diff options
| -rw-r--r-- | sys/security/mac/mac_framework.h | 365 | ||||
| -rw-r--r-- | sys/security/mac/mac_policy.h | 838 |
2 files changed, 574 insertions, 629 deletions
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index c3c0b1e..9e551d8 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -90,238 +90,143 @@ struct vop_setlabel_args; /* * Kernel functions to manage and evaluate labels. */ -void mac_bpfdesc_init(struct bpf_d *); -void mac_cred_init(struct ucred *); -void mac_devfs_init(struct devfs_dirent *); -void mac_ifnet_init(struct ifnet *); -int mac_inpcb_init(struct inpcb *, int); -void mac_sysvmsg_init(struct msg *); -void mac_sysvmsq_init(struct msqid_kernel *); -void mac_sysvsem_init(struct semid_kernel *); -void mac_sysvshm_init(struct shmid_kernel *); -int mac_ipq_init(struct ipq *, int); -int mac_socket_init(struct socket *, int); -void mac_pipe_init(struct pipepair *); -void mac_posixsem_init(struct ksem *); -int mac_mbuf_init(struct mbuf *, int); -int mac_mbuf_tag_init(struct m_tag *, int); -void mac_mount_init(struct mount *); -void mac_proc_init(struct proc *); -void mac_vnode_init(struct vnode *); -void mac_mbuf_copy(struct mbuf *, struct mbuf *); -void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *); -void mac_vnode_copy_label(struct label *, struct label *); +int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp); +void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d); +void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m); void mac_bpfdesc_destroy(struct bpf_d *); -void mac_cred_destroy(struct ucred *); -void mac_devfs_destroy(struct devfs_dirent *); -void mac_ifnet_destroy(struct ifnet *); -void mac_inpcb_destroy(struct inpcb *); -void mac_sysvmsg_destroy(struct msg *); -void mac_sysvmsq_destroy(struct msqid_kernel *); -void mac_sysvsem_destroy(struct semid_kernel *); -void mac_sysvshm_destroy(struct shmid_kernel *); -void mac_ipq_destroy(struct ipq *); -void mac_socket_destroy(struct socket *); -void mac_pipe_destroy(struct pipepair *); -void mac_posixsem_destroy(struct ksem *); -void mac_proc_destroy(struct proc *); -void mac_mbuf_tag_destroy(struct m_tag *); -void mac_mount_destroy(struct mount *); -void mac_vnode_destroy(struct vnode *); +void mac_bpfdesc_init(struct bpf_d *); -struct label *mac_cred_label_alloc(void); -void mac_cred_label_free(struct label *); -struct label *mac_vnode_label_alloc(void); -void mac_vnode_label_free(struct label *); +int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2); +void mac_cred_copy(struct ucred *cr1, struct ucred *cr2); +void mac_cred_destroy(struct ucred *); +void mac_cred_init(struct ucred *); -/* - * Labeling event operations: file system objects, and things that look a lot - * like file system objects. - */ -void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de, - struct vnode *vp); -int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp); -void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp); void mac_devfs_create_device(struct ucred *cred, struct mount *mp, struct cdev *dev, struct devfs_dirent *de); void mac_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, struct devfs_dirent *de); void mac_devfs_create_symlink(struct ucred *cred, struct mount *mp, struct devfs_dirent *dd, struct devfs_dirent *de); -int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp, - struct vnode *dvp, struct vnode *vp, struct componentname *cnp); -void mac_mount_create(struct ucred *cred, struct mount *mp); -void mac_vnode_relabel(struct ucred *cred, struct vnode *vp, - struct label *newlabel); +void mac_devfs_destroy(struct devfs_dirent *); +void mac_devfs_init(struct devfs_dirent *); void mac_devfs_update(struct mount *mp, struct devfs_dirent *de, struct vnode *vp); +void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de, + struct vnode *vp); -/* - * Labeling event operations: IPC objects. - */ -void mac_socket_create_mbuf(struct socket *so, struct mbuf *m); -void mac_socket_create(struct ucred *cred, struct socket *so); -void mac_socket_newconn(struct socket *oldso, struct socket *newso); -void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so); -void mac_socketpeer_set_from_socket(struct socket *oldso, - struct socket *newso); -void mac_pipe_create(struct ucred *cred, struct pipepair *pp); - -/* - * Labeling event operations: System V IPC primitives - */ -void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, - struct msg *msgptr); -void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr); -void mac_sysvsem_create(struct ucred *cred, - struct semid_kernel *semakptr); -void mac_sysvshm_create(struct ucred *cred, - struct shmid_kernel *shmsegptr); - -/* - * Labeling event operations: POSIX (global/inter-process) semaphores. - */ -void mac_posixsem_create(struct ucred *cred, struct ksem *ks); - -/* - * Labeling event operations: network objects. - */ -void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d); +int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m); void mac_ifnet_create(struct ifnet *ifp); +void mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m); +void mac_ifnet_destroy(struct ifnet *); +void mac_ifnet_init(struct ifnet *); +int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr, + struct ifnet *ifp); +int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, + struct ifnet *ifp); + +int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m); void mac_inpcb_create(struct socket *so, struct inpcb *inp); -void mac_ipq_create(struct mbuf *m, struct ipq *ipq); -void mac_ipq_reassemble(struct ipq *ipq, struct mbuf *m); -void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag); void mac_inpcb_create_mbuf(struct inpcb *inp, struct mbuf *m); -void mac_create_mbuf_linklayer(struct ifnet *ifp, struct mbuf *m); -void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m); -void mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m); -void mac_mbuf_create_multicast_encap(struct mbuf *m, struct ifnet *ifp, - struct mbuf *mnew); -void mac_mbuf_create_netlayer(struct mbuf *m, struct mbuf *mnew); -int mac_ipq_match(struct mbuf *m, struct ipq *ipq); -void mac_netinet_icmp_reply(struct mbuf *m); -void mac_netinet_tcp_reply(struct mbuf *m); -void mac_ipq_update(struct mbuf *m, struct ipq *ipq); +void mac_inpcb_destroy(struct inpcb *); +int mac_inpcb_init(struct inpcb *, int); void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp); -void mac_mbuf_create_from_firewall(struct mbuf *m); -void mac_syncache_destroy(struct label **l); -int mac_syncache_init(struct label **l); -void mac_syncache_create(struct label *l, struct inpcb *inp); -void mac_syncache_create_mbuf(struct label *l, struct mbuf *m); -/* - * Labeling event operations: processes. - */ -void mac_cred_copy(struct ucred *cr1, struct ucred *cr2); -int mac_execve_enter(struct image_params *imgp, struct mac *mac_p); -void mac_execve_exit(struct image_params *imgp); -void mac_vnode_execve_transition(struct ucred *oldcred, - struct ucred *newcred, struct vnode *vp, - struct label *interpvplabel, struct image_params *imgp); -int mac_vnode_execve_will_transition(struct ucred *cred, - struct vnode *vp, struct label *interpvplabel, - struct image_params *imgp); -void mac_proc_create_swapper(struct ucred *cred); -void mac_proc_create_init(struct ucred *cred); -void mac_proc_associate_nfsd(struct ucred *cred); -void mac_thread_userret(struct thread *td); - -/* - * Label cleanup operation: This is the inverse complement for the mac_create - * and associate type of hooks. This hook lets the policy module(s) perform a - * cleanup/flushing operation on the label associated with the objects, - * without