);
+ return (NULL);
+ }
+
+ return (label);
+}
diff --git a/lib/libc/posix1e/mac_internal.h b/lib/libc/posix1e/mac_internal.h
new file mode 100644
index 0000000..20c46b3
--- /dev/null
+++ b/lib/libc/posix1e/mac_internal.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * This software was developed for the FreeBSD Project in part by NAI Labs,
+ * the Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Eventually, these per-policy interfaces will be handled via a
+ * standard userland MAC module interface.
+ */
+
+int mac_biba_label_from_string __P((char *string, struct mac *label));
+char *mac_biba_string_from_label __P((struct mac *label));
+int mac_mls_label_from_string __P((char *string, struct mac *label));
+char *mac_mls_string_from_label __P((struct mac *label));
+int mac_te_label_from_string __P((char *string, struct mac *label));
+char *mac_te_string_from_label __P((struct mac *label));
diff --git a/lib/libc/posix1e/mac_is_present.3 b/lib/libc/posix1e/mac_is_present.3
new file mode 100644
index 0000000..b7610ad
--- /dev/null
+++ b/lib/libc/posix1e/mac_is_present.3
@@ -0,0 +1,73 @@
+.\" Copyright (c) 2002 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd January 9, 2002
+.Dt MAC_IS_PRESENT_NP 3
+.Sh NAME
+.Nm mac_is_present_np
+.Nd report whether the running system has MAC support
+.Sh SYNOPSIS
+.In sys/mac.h
+.Ft int
+.Fn mac_is_present "const char *policyname"
+.Sh DESCRIPTION
+The
+.Fn mac_is_present_np
+function determines whether the currently-running kernel supports MAC for
+a given policy or not.
+If
+.Fa policyname
+is non-
+.Ns Dv NULL ,
+the presence of the named policy
+(e.g.
+.Dq biba ,
+.Dq mls ,
+.Dq te )
+is checked, otherwise the presence of any MAC policies at all is checked.
+.Sh RETURN VALUES
+If the system supports the given MAC policy, the value 1 is returned.
+If the specified MAC policy is not supported, the value 0 is returned.
+If an error occurs, the value -1 is returned.
+.Sh ERRORS
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The value of
+.Fa policyname
+is not valid.
+.It Bq Er ENOMEM
+Insufficient memory was available to allocate internal storage.
+.El
+.Sh SEE ALSO
+.Xr mac 3
diff --git a/lib/libc/posix1e/mac_is_present_np.3 b/lib/libc/posix1e/mac_is_present_np.3
new file mode 100644
index 0000000..b7610ad
--- /dev/null
+++ b/lib/libc/posix1e/mac_is_present_np.3
@@ -0,0 +1,73 @@
+.\" Copyright (c) 2002 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd January 9, 2002
+.Dt MAC_IS_PRESENT_NP 3
+.Sh NAME
+.Nm mac_is_present_np
+.Nd report whether the running system has MAC support
+.Sh SYNOPSIS
+.In sys/mac.h
+.Ft int
+.Fn mac_is_present "const char *policyname"
+.Sh DESCRIPTION
+The
+.Fn mac_is_present_np
+function determines whether the currently-running kernel supports MAC for
+a given policy or not.
+If
+.Fa policyname
+is non-
+.Ns Dv NULL ,
+the presence of the named policy
+(e.g.
+.Dq biba ,
+.Dq mls ,
+.Dq te )
+is checked, otherwise the presence of any MAC policies at all is checked.
+.Sh RETURN VALUES
+If the system supports the given MAC policy, the value 1 is returned.
+If the specified MAC policy is not supported, the value 0 is returned.
+If an error occurs, the value -1 is returned.
+.Sh ERRORS
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The value of
+.Fa policyname
+is not valid.
+.It Bq Er ENOMEM
+Insufficient memory was available to allocate internal storage.
+.El
+.Sh SEE ALSO
+.Xr mac 3
diff --git a/lib/libc/posix1e/mac_is_present_np.c b/lib/libc/posix1e/mac_is_present_np.c
new file mode 100644
index 0000000..8ffabe8
--- /dev/null
+++ b/lib/libc/posix1e/mac_is_present_np.c
@@ -0,0 +1,86 @@
+/*-
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by NAI Labs, the
+ * Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/sysctl.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * Simply test whether the TrustedBSD/MAC MIB tree is present; if so,
+ * return 1 to indicate that the system has MAC enabled overall or for
+ * a given policy.