freeing up the space allocated. This hook is useful in cases - * where it is desirable to remove any labeling reference when recycling any - * object to a pool. This hook does not replace the mac_destroy hooks. - * - * XXXRW: These object methods are inconsistent with the life cycles of other - * objects, and likely should be revised to be more consistent. - */ -void mac_sysvmsg_cleanup(struct msg *msgptr); -void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr); -void mac_sysvsem_cleanup(struct semid_kernel *semakptr); -void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr); +void mac_ipq_create(struct mbuf *m, struct ipq *ipq); +void mac_ipq_destroy(struct ipq *); +int mac_ipq_init(struct ipq *, int); +int mac_ipq_match(struct mbuf *m, struct ipq *ipq); +void mac_ipq_reassemble(struct ipq *ipq, struct mbuf *m); +void mac_ipq_update(struct mbuf *m, struct ipq *ipq); -/* - * Access control checks. - */ -int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp); -int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2); -int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m); -int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m); -int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, - struct msqid_kernel *msqkptr); -int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr); -int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr); -int mac_sysvmsq_check_msqget(struct ucred *cred, - struct msqid_kernel *msqkptr); -int mac_sysvmsq_check_msqsnd(struct ucred *cred, - struct msqid_kernel *msqkptr); -int mac_sysvmsq_check_msqrcv(struct ucred *cred, - struct msqid_kernel *msqkptr); -int mac_sysvmsq_check_msqctl(struct ucred *cred, - struct msqid_kernel *msqkptr, int cmd); -int mac_sysvsem_check_semctl(struct ucred *cred, - struct semid_kernel *semakptr, int cmd); -int mac_sysvsem_check_semget(struct ucred *cred, - struct semid_kernel *semakptr); -int mac_sysvsem_check_semop(struct ucred *cred, - struct semid_kernel *semakptr, size_t accesstype); -int mac_sysvshm_check_shmat(struct ucred *cred, - struct shmid_kernel *shmsegptr, int shmflg); -int mac_sysvshm_check_shmctl(struct ucred *cred, - struct shmid_kernel *shmsegptr, int cmd); -int mac_sysvshm_check_shmdt(struct ucred *cred, - struct shmid_kernel *shmsegptr); -int mac_sysvshm_check_shmget(struct ucred *cred, - struct shmid_kernel *shmsegptr, int shmflg); int mac_kenv_check_dump(struct ucred *cred); int mac_kenv_check_get(struct ucred *cred, char *name); int mac_kenv_check_set(struct ucred *cred, char *name, char *value); int mac_kenv_check_unset(struct ucred *cred, char *name); + int mac_kld_check_load(struct ucred *cred, struct vnode *vp); int mac_kld_check_stat(struct ucred *cred); + +void mac_mbuf_copy(struct mbuf *, struct mbuf *); +void mac_mbuf_create_from_firewall(struct mbuf *m); +void mac_create_mbuf_linklayer(struct ifnet *ifp, struct mbuf *m); +void mac_mbuf_create_multicast_encap(struct mbuf *m, struct ifnet *ifp, + struct mbuf *mnew); +void mac_mbuf_create_netlayer(struct mbuf *m, struct mbuf *mnew); +int mac_mbuf_init(struct mbuf *, int); + +void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *); +void mac_mbuf_tag_destroy(struct m_tag *); +int mac_mbuf_tag_init(struct m_tag *, int); + int mac_mount_check_stat(struct ucred *cred, struct mount *mp); +void mac_mount_create(struct ucred *cred, struct mount *mp); +void mac_mount_destroy(struct mount *); +void mac_mount_init(struct mount *); + +void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag); +void mac_netinet_icmp_reply(struct mbuf *m); +void mac_netinet_tcp_reply(struct mbuf *m); + int mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, unsigned long cmd, void *data); int mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp); int mac_pipe_check_read(struct ucred *cred, struct pipepair *pp); int mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp); int mac_pipe_check_write(struct ucred *cred, struct pipepair *pp); +void mac_pipe_create(struct ucred *cred, struct pipepair *pp); +void mac_pipe_destroy(struct pipepair *); +void mac_pipe_init(struct pipepair *); +int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, + struct label *label); + int mac_posixsem_check_destroy(struct ucred *cred, struct ksem *ks); int mac_posixsem_check_getvalue(struct ucred *cred,struct ksem *ks); int mac_posixsem_check_open(struct ucred *cred, struct ksem *ks); int mac_posixsem_check_post(struct ucred *cred, struct ksem *ks); int mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks); int mac_posixsem_check_wait(struct ucred *cred, struct ksem *ks); +void mac_posixsem_create(struct ucred *cred, struct ksem *ks); +void mac_posixsem_destroy(struct ksem *); +void mac_posixsem_init(struct ksem *); + +int mac_priv_check(struct ucred *cred, int priv); +int mac_priv_grant(struct ucred *cred, int priv); + +void mac_proc_associate_nfsd(struct ucred *cred); int mac_proc_check_debug(struct ucred *cred, struct proc *p); int mac_proc_check_sched(struct ucred *cred, struct proc *p); int mac_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai); int mac_proc_check_setaudit_addr(struct ucred *cred, struct auditinfo_addr *aia); int mac_proc_check_setauid(struct ucred *cred, uid_t auid); -int mac_proc_check_setuid(struct proc *p, struct ucred *cred, - uid_t uid); +int mac_proc_check_setegid(struct proc *p, struct ucred *cred, + gid_t egid); int mac_proc_check_seteuid(struct proc *p, struct ucred *cred, uid_t euid); int mac_proc_check_setgid(struct proc *p, struct ucred *cred, gid_t gid); -int mac_proc_check_setegid(struct proc *p, struct ucred *cred, - gid_t egid); int mac_proc_check_setgroups(struct proc *p, struct ucred *cred, int ngroups, gid_t *gidset); -int mac_proc_check_setreuid(struct proc *p, struct ucred *cred, - uid_t ruid, uid_t euid); int mac_proc_check_setregid(struct proc *p, struct ucred *cred, gid_t rgid, gid_t egid); -int mac_proc_check_setresuid(struct proc *p, struct ucred *cred, - uid_t ruid, uid_t euid, uid_t suid); int mac_proc_check_setresgid(struct proc *p, struct ucred *cred, gid_t rgid, gid_t egid, gid_t sgid); +int mac_proc_check_setresuid(struct proc *p, struct ucred *cred, + uid_t ruid, uid_t euid, uid_t suid); +int mac_proc_check_setreuid(struct proc *p, struct ucred *cred, + uid_t ruid, uid_t euid); +int mac_proc_check_setuid(struct proc *p, struct ucred *cred, + uid_t uid); int mac_proc_check_signal(struct ucred *cred, struct proc *p, int signum); int mac_proc_check_wait(struct ucred *cred, struct proc *p); +void mac_proc_create_init(struct ucred *cred); +void mac_proc_create_swapper(struct ucred *cred); +void mac_proc_destroy(struct proc *); +int mac_execve_enter(struct image_params *imgp, struct mac *mac_p); +void mac_execve_exit(struct image_params *imgp); +void mac_proc_init(struct proc *); + int mac_socket_check_accept(struct ucred *cred, struct socket *so); int mac_socket_check_bind(struct ucred *cred, struct socket *so, struct sockaddr *sa); @@ -336,6 +241,27 @@ int mac_socket_check_receive(struct ucred *cred, struct socket *so); int mac_socket_check_send(struct ucred *cred, struct socket *so); int mac_socket_check_stat(struct ucred *cred, struct socket *so); int mac_socket_check_visible(struct ucred *cred, struct socket *so); +void mac_socket_create_mbuf(struct socket *so, struct mbuf *m); +void mac_socket_create(struct ucred *cred, struct socket *so); +void mac_socket_destroy(struct socket *); +int mac_socket_init(struct socket *, int); +void mac_socket_newconn(struct socket *oldso, struct socket *newso); +int mac_getsockopt_label(struct ucred *cred, struct socket *so, + struct mac *extmac); +int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, + struct mac *extmac); +int mac_setsockopt_label(struct ucred *cred, struct socket *so, + struct mac *extmac); + +void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so); +void mac_socketpeer_set_from_socket(struct socket *oldso, + struct socket *newso); + +void mac_syncache_create(struct label *l, struct inpcb *inp); +void mac_syncache_create_mbuf(struct label *l, struct mbuf *m); +void mac_syncache_destroy(struct label **l); +int mac_syncache_init(struct label **l); + int mac_system_check_acct(struct ucred *cred, struct vnode *vp); int mac_system_check_audit(struct ucred *cred, void *record, int length); int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp); @@ -345,6 +271,60 @@ int mac_system_check_swapon(struct ucred *cred, struct vnode *vp); int mac_system_check_swapoff(struct ucred *cred, struct vnode *vp); int mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, void *arg1, int arg2, struct sysctl_req *req); + +void mac_sysvmsg_cleanup(struct msg *msgptr); +void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, + struct msg *msgptr); +void mac_sysvmsg_destroy(struct msg *); +void mac_sysvmsg_init(struct msg *); + +int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, + struct msqid_kernel *msqkptr); +int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr); +int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr); +int mac_sysvmsq_check_msqctl(struct ucred *cred, + struct msqid_kernel *msqkptr, int cmd); +int mac_sysvmsq_check_msqget(struct ucred *cred, + struct msqid_kernel *msqkptr); +int mac_sysvmsq_check_msqrcv(struct ucred *cred, + struct msqid_kernel *msqkptr); +int mac_sysvmsq_check_msqsnd(struct ucred *cred, + struct msqid_kernel *msqkptr); +void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr); +void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr); +void mac_sysvmsq_destroy(struct msqid_kernel *); +void mac_sysvmsq_init(struct msqid_kernel *); + +int mac_sysvsem_check_semctl(struct ucred *cred, + struct semid_kernel *semakptr, int cmd); +int mac_sysvsem_check_semget(struct ucred *cred, + struct semid_kernel *semakptr); +int mac_sysvsem_check_semop(struct ucred *cred, + struct semid_kernel *semakptr, size_t accesstype); +void mac_sysvsem_cleanup(struct semid_kernel *semakptr); +void mac_sysvsem_create(struct ucred *cred, + struct semid_kernel *semakptr); +void mac_sysvsem_destroy(struct semid_kernel *); +void mac_sysvsem_init(struct semid_kernel *); + +int mac_sysvshm_check_shmat(struct ucred *cred, + struct shmid_kernel *shmsegptr, int shmflg); +int mac_sysvshm_check_shmctl(struct ucred *cred, + struct shmid_kernel *shmsegptr, int cmd); +int mac_sysvshm_check_shmdt(struct ucred *cred, + struct shmid_kernel *shmsegptr); +int mac_sysvshm_check_shmget(struct ucred *cred, + struct shmid_kernel *shmsegptr, int shmflg); +void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr); +void mac_sysvshm_create(struct ucred *cred, + struct shmid_kernel *shmsegptr); +void mac_sysvshm_destroy(struct shmid_kernel *); +void mac_sysvshm_init(struct shmid_kernel *); + +void mac_thread_userret(struct thread *td); + +int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp); +void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp); int mac_vnode_check_access(struct ucred *cred, struct vnode *vp, int acc_mode); int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp); @@ -402,21 +382,26 @@ int mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); -int mac_getsockopt_label(struct ucred *cred, struct socket *so, - struct mac *extmac); -int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, - struct mac *extmac); -int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr, - struct ifnet *ifp); -int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, - struct ifnet *ifp); -int mac_setsockopt_label(struct ucred *cred, struct socket *so, - struct mac *extmac); -int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, - struct label *label); +void mac_vnode_copy_label(struct label *, struct label *); +void mac_vnode_init(struct vnode *); +int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp, + struct vnode *dvp, struct vnode *vp, struct componentname *cnp); +void mac_vnode_destroy(struct vnode *); +void mac_vnode_execve_transition(struct ucred *oldcred, + struct ucred *newcred, struct vnode *vp, + struct label *interpvplabel, struct image_params *imgp); +int mac_vnode_execve_will_transition(struct ucred *cred, + struct vnode *vp, struct label *interpvplabel, + struct image_params *imgp); +void mac_vnode_relabel(struct ucred *cred, struct vnode *vp, + struct label *newlabel); + +struct label *mac_cred_label_alloc(void); +void mac_cred_label_free(struct label *); +struct label *mac_vnode_label_alloc(void); +void mac_vnode_label_free(struct label *); + void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); -int mac_priv_check(struct ucred *cred, int priv); -int mac_priv_grant(struct ucred *cred, int priv); /* * Calls to help various file systems implement labeling functionality using diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index 0cf8c87..f09735d 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -112,100 +112,34 @@ typedef int (*mpo_syscall_t)(struct thread *td, int call, void *arg); typedef void (*mpo_placeholder_t)(void); /* - * Label operations. Initialize label storage, destroy label storage, - * recycle for re-use without init/destroy, copy a label to initialized - * storage, and externalize/internalize from/to initialized storage. + * Operations sorted alphabetically by primary object type and then method. */ -typedef void (*mpo_bpfdesc_init_label_t)(struct label *label); -typedef void (*mpo_cred_init_label_t)(struct label *label); -typedef void (*mpo_devfs_init_label_t)(struct label *label); -typedef void (*mpo_ifnet_init_label_t)(struct label *label); -typedef int (*mpo_inpcb_init_label_t)(struct label *label, int flag); -typedef void (*mpo_sysvmsg_init_label_t)(struct label *label); -typedef void (*mpo_sysvmsq_init_label_t)(struct label *label); -typedef void (*mpo_sysvsem_init_label_t)(struct label *label); -typedef void (*mpo_sysvshm_init_label_t)(struct label *label); -typedef int (*mpo_ipq_init_label_t)(struct label *label, int flag); -typedef int (*mpo_mbuf_init_label_t)(struct label *label, int flag); -typedef void (*mpo_mount_init_label_t)(struct label *label); -typedef int (*mpo_socket_init_label_t)(struct label *label, int flag); -typedef int (*mpo_socketpeer_init_label_t)(struct label *label, - int flag); -typedef void (*mpo_pipe_init_label_t)(struct label *label); -typedef void (*mpo_posixsem_init_label_t)(struct label *label); -typedef void (*mpo_proc_init_label_t)(struct label *label); -typedef void (*mpo_vnode_init_label_t)(struct label *label); +typedef int (*mpo_bpfdesc_check_receive_t)(struct bpf_d *d, + struct label *dlabel, struct ifnet *ifp, + struct label *ifplabel); +typedef void (*mpo_bpfdesc_create_t)(struct ucred *cred, + struct bpf_d *d, struct label *dlabel); +typedef void (*mpo_bpfdesc_create_mbuf_t)(struct bpf_d *d, + struct label *dlabel, struct mbuf *m, + struct label *mlabel); typedef void (*mpo_bpfdesc_destroy_label_t)(struct label *label); -typedef void (*mpo_cred_destroy_label_t)(struct label *label); -typedef void (*mpo_devfs_destroy_label_t)(struct label *label); -typedef void (*mpo_ifnet_destroy_label_t)(struct label *label); -typedef void (*mpo_inpcb_destroy_label_t)(struct label *label); -typedef void (*mpo_sysvmsg_destroy_label_t)(struct label *label); -typedef void (*mpo_sysvmsq_destroy_label_t)(struct label *label); -typedef