+ */
+
+int
+mac_is_present_np(const char *policyname)
+{
+ int mib[5];
+ size_t siz;
+ char *mibname;
+ int error;
+
+ if (policyname != NULL) {
+ if (policyname[strcspn(policyname, ".=")] != '\0') {
+ errno = EINVAL;
+ return (-1);
+ }
+ mibname = malloc(sizeof("security.mac.") - 1 +
+ strlen(policyname) + sizeof(".enabled"));
+ if (mibname == NULL)
+ return (-1);
+ strcpy(mibname, "security.mac.");
+ strcat(mibname, policyname);
+ strcat(mibname, ".enabled");
+ siz = 5;
+ error = sysctlnametomib(mibname, mib, &siz);
+ free(mibname);
+ } else {
+ siz = 3;
+ error = sysctlnametomib("security.mac", mib, &siz);
+ }
+ if (error == -1) {
+ switch (errno) {
+ case ENOTDIR:
+ case ENOENT:
+ return (0);
+ default:
+ return (error);
+ }
+ }
+ return (1);
+}
diff --git a/lib/libc/posix1e/mac_mls.c b/lib/libc/posix1e/mac_mls.c
new file mode 100644
index 0000000..78d7b99
--- /dev/null
+++ b/lib/libc/posix1e/mac_mls.c
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * This software was developed for the FreeBSD Project in part by NAI Labs,
+ * the Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <security/mac_mls/mac_mls.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * MLS labels take the following format:
+ * [optional mlssingle][optional mlsrange]
+ * mlssingle: {low,0-65535,high,equal}
+ * mlsrange: ([mlssingle]-[mlssingle])
+ */
+
+/*
+ * Extract mac_mls_element contents from a string.
+ */
+static int
+mac_mls_element_from_string(char *string, struct mac_mls_element *element)
+{
+ unsigned long value;
+ char *endp;
+ int error;
+
+ if (strcmp(string, "low") == 0) {
+ element->mme_type = MAC_MLS_TYPE_LOW;
+ element->mme_level = 0;
+ error = 0;
+ } else if (strcmp(string, "high") == 0) {
+ element->mme_type = MAC_MLS_TYPE_HIGH;
+ element->mme_level = 0;
+ error = 0;
+ } else if (strcmp(string, "equal") == 0) {
+ element->mme_type = MAC_MLS_TYPE_EQUAL;
+ element->mme_level = 0;
+ error = 0;
+ } else {
+ value = strtoul(string, &endp, 10);
+ if (*endp == '\0' && value == (u_short) value) {
+ element->mme_type = MAC_MLS_TYPE_LEVEL;
+ element->mme_level = value;
+ error = 0;
+ } else
+ error = EINVAL;
+ }
+
+ return (error);
+}
+
+/*
+ * Destructively convert a string into a mac_mls.
+ */
+int
+mac_mls_label_from_string(char *string, struct mac *label)
+{
+ char *string_single, *string_rangelow, *string_rangehigh;
+ int error;
+
+ bzero(&label->m_mls, sizeof(label->m_mls));
+
+ /*
+ * Is a '(' present?, if so check for last character of ')', and
+ * split into single and range strings after nulling the '(' and
+ * ')'. Reject if appropriate.
+ */
+
+ string_single = strsep(&string, "(");
+ if (*string_single == '\0' && string == NULL) {
+ /* No interesting elements to parse, flags already zero'd. */
+ return (0);
+ }
+ if (string != NULL) {
+ /* If a '(' was present, last character must be ')'. */
+ if (*string == '\0')
+ return (EINVAL);
+ if (string[strlen(string)-1] != ')')
+ return (EINVAL);
+ string[strlen(string)-1] = '\0';
+ }
+
+ /*
+ * If range is present, split range into rangelow and rangehigh
+ * based on '-', if present, and nul it. Process range elements.
+ * Reject if appropriate.