void (*mpo_sysvsem_destroy_label_t)(struct label *label); -typedef void (*mpo_sysvshm_destroy_label_t)(struct label *label); -typedef void (*mpo_ipq_destroy_label_t)(struct label *label); -typedef void (*mpo_mbuf_destroy_label_t)(struct label *label); -typedef void (*mpo_mount_destroy_label_t)(struct label *label); -typedef void (*mpo_socket_destroy_label_t)(struct label *label); -typedef void (*mpo_socketpeer_destroy_label_t)(struct label *label); -typedef void (*mpo_pipe_destroy_label_t)(struct label *label); -typedef void (*mpo_posixsem_destroy_label_t)(struct label *label); -typedef void (*mpo_proc_destroy_label_t)(struct label *label); -typedef void (*mpo_vnode_destroy_label_t)(struct label *label); -typedef void (*mpo_sysvmsg_cleanup_t)(struct label *msglabel); -typedef void (*mpo_sysvmsq_cleanup_t)(struct label *msqlabel); -typedef void (*mpo_sysvsem_cleanup_t)(struct label *semalabel); -typedef void (*mpo_sysvshm_cleanup_t)(struct label *shmlabel); +typedef void (*mpo_bpfdesc_init_label_t)(struct label *label); + +typedef int (*mpo_cred_check_relabel_t)(struct ucred *cred, + struct label *newlabel); +typedef int (*mpo_cred_check_visible_t)(struct ucred *cr1, + struct ucred *cr2); typedef void (*mpo_cred_copy_label_t)(struct label *src, struct label *dest); -typedef void (*mpo_ifnet_copy_label_t)(struct label *src, - struct label *dest); -typedef void (*mpo_mbuf_copy_label_t)(struct label *src, - struct label *dest); -typedef void (*mpo_pipe_copy_label_t)(struct label *src, - struct label *dest); -typedef void (*mpo_socket_copy_label_t)(struct label *src, - struct label *dest); -typedef void (*mpo_vnode_copy_label_t)(struct label *src, - struct label *dest); +typedef void (*mpo_cred_destroy_label_t)(struct label *label); typedef int (*mpo_cred_externalize_label_t)(struct label *label, char *element_name, struct sbuf *sb, int *claimed); -typedef int (*mpo_ifnet_externalize_label_t)(struct label *label, - char *element_name, struct sbuf *sb, int *claimed); -typedef int (*mpo_pipe_externalize_label_t)(struct label *label, - char *element_name, struct sbuf *sb, int *claimed); -typedef int (*mpo_socket_externalize_label_t)(struct label *label, - char *element_name, struct sbuf *sb, int *claimed); -typedef int (*mpo_socketpeer_externalize_label_t)(struct label *label, - char *element_name, struct sbuf *sb, int *claimed); -typedef int (*mpo_vnode_externalize_label_t)(struct label *label, - char *element_name, struct sbuf *sb, int *claimed); +typedef void (*mpo_cred_init_label_t)(struct label *label); typedef int (*mpo_cred_internalize_label_t)(struct label *label, char *element_name, char *element_data, int *claimed); -typedef int (*mpo_ifnet_internalize_label_t)(struct label *label, - char *element_name, char *element_data, int *claimed); -typedef int (*mpo_pipe_internalize_label_t)(struct label *label, - char *element_name, char *element_data, int *claimed); -typedef int (*mpo_socket_internalize_label_t)(struct label *label, - char *element_name, char *element_data, int *claimed); -typedef int (*mpo_vnode_internalize_label_t)(struct label *label, - char *element_name, char *element_data, int *claimed); +typedef void (*mpo_cred_relabel_t)(struct ucred *cred, + struct label *newlabel); -/* - * Labeling event operations: file system objects, and things that look a lot - * like file system objects. - */ -typedef void (*mpo_devfs_vnode_associate_t)(struct mount *mp, - struct label *mplabel, struct devfs_dirent *de, - struct label *delabel, struct vnode *vp, - struct label *vplabel); -typedef int (*mpo_vnode_associate_extattr_t)(struct mount *mp, - struct label *mplabel, struct vnode *vp, - struct label *vplabel); -typedef void (*mpo_vnode_associate_singlelabel_t)(struct mount *mp, - struct label *mplabel, struct vnode *vp, - struct label *vplabel); typedef void (*mpo_devfs_create_device_t)(struct ucred *cred, struct mount *mp, struct cdev *dev, struct devfs_dirent *de, struct label *delabel); @@ -216,209 +150,107 @@ typedef void (*mpo_devfs_create_symlink_t)(struct ucred *cred, struct mount *mp, struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, struct label *delabel); -typedef int (*mpo_vnode_create_extattr_t)(struct ucred *cred, - struct mount *mp, struct label *mplabel, - struct vnode *dvp, struct label *dvplabel, - struct vnode *vp, struct label *vplabel, - struct componentname *cnp); -typedef void (*mpo_mount_create_t)(struct ucred *cred, struct mount *mp, - struct label *mplabel); -typedef void (*mpo_vnode_relabel_t)(struct ucred *cred, struct vnode *vp, - struct label *vplabel, struct label *label); -typedef int (*mpo_vnode_setlabel_extattr_t)(struct ucred *cred, - struct vnode *vp, struct label *vplabel, - struct label *intlabel); +typedef void (*mpo_devfs_destroy_label_t)(struct label *label); +typedef void (*mpo_devfs_init_label_t)(struct label *label); typedef void (*mpo_devfs_update_t)(struct mount *mp, struct devfs_dirent *de, struct label *delabel, struct vnode *vp, struct label *vplabel); +typedef void (*mpo_devfs_vnode_associate_t)(struct mount *mp, + struct label *mplabel, struct devfs_dirent *de, + struct label *delabel, struct vnode *vp, + struct label *vplabel); -/* - * Labeling event operations: IPC objects. - */ -typedef void (*mpo_socket_create_mbuf_t)(struct socket *so, - struct label *solabel, struct mbuf *m, +typedef int (*mpo_ifnet_check_relabel_t)(struct ucred *cred, + struct ifnet *ifp, struct label *ifplabel, + struct label *newlabel); +typedef int (*mpo_ifnet_check_transmit_t)(struct ifnet *ifp, + struct label *ifplabel, struct mbuf *m, struct label *mlabel); -typedef void (*mpo_socket_create_t)(struct ucred *cred, struct socket *so, - struct label *solabel); -typedef void (*mpo_socket_newconn_t)(struct socket *oldso, - struct label *oldsolabel, struct socket *newso, - struct label *newsolabel); -typedef void (*mpo_socket_relabel_t)(struct ucred *cred, struct socket *so, - struct label *oldlabel, struct label *newlabel); -typedef void (*mpo_pipe_relabel_t)(struct ucred *cred, struct pipepair *pp, - struct label *oldlabel, struct label *newlabel); -typedef void (*mpo_socketpeer_set_from_mbuf_t)(struct mbuf *m, - struct label *mlabel, struct socket *so, - struct label *sopeerlabel); -typedef void (*mpo_socketpeer_set_from_socket_t)(struct socket *oldso, - struct label *oldsolabel, struct socket *newso, - struct label *newsopeerlabel); -typedef void (*mpo_pipe_create_t)(struct ucred *cred, struct pipepair *pp, - struct label *pplabel); - -/* - * Labeling event operations: System V IPC primitives. - */ -typedef void (*mpo_sysvmsg_create_t)(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqlabel, - struct msg *msgptr, struct label *msglabel); -typedef void (*mpo_sysvmsq_create_t)(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqlabel); -typedef void (*mpo_sysvsem_create_t)(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semalabel); -typedef void (*mpo_sysvshm_create_t)(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmlabel); - -/* - * Labeling event operations: POSIX (global/inter-process) semaphores. - */ -typedef void (*mpo_posixsem_create_t)(struct ucred *cred, - struct ksem *ks, struct label *kslabel); - -/* - * Labeling event operations: network objects. - */ -typedef void (*mpo_bpfdesc_create_t)(struct ucred *cred, - struct bpf_d *d, struct label *dlabel); +typedef void (*mpo_ifnet_copy_label_t)(struct label *src, + struct label *dest); typedef void (*mpo_ifnet_create_t)(struct ifnet *ifp, struct label *ifplabel); +typedef void (*mpo_ifnet_create_mbuf_t)(struct ifnet *ifp, + struct label *ifplabel, struct mbuf *m, + struct label *mlabel); +typedef void (*mpo_ifnet_destroy_label_t)(struct label *label); +typedef int (*mpo_ifnet_externalize_label_t)(struct label *label, + char *element_name, struct sbuf *sb, int *claimed); +typedef void (*mpo_ifnet_init_label_t)(struct label *label); +typedef int (*mpo_ifnet_internalize_label_t)(struct label *label, + char *element_name, char *element_data, int *claimed); +typedef void (*mpo_ifnet_relabel_t)(struct ucred *cred, struct ifnet *ifp, + struct label *ifplabel, struct label *newlabel); + +typedef int (*mpo_inpcb_check_deliver_t)(struct inpcb *inp, + struct label *inplabel, struct mbuf *m, + struct label *mlabel); typedef void (*mpo_inpcb_create_t)(struct socket *so, struct label *solabel, struct inpcb *inp, struct label *inplabel); -typedef void (*mpo_ipq_create_t)(struct mbuf *m, struct label *mlabel, - struct ipq *ipq, struct label *ipqlabel); -typedef void (*mpo_ipq_reassemble) - (struct ipq *ipq, struct label *ipqlabel, struct mbuf *m, - struct label *mlabel); -typedef void (*mpo_netinet_fragment_t)(struct mbuf *m, - struct label *mlabel, struct mbuf *frag, - struct label *fraglabel); typedef void (*mpo_inpcb_create_mbuf_t)(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel); -typedef void (*mpo_create_mbuf_linklayer_t)(struct ifnet *ifp, - struct label *ifplabel, struct mbuf *m, - struct label *mlabel); -typedef void (*mpo_bpfdesc_create_mbuf_t)(struct bpf_d *d, - struct label *dlabel, struct mbuf *m, - struct label *mlabel); -typedef void (*mpo_ifnet_create_mbuf_t)(struct ifnet *ifp, - struct label *ifplabel, struct mbuf *m, - struct label *mlabel); -typedef void (*mpo_mbuf_create_multicast_encap_t)(struct mbuf *m, - struct label *mlabel, struct ifnet *ifp, - struct label *ifplabel, struct mbuf *mnew, - struct label *mnewlabel); -typedef void (*mpo_mbuf_create_netlayer_t)(struct mbuf *m, - struct label *mlabel, struct mbuf *mnew, - struct label *mnewlabel); +typedef void (*mpo_inpcb_destroy_label_t)(struct label *label); +typedef int (*mpo_inpcb_init_label_t)(struct label *label, int flag); +typedef void (*mpo_inpcb_sosetlabel_t)(struct socket *so, + struct label *label, struct inpcb *inp, + struct label *inplabel); + +typedef void (*mpo_ipq_create_t)(struct mbuf *m, struct label *mlabel, + struct ipq *ipq, struct label *ipqlabel); +typedef void (*mpo_ipq_destroy_label_t)(struct label *label); +typedef int (*mpo_ipq_init_label_t)(struct label *label, int flag); typedef int (*mpo_ipq_match_t)(struct mbuf *m, struct label *mlabel, struct ipq *ipq, struct label *ipqlabel); -typedef void (*mpo_netinet_icmp_reply_t)(struct mbuf *m, - struct label *mlabel); -typedef void (*mpo_netinet_tcp_reply_t)(struct mbuf *m, +typedef void (*mpo_ipq_reassemble)(struct ipq *ipq, + struct label *ipqlabel, struct mbuf *m, struct label *mlabel); -typedef void (*mpo_ifnet_relabel_t)(struct ucred *cred, struct ifnet *ifp, - struct label *ifplabel, struct label *newlabel); typedef void (*mpo_ipq_update_t)(struct mbuf *m, struct label *mlabel, struct ipq *ipq, struct label *ipqlabel); -typedef void (*mpo_inpcb_sosetlabel_t)(struct socket *so, - struct label *label, struct inpcb *inp, - struct label *inplabel); -typedef void (*mpo_mbuf_create_from_firewall_t)(struct mbuf *m, - struct label *label); -typedef void (*mpo_syncache_destroy_label_t)(struct label *label); -typedef int (*mpo_syncache_init_label_t)(struct label *label, int flag); -typedef void (*mpo_syncache_create_t)(struct label *label, - struct inpcb *inp); -typedef void (*mpo_syncache_create_mbuf_t)(struct label *sc_label, - struct mbuf *m, struct label *mlabel); -/* - * Labeling event operations: processes. - */ -typedef void (*mpo_vnode_execve_transition_t)(struct ucred *old, - struct ucred *new, struct vnode *vp, - struct label *vplabel, struct label *interpvplabel, - struct image_params *imgp, struct label *execlabel); -typedef int (*mpo_vnode_execve_will_transition_t)(struct ucred *old, - struct vnode *vp, struct label *vplabel, - struct label *interpvplabel, struct image_params *imgp, - struct label *execlabel); -typedef void (*mpo_proc_create_swapper_t)(struct ucred *cred); -typedef void (*mpo_proc_create_init_t)(struct ucred *cred); -typedef void (*mpo_cred_relabel_t)(struct ucred *cred, - struct label *newlabel); -typedef void (*mpo_thread_userret_t)(struct thread *thread); - -/* - * Access control checks. - */ -typedef int (*mpo_bpfdesc_check_receive_t)(struct bpf_d *d, - struct label *dlabel, struct ifnet *ifp, - struct label *ifplabel); -typedef int (*mpo_cred_check_relabel_t)(struct ucred *cred, - struct label *newlabel); -typedef int (*mpo_cred_check_visible_t)(struct ucred *cr1, - struct ucred *cr2); -typedef int (*mpo_ifnet_check_relabel_t)(struct ucred *cred, - struct ifnet *ifp, struct label *ifplabel, - struct label *newlabel); -typedef int (*mpo_ifnet_check_transmit_t)(struct ifnet *ifp, - struct label *ifplabel, struct mbuf *m, - struct label *mlabel); -typedef int (*mpo_inpcb_check_deliver_t)(struct inpcb *inp, - struct label *inplabel, struct mbuf *m, - struct label *mlabel); -typedef int (*mpo_sysvmsq_check_msgmsq_t)(struct ucred *cred, - struct msg *msgptr, struct label *msglabel, - struct msqid_kernel *msqkptr, struct label *msqklabel); -typedef int (*mpo_sysvmsq_check_msgrcv_t)(struct ucred *cred, - struct msg *msgptr, struct label *msglabel); -typedef int (*mpo_sysvmsq_check_msgrmid_t)(struct ucred *cred, - struct msg *msgptr, struct label *msglabel); -typedef int (*mpo_sysvmsq_check_msqget_t)(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel); -typedef int (*mpo_sysvmsq_check_msqsnd_t)(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel); -typedef int (*mpo_sysvmsq_check_msqrcv_t)(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel); -typedef int (*mpo_sysvmsq_check_msqctl_t)(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel, - int cmd); -typedef int (*mpo_sysvsem_check_semctl_t)(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel, - int cmd); -typedef int (*mpo_sysvsem_check_semget_t)(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel); -typedef int (*mpo_sysvsem_check_semop_t)(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel, - size_t accesstype); -typedef int (*mpo_sysvshm_check_shmat_t)(struct ucred *cred, - struct shmid_kernel *shmsegptr, - struct label *shmseglabel, int shmflg); -typedef int (*mpo_sysvshm_check_shmctl_t)(struct ucred *cred, - struct shmid_kernel *shmsegptr, - struct label *shmseglabel, int cmd); -typedef int (*mpo_sysvshm_check_shmdt_t)(struct ucred *cred, - struct shmid_kernel *shmsegptr, - struct label *shmseglabel); -typedef int (*mpo_sysvshm_check_shmget_t)(struct ucred *cred, - struct shmid_kernel *shmsegptr, - struct label *shmseglabel, int shmflg); typedef int (*mpo_kenv_check_dump_t)(struct ucred *cred); typedef int (*mpo_kenv_check_get_t)(struct ucred *cred, char *name); typedef int (*mpo_kenv_check_set_t)(struct ucred *cred, char *name, char *value); typedef int (*mpo_kenv_check_unset_t)(struct ucred *cred, char *name); + typedef int (*mpo_kld_check_load_t)(struct ucred *cred, struct vnode *vp, struct label *vplabel); typedef int (*mpo_kld_check_stat_t)(struct ucred *cred); -typedef int (*mpo_mpo_placeholder19_t)(void); -typedef int (*mpo_mpo_placeholder20_t)(void); + +typedef void (*mpo_mbuf_copy_label_t)(struct label *src, + struct label *dest); +typedef void (*mpo_mbuf_create_from_firewall_t)(struct mbuf *m, + struct label *label); +typedef void (*mpo_create_mbuf_linklayer_t)(struct ifnet *ifp, + struct label *ifplabel, struct mbuf *m, + struct label *mlabel); +typedef void (*mpo_mbuf_create_multicast_encap_t)(struct