+ */
+ if (string != NULL) {
+ string_rangehigh = string;
+ string_rangelow = strsep(&string_rangehigh, "-");
+ if (*string_rangelow == '\0' || string_rangehigh == NULL)
+ return (EINVAL);
+ error = mac_mls_element_from_string(string_rangelow,
+ &label->m_mls.mm_rangelow);
+ if (error)
+ return (error);
+ error = mac_mls_element_from_string(string_rangehigh,
+ &label->m_mls.mm_rangehigh);
+ if (error)
+ return (error);
+ label->m_mls.mm_flags |= MAC_MLS_FLAG_RANGE;
+ }
+
+ /*
+ * If single is present, process single and reject if needed.
+ */
+ if (*string_single != '\0') {
+ error = mac_mls_element_from_string(string_single,
+ &label->m_mls.mm_single);
+ if (error)
+ return (error);
+ label->m_mls.mm_flags |= MAC_MLS_FLAG_SINGLE;
+ }
+
+ return (0);
+}
+
+static char *
+mac_mls_string_from_element(struct mac_mls_element *element)
+{
+ char *string;
+
+ switch(element->mme_type) {
+ case MAC_MLS_TYPE_LOW:
+ return (strdup("low"));
+
+ case MAC_MLS_TYPE_HIGH:
+ return (strdup("high"));
+
+ case MAC_MLS_TYPE_EQUAL:
+ return (strdup("equal"));
+
+ case MAC_MLS_TYPE_LEVEL:
+ asprintf(&string, "%d", element->mme_level);
+ return (string);
+
+ default:
+ return (strdup("invalid"));
+ }
+}
+
+char *
+mac_mls_string_from_label(struct mac *label)
+{
+ char *format_string = NULL;
+ char *string = NULL, *string_single = NULL, *string_rangelow = NULL;
+ char *string_rangehigh = NULL;
+
+ if (label->m_mls.mm_flags & MAC_MLS_FLAG_SINGLE) {
+ string_single = mac_mls_string_from_element(
+ &label->m_mls.mm_single);
+ }
+ if (label->m_mls.mm_flags & MAC_MLS_FLAG_RANGE) {
+ string_rangelow = mac_mls_string_from_element(
+ &label->m_mls.mm_rangelow);
+ string_rangehigh = mac_mls_string_from_element(
+ &label->m_mls.mm_rangehigh);
+ }
+
+ if (string_rangelow && string_single) {
+ asprintf(&string, "%s(%s-%s)", string_single, string_rangelow,
+ string_rangehigh);
+ } else if (string_rangelow) {
+ asprintf(&string, "(%s-%s)", string_rangelow,
+ string_rangehigh);
+ } else if (string_single) {
+ asprintf(&string, "%s", string_single);
+ } else
+ string = strdup("");
+
+ if (string_single)
+ free(string_single);
+ if (string_rangelow)
+ free(string_rangelow);
+ if (string_rangehigh)
+ free(string_rangehigh);
+
+ return (string);
+}
diff --git a/lib/libc/posix1e/mac_sebsd.c b/lib/libc/posix1e/mac_sebsd.c
new file mode 100644
index 0000000..5a152bd
--- /dev/null
+++ b/lib/libc/posix1e/mac_sebsd.c
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * This software was developed for the FreeBSD Project in part by NAI Labs,
+ * the Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * SEBSD labels consist of a single psid_t.
+ */
+
+int
+mac_sebsd_label_from_string(char *string, struct mac *label)
+{
+
+ bzero(&label->m_sebsd, sizeof(label->m_sebsd));
+ return (sscanf(string, "%u", &label->m_sebsd.ms_psid) == 1 ? 0
+ : errno);
+}
+
+char *
+mac_sebsd_string_from_label(struct mac *label)
+{
+ char *ret;
+
+ asprintf(&ret, "%u", label->m_sebsd.ms_psid);
+ return (ret);
+}
diff --git a/lib/libc/posix1e/mac_set.3 b/lib/libc/posix1e/mac_set.3
new file mode 100644
index 0000000..c747952
--- /dev/null
+++ b/lib/libc/posix1e/mac_set.3
@@ -0,0 +1,124 @@
+.\" Copyright (c) 2001 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd December 21, 2001
+.Dt MAC_SET 3
+.Sh NAME
+.Nm mac_set_file ,
+.Nm mac_set_fd ,
+.Nm mac_set_proc
+.Nd set the MAC label for a file or process
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/mac.h
+.Ft int
+.Fn mac_set_file "const char *path_p" "mac_t label"
+.Ft int
+.Fn mac_set_fd "int fd" "mac_t label"
+.Ft int
+.Fn mac_set_proc "mac_t label"
+.Sh DESCRIPTION
+The
+.Fn mac_set_file
+and
+.Fn mac_set_fd
+functions associate a MAC label
+specified by
+.Fa label
+to the file referenced to by
+.Fa path_p ,
+or to the file descriptor
+.Fa fd ,
+respectively. Note this function will
+fail on socket descriptors. For information on
+setting MAC labels on socket descriptors see
+.Xr setsockopt 2 .