mbuf *m, + struct label *mlabel, struct ifnet *ifp, + struct label *ifplabel, struct mbuf *mnew, + struct label *mnewlabel); +typedef void (*mpo_mbuf_create_netlayer_t)(struct mbuf *m, + struct label *mlabel, struct mbuf *mnew, + struct label *mnewlabel); +typedef void (*mpo_mbuf_destroy_label_t)(struct label *label); +typedef int (*mpo_mbuf_init_label_t)(struct label *label, int flag); + typedef int (*mpo_mount_check_stat_t)(struct ucred *cred, struct mount *mp, struct label *mplabel); -typedef int (*mpo_mpo_placeholder21_t)(void); +typedef void (*mpo_mount_create_t)(struct ucred *cred, struct mount *mp, + struct label *mplabel); +typedef void (*mpo_mount_destroy_label_t)(struct label *label); +typedef void (*mpo_mount_init_label_t)(struct label *label); + +typedef void (*mpo_netinet_fragment_t)(struct mbuf *m, + struct label *mlabel, struct mbuf *frag, + struct label *fraglabel); +typedef void (*mpo_netinet_icmp_reply_t)(struct mbuf *m, + struct label *mlabel); +typedef void (*mpo_netinet_tcp_reply_t)(struct mbuf *m, + struct label *mlabel); + typedef int (*mpo_pipe_check_ioctl_t)(struct ucred *cred, struct pipepair *pp, struct label *pplabel, unsigned long cmd, void *data); @@ -433,6 +265,19 @@ typedef int (*mpo_pipe_check_stat_t)(struct ucred *cred, struct pipepair *pp, struct label *pplabel); typedef int (*mpo_pipe_check_write_t)(struct ucred *cred, struct pipepair *pp, struct label *pplabel); +typedef void (*mpo_pipe_copy_label_t)(struct label *src, + struct label *dest); +typedef void (*mpo_pipe_create_t)(struct ucred *cred, struct pipepair *pp, + struct label *pplabel); +typedef void (*mpo_pipe_destroy_label_t)(struct label *label); +typedef int (*mpo_pipe_externalize_label_t)(struct label *label, + char *element_name, struct sbuf *sb, int *claimed); +typedef void (*mpo_pipe_init_label_t)(struct label *label); +typedef int (*mpo_pipe_internalize_label_t)(struct label *label, + char *element_name, char *element_data, int *claimed); +typedef void (*mpo_pipe_relabel_t)(struct ucred *cred, struct pipepair *pp, + struct label *oldlabel, struct label *newlabel); + typedef int (*mpo_posixsem_check_destroy_t)(struct ucred *cred, struct ksem *ks, struct label *kslabel); typedef int (*mpo_posixsem_check_getvalue_t)(struct ucred *cred, @@ -445,6 +290,15 @@ typedef int (*mpo_posixsem_check_unlink_t)(struct ucred *cred, struct ksem *ks, struct label *kslabel); typedef int (*mpo_posixsem_check_wait_t)(struct ucred *cred, struct ksem *ks, struct label *kslabel); +typedef void (*mpo_posixsem_create_t)(struct ucred *cred, + struct ksem *ks, struct label *kslabel); +typedef void (*mpo_posixsem_destroy_label_t)(struct label *label); +typedef void (*mpo_posixsem_init_label_t)(struct label *label); + +typedef int (*mpo_priv_check_t)(struct ucred *cred, int priv); +typedef int (*mpo_priv_grant_t)(struct ucred *cred, int priv); + +typedef void (*mpo_proc_associate_nfsd_t)(struct ucred *cred); typedef int (*mpo_proc_check_debug_t)(struct ucred *cred, struct proc *p); typedef int (*mpo_proc_check_sched_t)(struct ucred *cred, @@ -454,24 +308,29 @@ typedef int (*mpo_proc_check_setaudit_t)(struct ucred *cred, typedef int (*mpo_proc_check_setaudit_addr_t)(struct ucred *cred, struct auditinfo_addr *aia); typedef int (*mpo_proc_check_setauid_t)(struct ucred *cred, uid_t auid); -typedef int (*mpo_proc_check_setuid_t)(struct ucred *cred, uid_t uid); +typedef int (*mpo_proc_check_setegid_t)(struct ucred *cred, gid_t egid); typedef int (*mpo_proc_check_seteuid_t)(struct ucred *cred, uid_t euid); typedef int (*mpo_proc_check_setgid_t)(struct ucred *cred, gid_t gid); -typedef int (*mpo_proc_check_setegid_t)(struct ucred *cred, gid_t egid); typedef int (*mpo_proc_check_setgroups_t)(struct ucred *cred, int ngroups, gid_t *gidset); -typedef int (*mpo_proc_check_setreuid_t)(struct ucred *cred, uid_t ruid, - uid_t euid); typedef int (*mpo_proc_check_setregid_t)(struct ucred *cred, gid_t rgid, gid_t egid); -typedef int (*mpo_proc_check_setresuid_t)(struct ucred *cred, uid_t ruid, - uid_t euid, uid_t suid); typedef int (*mpo_proc_check_setresgid_t)(struct ucred *cred, gid_t rgid, gid_t egid, gid_t sgid); +typedef int (*mpo_proc_check_setresuid_t)(struct ucred *cred, uid_t ruid, + uid_t euid, uid_t suid); +typedef int (*mpo_proc_check_setreuid_t)(struct ucred *cred, uid_t ruid, + uid_t euid); +typedef int (*mpo_proc_check_setuid_t)(struct ucred *cred, uid_t uid); typedef int (*mpo_proc_check_signal_t)(struct ucred *cred, struct proc *proc, int signum); typedef int (*mpo_proc_check_wait_t)(struct ucred *cred, struct proc *proc); +typedef void (*mpo_proc_create_init_t)(struct ucred *cred); +typedef void (*mpo_proc_create_swapper_t)(struct ucred *cred); +typedef void (*mpo_proc_destroy_label_t)(struct label *label); +typedef void (*mpo_proc_init_label_t)(struct label *label); + typedef int (*mpo_socket_check_accept_t)(struct ucred *cred, struct socket *so, struct label *solabel); typedef int (*mpo_socket_check_bind_t)(struct ucred *cred, @@ -500,6 +359,44 @@ typedef int (*mpo_socket_check_stat_t)(struct ucred *cred, struct socket *so, struct label *solabel); typedef int (*mpo_socket_check_visible_t)(struct ucred *cred, struct socket *so, struct label *solabel); +typedef void (*mpo_socket_copy_label_t)(struct label *src, + struct label *dest); +typedef void (*mpo_socket_create_t)(struct ucred *cred, struct socket *so, + struct label *solabel); +typedef void (*mpo_socket_create_mbuf_t)(struct socket *so, + struct label *solabel, struct mbuf *m, + struct label *mlabel); +typedef void (*mpo_socket_destroy_label_t)(struct label *label); +typedef int (*mpo_socket_externalize_label_t)(struct label *label, + char *element_name, struct sbuf *sb, int *claimed); +typedef int (*mpo_socket_init_label_t)(struct label *label, int flag); +typedef int (*mpo_socket_internalize_label_t)(struct label *label, + char *element_name, char *element_data, int *claimed); +typedef void (*mpo_socket_newconn_t)(struct socket *oldso, + struct label *oldsolabel, struct socket *newso, + struct label *newsolabel); +typedef void (*mpo_socket_relabel_t)(struct ucred *cred, struct socket *so, + struct label *oldlabel, struct label *newlabel); + +typedef void (*mpo_socketpeer_destroy_label_t)(struct label *label); +typedef int (*mpo_socketpeer_externalize_label_t)(struct label *label, + char *element_name, struct sbuf *sb, int *claimed); +typedef int (*mpo_socketpeer_init_label_t)(struct label *label, + int flag); +typedef void (*mpo_socketpeer_set_from_mbuf_t)(struct mbuf *m, + struct label *mlabel, struct socket *so, + struct label *sopeerlabel); +typedef void (*mpo_socketpeer_set_from_socket_t)(struct socket *oldso, + struct label *oldsolabel, struct socket *newso, + struct label *newsopeerlabel); + +typedef void (*mpo_syncache_create_t)(struct label *label, + struct inpcb *inp); +typedef void (*mpo_syncache_create_mbuf_t)(struct label *sc_label, + struct mbuf *m, struct label *mlabel); +typedef void (*mpo_syncache_destroy_label_t)(struct label *label); +typedef int (*mpo_syncache_init_label_t)(struct label *label, int flag); + typedef int (*mpo_system_check_acct_t)(struct ucred *cred, struct vnode *vp, struct label *vplabel); typedef int (*mpo_system_check_audit_t)(struct ucred *cred, void *record, @@ -515,6 +412,76 @@ typedef int (*mpo_system_check_swapoff_t)(struct ucred *cred, typedef int (*mpo_system_check_sysctl_t)(struct ucred *cred, struct sysctl_oid *oidp, void *arg1, int arg2, struct sysctl_req *req); + +typedef void (*mpo_sysvmsg_cleanup_t)(struct label *msglabel); +typedef void (*mpo_sysvmsg_create_t)(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqlabel, + struct