+The
+.Fn mac_set_proc
+function associates the MAC label
+specified by
+.Fa label
+to the calling process.
+.Pp
+A process is allowed to set a label for a file
+only if it has MAC write access to the file,
+and its effective user id is equal to
+the owner of the file,
+or has appropriate privileges.
+.Sh RETURN VALUES
+.Rv -std mac_set_fd mac_set_file mac_set_proc
+.Sh ERRORS
+.Bl -tag -width Er
+.It Bq Er EACCES
+MAC write access to the file is denied.
+.It Bq Er EBADF
+.Fa fd
+is not a valid file descriptor.
+.It Bq Er EINVAL
+.Fa label
+is not a valid MAC label.
+.It Bq Er EOPNOTSUPP
+Setting MAC labels is not supported
+by the file referenced by
+.Fa fd .
+.It Bq Er EPERM
+The calling process had insufficient privelege
+to change the MAC label.
+.It Bq Er EROFS
+File system for the object being modified
+is read only.
+.It Bq Er ENAMETOOLONG
+.\" XXX POSIX_NO_TRUNC?
+The length of the pathname in
+.Fa path_p
+exceeds
+.Dv PATH_MAX ,
+or a component of the pathname
+is longer than
+.Dv NAME_MAX .
+.It Bq Er ENOENT
+The file referenced by
+.Fa path_p
+does not exist.
+.It Bq Er ENOTDIR
+A component of the pathname
+referenced by
+.Fa path_p
+is not a directory.
+.Sh SEE_ALSO
+.Xr mac 3 ,
+.Xr mac_free 3 ,
+.Xr mac_text 3 ,
+.Xr mac_get 3
diff --git a/lib/libc/posix1e/mac_set.c b/lib/libc/posix1e/mac_set.c
new file mode 100644
index 0000000..fd94244
--- /dev/null
+++ b/lib/libc/posix1e/mac_set.c
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+int
+mac_set_file(const char *path_p, mac_t label)
+{
+
+ return (__mac_set_file(path_p, label));
+}
+
+int
+mac_set_fd(int fd, mac_t label)
+{
+
+ return (__mac_set_fd(fd, label));
+}
+
+int
+mac_set_proc(mac_t label)
+{
+
+ return (__mac_set_proc(label));
+}
diff --git a/lib/libc/posix1e/mac_te.c b/lib/libc/posix1e/mac_te.c
new file mode 100644
index 0000000..c74dbfb
--- /dev/null
+++ b/lib/libc/posix1e/mac_te.c
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * This software was developed for the FreeBSD Project in part by NAI Labs,
+ * the Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * TE labels simply consist of the typename. The typename must not be
+ * the empty string, and must not exceed the length limit in the label.
+ */
+
+int
+mac_te_label_from_string(char *string, struct mac *label)
+{
+
+ bzero(&label->m_te, sizeof(label->m_te));
+ if (strlen(string) == 0)
+ return (EINVAL);
+ if (strlcpy(label->m_te.mt_type, string,
+ sizeof(label->m_te.mt_type)) >= sizeof(label->m_te.mt_type))
+ return (EINVAL);
+ return (0);
+}
+
+char *
+mac_te_string_from_label(struct mac *label)
+{
+
+ return (strdup(label->m_te.mt_type));
+}
diff --git a/lib/libc/posix1e/mac_text.3 b/lib/libc/posix1e/mac_text.3
new file mode 100644
index 0000000..46aec34
--- /dev/null
+++ b/lib/libc/posix1e/mac_text.3
@@ -0,0 +1,169 @@
+.\" Copyright (c) 2001 Networks Associates Technology, Inc.