msg *msgptr, struct label *msglabel); +typedef void (*mpo_sysvmsg_destroy_label_t)(struct label *label); +typedef void (*mpo_sysvmsg_init_label_t)(struct label *label); + +typedef int (*mpo_sysvmsq_check_msgmsq_t)(struct ucred *cred, + struct msg *msgptr, struct label *msglabel, + struct msqid_kernel *msqkptr, struct label *msqklabel); +typedef int (*mpo_sysvmsq_check_msgrcv_t)(struct ucred *cred, + struct msg *msgptr, struct label *msglabel); +typedef int (*mpo_sysvmsq_check_msgrmid_t)(struct ucred *cred, + struct msg *msgptr, struct label *msglabel); +typedef int (*mpo_sysvmsq_check_msqget_t)(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel); +typedef int (*mpo_sysvmsq_check_msqctl_t)(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel, + int cmd); +typedef int (*mpo_sysvmsq_check_msqrcv_t)(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel); +typedef int (*mpo_sysvmsq_check_msqsnd_t)(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel); +typedef void (*mpo_sysvmsq_cleanup_t)(struct label *msqlabel); +typedef void (*mpo_sysvmsq_create_t)(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqlabel); +typedef void (*mpo_sysvmsq_destroy_label_t)(struct label *label); +typedef void (*mpo_sysvmsq_init_label_t)(struct label *label); + +typedef int (*mpo_sysvsem_check_semctl_t)(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel, + int cmd); +typedef int (*mpo_sysvsem_check_semget_t)(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel); +typedef int (*mpo_sysvsem_check_semop_t)(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel, + size_t accesstype); +typedef void (*mpo_sysvsem_cleanup_t)(struct label *semalabel); +typedef void (*mpo_sysvsem_create_t)(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semalabel); +typedef void (*mpo_sysvsem_destroy_label_t)(struct label *label); +typedef void (*mpo_sysvsem_init_label_t)(struct label *label); + +typedef int (*mpo_sysvshm_check_shmat_t)(struct ucred *cred, + struct shmid_kernel *shmsegptr, + struct label *shmseglabel, int shmflg); +typedef int (*mpo_sysvshm_check_shmctl_t)(struct ucred *cred, + struct shmid_kernel *shmsegptr, + struct label *shmseglabel, int cmd); +typedef int (*mpo_sysvshm_check_shmdt_t)(struct ucred *cred, + struct shmid_kernel *shmsegptr, + struct label *shmseglabel); +typedef int (*mpo_sysvshm_check_shmget_t)(struct ucred *cred, + struct shmid_kernel *shmsegptr, + struct label *shmseglabel, int shmflg); +typedef void (*mpo_sysvshm_cleanup_t)(struct label *shmlabel); +typedef void (*mpo_sysvshm_create_t)(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmlabel); +typedef void (*mpo_sysvshm_destroy_label_t)(struct label *label); +typedef void (*mpo_sysvshm_init_label_t)(struct label *label); + +typedef void (*mpo_thread_userret_t)(struct thread *thread); + +typedef int (*mpo_vnode_associate_extattr_t)(struct mount *mp, + struct label *mplabel, struct vnode *vp, + struct label *vplabel); +typedef void (*mpo_vnode_associate_singlelabel_t)(struct mount *mp, + struct label *mplabel, struct vnode *vp, + struct label *vplabel); typedef int (*mpo_vnode_check_access_t)(struct ucred *cred, struct vnode *vp, struct label *vplabel, int acc_mode); typedef int (*mpo_vnode_check_chdir_t)(struct ucred *cred, @@ -607,9 +574,32 @@ typedef int (*mpo_vnode_check_unlink_t)(struct ucred *cred, typedef int (*mpo_vnode_check_write_t)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *vplabel); -typedef void (*mpo_proc_associate_nfsd_t)(struct ucred *cred); -typedef int (*mpo_priv_check_t)(struct ucred *cred, int priv); -typedef int (*mpo_priv_grant_t)(struct ucred *cred, int priv); +typedef void (*mpo_vnode_copy_label_t)(struct label *src, + struct label *dest); +typedef int (*mpo_vnode_create_extattr_t)(struct ucred *cred, + struct mount *mp, struct label *mplabel, + struct vnode *dvp, struct label *dvplabel, + struct vnode *vp, struct label *vplabel, + struct componentname *cnp); +typedef void (*mpo_vnode_destroy_label_t)(struct label *label); +typedef void (*mpo_vnode_execve_transition_t)(struct ucred *old, + struct ucred *new, struct vnode *vp, + struct label *vplabel, struct label *interpvplabel, + struct image_params *imgp, struct label *execlabel); +typedef int (*mpo_vnode_execve_will_transition_t)(struct ucred *old, + struct vnode *vp, struct label *vplabel, + struct label *interpvplabel, struct image_params *imgp, + struct label *execlabel); +typedef int (*mpo_vnode_externalize_label_t)(struct label *label, + char *element_name, struct sbuf *sb, int *claimed); +typedef void (*mpo_vnode_init_label_t)(struct label *label); +typedef int (*mpo_vnode_internalize_label_t)(struct label *label, + char *element_name, char *element_data, int *claimed); +typedef void (*mpo_vnode_relabel_t)(struct ucred *cred, struct vnode *vp, + struct label *vplabel, struct label *label); +typedef int (*mpo_vnode_setlabel_extattr_t)(struct ucred *cred, + struct vnode *vp, struct label *vplabel, + struct label *intlabel); struct mac_policy_ops { /* @@ -631,202 +621,107 @@ struct mac_policy_ops { * initialized storage, and externalize/internalize from/to * initialized storage. */ - mpo_bpfdesc_init_label_t mpo_bpfdesc_init_label; - mpo_cred_init_label_t mpo_cred_init_label; - mpo_devfs_init_label_t mpo_devfs_init_label; - mpo_placeholder_t _mpo_placeholder0; - mpo_ifnet_init_label_t mpo_ifnet_init_label; - mpo_inpcb_init_label_t mpo_inpcb_init_label; - mpo_sysvmsg_init_label_t mpo_sysvmsg_init_label; - mpo_sysvmsq_init_label_t mpo_sysvmsq_init_label; - mpo_sysvsem_init_label_t mpo_sysvsem_init_label; - mpo_sysvshm_init_label_t mpo_sysvshm_init_label; - mpo_ipq_init_label_t mpo_ipq_init_label; - mpo_mbuf_init_label_t mpo_mbuf_init_label; - mpo_mount_init_label_t mpo_mount_init_label; - mpo_socket_init_label_t mpo_socket_init_label; - mpo_socketpeer_init_label_t mpo_socketpeer_init_label; - mpo_pipe_init_label_t mpo_pipe_init_label; - mpo_posixsem_init_label_t mpo_posixsem_init_label; - mpo_proc_init_label_t mpo_proc_init_label; - mpo_vnode_init_label_t mpo_vnode_init_label; + mpo_bpfdesc_check_receive_t mpo_bpfdesc_check_receive; + mpo_bpfdesc_create_t mpo_bpfdesc_create; + mpo_bpfdesc_create_mbuf_t mpo_bpfdesc_create_mbuf; mpo_bpfdesc_destroy_label_t mpo_bpfdesc_destroy_label; - mpo_cred_destroy_label_t mpo_cred_destroy_label; - mpo_devfs_destroy_label_t mpo_devfs_destroy_label; - mpo_placeholder_t _mpo_placeholder1; - mpo_ifnet_destroy_label_t mpo_ifnet_destroy_label; - mpo_inpcb_destroy_label_t mpo_inpcb_destroy_label; - mpo_sysvmsg_destroy_label_t mpo_sysvmsg_destroy_label; - mpo_sysvmsq_destroy_label_t mpo_sysvmsq_destroy_label; - mpo_sysvsem_destroy_label_t mpo_sysvsem_destroy_label; - mpo_sysvshm_destroy_label_t mpo_sysvshm_destroy_label; - mpo_ipq_destroy_label_t mpo_ipq_destroy_label; - mpo_mbuf_destroy_label_t mpo_mbuf_destroy_label; - mpo_mount_destroy_label_t mpo_mount_destroy_label; - mpo_socket_destroy_label_t mpo_socket_destroy_label; - mpo_socketpeer_destroy_label_t mpo_socketpeer_destroy_label; - mpo_pipe_destroy_label_t mpo_pipe_destroy_label; - mpo_posixsem_destroy_label_t mpo_posixsem_destroy_label; - mpo_proc_destroy_label_t mpo_proc_destroy_label; - mpo_vnode_destroy_label_t mpo_vnode_destroy_label; - mpo_sysvmsg_cleanup_t mpo_sysvmsg_cleanup; - mpo_sysvmsq_cleanup_t mpo_sysvmsq_cleanup; - mpo_sysvsem_cleanup_t mpo_sysvsem_cleanup; - mpo_sysvshm_cleanup_t mpo_sysvshm_cleanup; + mpo_bpfdesc_init_label_t mpo_bpfdesc_init_label; + + mpo_cred_check_relabel_t mpo_cred_check_relabel; + mpo_cred_check_visible_t mpo_cred_check_visible; mpo_cred_copy_label_t mpo_cred_copy_label; - mpo_ifnet_copy_label_t