+.\" All rights reserved.
+.\"
+.\" This software was developed for the FreeBSD Project by Chris
+.\" Costello at Safeport Network Services and NAI Labs, the Security
+.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
+.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
+.\" research program.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote
+.\" products derived from this software without specific prior written
+.\" permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.Dd December 21, 2001
+.Dt MAC_TEXT 3
+.Sh NAME
+.Nm mac_from_text ,
+.Nm mac_to_text
+.Nd convert MAC label to/from text representation
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In sys/mac.h
+.Ft mac_t
+.Fn mac_from_text "const char *text_p"
+.Ft "char *"
+.Fn mac_to_text "mac_t label" "size_t *len_p"
+.Sh DESCRIPTION
+The
+.Fn mac_from_text
+function converts the text representation of a label
+into a
+.Vt mac_t ,
+which must later be freed with
+.Xr mac_free .
+The
+.Fn mac_to_text
+function returns
+the text representation of
+.Fa label
+and sets
+.Fa *len_p
+to the length of the returned string.
+.Pp
+.Fx
+uses the following format
+for MAC policy text representations:
+.Pp
+.Dl Sy policy Ns No / Ns Sy qualifier
+.Pp
+Where
+.Sy policy
+can be one of
+.Dq biba ,
+.Dq mls ,
+or
+.Dq te .
+.Pp
+Valid labels can have the following arguments for
+.Sy qualifier ,
+depending on the value of
+.Sy policy .
+.Bl -tag -width "Policy" -offset indent
+.It Em Policy
+.Em Qualifier
+.It biba
+.Dq high ,
+.Dq low ,
+.Dq equal ,
+or a numeric grade.
+.It mls
+.Dq high ,
+.Dq low ,
+.Dq equal ,
+or a numeric level.
+.It te
+Types for
+.Dq te
+consist of a type name which must
+neither be empty nor exceed the length limit for the label.
+.El
+.Pp
+All policies must be present
+in a comma-separated list,
+but may be in any order
+(see
+.Sx EXAMPLES ) .
+.Sh RETURN VALUES
+The
+.Fn mac_from_text
+function returns a valid
+.Vt mac_t
+equivalent to
+the MAC label described in
+.Fa text_p
+upon success, and
+.Dv NULL
+upon failure, setting
+.Va errno
+to indicate the error.
+.Pp
+The
+.Fn mac_to_text
+function returns a string
+containing the text representation of
+.Fa label
+upon success, and
+.Dv NULL
+upon failure, setting
+.Va errno
+to indicate the error.
+.Sh EXAMPLES
+The following are valid MAC labels:
+.Bd -literal -offset indent
+biba/high,mls/low,te/none
+biba/low,mls/low,te/none
+biba/low,mls/3,te/none
+.Ed
+.Sh COMPATIBILITY
+POSIX.1e does not define
+a text format for text representations
+of MAC labels.
+.Sh ERRORS
+.Bl -tag -width Er
+.It Bq Er EINVAL
+An invalid policy or qualifier
+was specified in
+.Fa text_p ,
+or an invalid MAC label
+was specified in
+.Fa label .
+.It Bq Er ENOMEM
+Insufficient memory was available
+to allocate internal storage.
+.El
+.Sh SEE ALSO
+.Xr mac 3 ,
+.Xr mac_free 3 ,
+.Xr mac_get 3 ,
+.Xr mac_set 3
+.Sh STANDARDS
+POSIX.1e is described in IEEE POSIX.1e draft 17.
+Discussion of the draft
+continues on the cross-platform POSIX.1e implementation mailing list.
+To join this list, see the
+.Fx
+POSIX.1e implementation page
+for more information.
diff --git a/lib/libc/posix1e/mac_text.c b/lib/libc/posix1e/mac_text.c
new file mode 100644
index 0000000..3ab6484d
--- /dev/null
+++ b/lib/libc/posix1e/mac_text.c
@@ -0,0 +1,182 @@
+/*
+ * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed by Robert Watson for the TrustedBSD Project.
+ *
+ * This software was developed for the FreeBSD Project in part by NAI Labs,
+ * the Security Research Division of Network Associates, Inc. under
+ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
+ * CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The names of the authors may not be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/mac.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "mac_internal.h"
+
+/*
+ * POSIX.1e does not define a text format for MAC label string conversions.
+ * We use the following format:
+ *
+ * label: policyname/policyvalue{,...}
+ *
+ * Each policy is responsible for parsing policyvalue on its own, although
+ * policies must not use '/' or ',' in their text representation. Currently
+ * supported policies are "biba, "mls", "te".
+ */
+
+#define STRING_LISTSEP ","
+#define STRING_ELEMENTSEP "/"
+
+#define STRING_BIBA "biba"
+#define STRING_MLS "mls"
+#define STRING_TE "te"
+
+char *
+mac_to_text(struct mac *mac_p, size_t *len_p)
+{
+ char *biba = NULL, *mls = NULL, *string = NULL, *te = NULL;
+ int len = -1;
+
+ biba = mac_biba_string_from_label(mac_p);
+ if (biba == NULL)
+ goto out;
+
+ mls = mac_mls_string_from_label(mac_p);
+ if (mls == NULL)
+ goto out;
+
+ te = mac_te_string_from_label(mac_p);
+ if (te == NULL)
+ goto out;
+
+ len = asprintf(&string, "%s%s%s%s%s%s%s%s%s%s%s",
+ STRING_BIBA, STRING_ELEMENTSEP, biba, STRING_LISTSEP,
+ STRING_MLS, STRING_ELEMENTSEP, mls, STRING_LISTSEP,
+ STRING_TE, STRING_ELEMENTSEP, te);
+
+out:
+ if (biba != NULL)
+ free(biba);
+ if (mls != NULL)
+ free(mls);
+ if (te != NULL)
+ free(te);
+
+ if (len != -1 && len_p != NULL)
+ *len_p = len;
+
+ return (string);
+}
+
+struct mac *
+mac_from_text(const char *text_p)
+{
+ struct mac *label;
+ char *local_string, *next_token, *token, *tmp;
+ char *policy_name, *policy_value;
+ int biba_seen = 0, mls_seen = 0, te_seen = 0;
+ int error;
+
+ /*
+ * Parse into three assignments, determine which assignments
+ * they are and recurse appropriately, and reject if there are
+ * not the right assignments (or duplicates).
+ */
+
+ label = (struct mac *) malloc(sizeof(*label));
+ if (label == NULL) {
+ errno = ENOMEM;
+ goto exit1;
+ }
+ label->m_macflags = 0;
+ label->m_macflags |= MAC_FLAG_INITIALIZED;
+
+ local_string = strdup(text_p);
+ if (local_string == NULL) {
+ errno = ENOMEM;
+ goto exit2;
+ }
+
+ next_token = local_string;
+ while ((token = strsep(&next_token, STRING_LISTSEP)) != NULL) {
+
+ policy_value = token;
+ policy_name = strsep(&policy_value, STRING_ELEMENTSEP);
+
+ if (strcmp(policy_name, STRING_BIBA) == 0) {
+ error = mac_biba_label_from_string(policy_value,
+ label);
+ if (error) {
+ errno = error;
+ goto exit2;
+ }
+ biba_seen++;
+ } else if (strcmp(policy_name, STRING_MLS) == 0) {
+ error = mac_mls_label_from_string(policy_value,
+ label);
+ if (error) {
+ errno = error;
+ goto exit2;
+ }
+ mls_seen++;
+ } else if (strcmp(policy_name, STRING_TE) == 0) {
+ error = mac_te_label_from_string(policy_value, label);
+ if (error) {
+ errno = error;
+ goto exit2;
+ }
+ te_seen++;
+ } else {
+ errno = EINVAL;
+ goto exit2;
+ }
+ }
+
+ if (biba_seen != 1 || mls_seen != 1 || te_seen != 1) {
+ errno = EINVAL;
+ goto exit2;
+ }
+
+ /* Success. */
+ goto exit1;
+
+exit2:
+ free(label);
+ label = NULL;
+exit1:
+ free(local_string);
+ return (label);
+}
OpenPOWER on IntegriCloud