mpo_ifnet_copy_label; - mpo_mbuf_copy_label_t mpo_mbuf_copy_label; - mpo_placeholder_t _mpo_placeholder2; - mpo_pipe_copy_label_t mpo_pipe_copy_label; - mpo_socket_copy_label_t mpo_socket_copy_label; - mpo_vnode_copy_label_t mpo_vnode_copy_label; + mpo_cred_destroy_label_t mpo_cred_destroy_label; mpo_cred_externalize_label_t mpo_cred_externalize_label; - mpo_ifnet_externalize_label_t mpo_ifnet_externalize_label; - mpo_placeholder_t _mpo_placeholder3; - mpo_pipe_externalize_label_t mpo_pipe_externalize_label; - mpo_socket_externalize_label_t mpo_socket_externalize_label; - mpo_socketpeer_externalize_label_t mpo_socketpeer_externalize_label; - mpo_vnode_externalize_label_t mpo_vnode_externalize_label; + mpo_cred_init_label_t mpo_cred_init_label; mpo_cred_internalize_label_t mpo_cred_internalize_label; - mpo_ifnet_internalize_label_t mpo_ifnet_internalize_label; - mpo_placeholder_t _mpo_placeholder4; - mpo_pipe_internalize_label_t mpo_pipe_internalize_label; - mpo_socket_internalize_label_t mpo_socket_internalize_label; - mpo_vnode_internalize_label_t mpo_vnode_internalize_label; + mpo_cred_relabel_t mpo_cred_relabel; - /* - * Labeling event operations: file system objects, and things that - * look a lot like file system objects. - */ - mpo_devfs_vnode_associate_t mpo_devfs_vnode_associate; - mpo_vnode_associate_extattr_t mpo_vnode_associate_extattr; - mpo_vnode_associate_singlelabel_t mpo_vnode_associate_singlelabel; mpo_devfs_create_device_t mpo_devfs_create_device; mpo_devfs_create_directory_t mpo_devfs_create_directory; mpo_devfs_create_symlink_t mpo_devfs_create_symlink; - mpo_placeholder_t _mpo_placeholder5; - mpo_vnode_create_extattr_t mpo_vnode_create_extattr; - mpo_mount_create_t mpo_mount_create; - mpo_vnode_relabel_t mpo_vnode_relabel; - mpo_vnode_setlabel_extattr_t mpo_vnode_setlabel_extattr; + mpo_devfs_destroy_label_t mpo_devfs_destroy_label; + mpo_devfs_init_label_t mpo_devfs_init_label; mpo_devfs_update_t mpo_devfs_update; + mpo_devfs_vnode_associate_t mpo_devfs_vnode_associate; - /* - * Labeling event operations: IPC objects. - */ - mpo_socket_create_mbuf_t mpo_socket_create_mbuf; - mpo_socket_create_t mpo_socket_create; - mpo_socket_newconn_t mpo_socket_newconn; - mpo_socket_relabel_t mpo_socket_relabel; - mpo_pipe_relabel_t mpo_pipe_relabel; - mpo_socketpeer_set_from_mbuf_t mpo_socketpeer_set_from_mbuf; - mpo_socketpeer_set_from_socket_t mpo_socketpeer_set_from_socket; - mpo_pipe_create_t mpo_pipe_create; - - /* - * Labeling event operations: System V IPC primitives. - */ - mpo_sysvmsg_create_t mpo_sysvmsg_create; - mpo_sysvmsq_create_t mpo_sysvmsq_create; - mpo_sysvsem_create_t mpo_sysvsem_create; - mpo_sysvshm_create_t mpo_sysvshm_create; - - /* - * Labeling event operations: POSIX (global/inter-process) semaphores. - */ - mpo_posixsem_create_t mpo_posixsem_create; - - /* - * Labeling event operations: network objects. - */ - mpo_bpfdesc_create_t mpo_bpfdesc_create; + mpo_ifnet_check_relabel_t mpo_ifnet_check_relabel; + mpo_ifnet_check_transmit_t mpo_ifnet_check_transmit; + mpo_ifnet_copy_label_t mpo_ifnet_copy_label; mpo_ifnet_create_t mpo_ifnet_create; - mpo_inpcb_create_t mpo_inpcb_create; - mpo_ipq_create_t mpo_ipq_create; - mpo_ipq_reassemble mpo_ipq_reassemble; - mpo_netinet_fragment_t mpo_netinet_fragment; - mpo_inpcb_create_mbuf_t mpo_inpcb_create_mbuf; - mpo_create_mbuf_linklayer_t mpo_create_mbuf_linklayer; - mpo_bpfdesc_create_mbuf_t mpo_bpfdesc_create_mbuf; mpo_ifnet_create_mbuf_t mpo_ifnet_create_mbuf; - mpo_mbuf_create_multicast_encap_t mpo_mbuf_create_multicast_encap; - mpo_mbuf_create_netlayer_t mpo_mbuf_create_netlayer; - mpo_ipq_match_t mpo_ipq_match; - mpo_netinet_icmp_reply_t mpo_netinet_icmp_reply; - mpo_netinet_tcp_reply_t mpo_netinet_tcp_reply; + mpo_ifnet_destroy_label_t mpo_ifnet_destroy_label; + mpo_ifnet_externalize_label_t mpo_ifnet_externalize_label; + mpo_ifnet_init_label_t mpo_ifnet_init_label; + mpo_ifnet_internalize_label_t mpo_ifnet_internalize_label; mpo_ifnet_relabel_t mpo_ifnet_relabel; - mpo_ipq_update_t mpo_ipq_update; + + mpo_inpcb_check_deliver_t mpo_inpcb_check_deliver; + mpo_inpcb_create_t mpo_inpcb_create; + mpo_inpcb_create_mbuf_t mpo_inpcb_create_mbuf; + mpo_inpcb_destroy_label_t mpo_inpcb_destroy_label; + mpo_inpcb_init_label_t mpo_inpcb_init_label; mpo_inpcb_sosetlabel_t mpo_inpcb_sosetlabel; - /* - * Labeling event operations: processes. - */ - mpo_vnode_execve_transition_t mpo_vnode_execve_transition; - mpo_vnode_execve_will_transition_t mpo_vnode_execve_will_transition; - mpo_proc_create_swapper_t mpo_proc_create_swapper; - mpo_proc_create_init_t mpo_proc_create_init; - mpo_proc_associate_nfsd_t mpo_proc_associate_nfsd; - mpo_cred_relabel_t mpo_cred_relabel; - mpo_placeholder_t _mpo_placeholder6; - mpo_thread_userret_t mpo_thread_userret; + mpo_ipq_create_t mpo_ipq_create; + mpo_ipq_destroy_label_t mpo_ipq_destroy_label; + mpo_ipq_init_label_t mpo_ipq_init_label; + mpo_ipq_match_t mpo_ipq_match; + mpo_ipq_reassemble mpo_ipq_reassemble; + mpo_ipq_update_t mpo_ipq_update; - /* - * Access control checks. - */ - mpo_bpfdesc_check_receive_t mpo_bpfdesc_check_receive; - mpo_placeholder_t _mpo_placeholder7; - mpo_cred_check_relabel_t mpo_cred_check_relabel; - mpo_cred_check_visible_t mpo_cred_check_visible; - mpo_placeholder_t _mpo_placeholder8; - mpo_placeholder_t _mpo_placeholder9; - mpo_placeholder_t _mpo_placeholder10; - mpo_placeholder_t _mpo_placeholder11; - mpo_placeholder_t _mpo_placeholder12; - mpo_placeholder_t _mpo_placeholder13; - mpo_placeholder_t _mpo_placeholder14; - mpo_placeholder_t _mpo_placeholder15; - mpo_placeholder_t _mpo_placeholder16; - mpo_placeholder_t _mpo_placeholder17; - mpo_placeholder_t _mpo_placeholder18; - mpo_ifnet_check_relabel_t mpo_ifnet_check_relabel; - mpo_ifnet_check_transmit_t mpo_ifnet_check_transmit; - mpo_inpcb_check_deliver_t mpo_inpcb_check_deliver; - mpo_sysvmsq_check_msgmsq_t mpo_sysvmsq_check_msgmsq; - mpo_sysvmsq_check_msgrcv_t mpo_sysvmsq_check_msgrcv; - mpo_sysvmsq_check_msgrmid_t mpo_sysvmsq_check_msgrmid; - mpo_sysvmsq_check_msqget_t mpo_sysvmsq_check_msqget; - mpo_sysvmsq_check_msqsnd_t mpo_sysvmsq_check_msqsnd; - mpo_sysvmsq_check_msqrcv_t mpo_sysvmsq_check_msqrcv; - mpo_sysvmsq_check_msqctl_t mpo_sysvmsq_check_msqctl; - mpo_sysvsem_check_semctl_t mpo_sysvsem_check_semctl; - mpo_sysvsem_check_semget_t mpo_sysvsem_check_semget; - mpo_sysvsem_check_semop_t mpo_sysvsem_check_semop; - mpo_sysvshm_check_shmat_t mpo_sysvshm_check_shmat; - mpo_sysvshm_check_shmctl_t mpo_sysvshm_check_shmctl; - mpo_sysvshm_check_shmdt_t mpo_sysvshm_check_shmdt; - mpo_sysvshm_check_shmget_t mpo_sysvshm_check_shmget; mpo_kenv_check_dump_t mpo_kenv_check_dump; mpo_kenv_check_get_t mpo_kenv_check_get; mpo_kenv_check_set_t mpo_kenv_check_set; mpo_kenv_check_unset_t mpo_kenv_check_unset; + mpo_kld_check_load_t mpo_kld_check_load; mpo_kld_check_stat_t mpo_kld_check_stat; - mpo_placeholder_t _mpo_placeholder19; - mpo_placeholder_t _mpo_placeholder20; + + mpo_mbuf_copy_label_t mpo_mbuf_copy_label; + mpo_mbuf_create_from_firewall_t mpo_mbuf_create_from_firewall; + mpo_create_mbuf_linklayer_t mpo_create_mbuf_linklayer; + mpo_mbuf_create_multicast_encap_t mpo_mbuf_create_multicast_encap; + mpo_mbuf_create_netlayer_t mpo_mbuf_create_netlayer; + mpo_mbuf_destroy_label_t mpo_mbuf_destroy_label; + mpo_mbuf_init_label_t mpo_mbuf_init_label; + mpo_mount_check_stat_t mpo_mount_check_stat; - mpo_placeholder_t _mpo_placeholder_21; + mpo_mount_create_t mpo_mount_create; + mpo_mount_destroy_label_t mpo_mount_destroy_label; + mpo_mount_init_label_t mpo_mount_init_label; + + mpo_netinet_fragment_t mpo_netinet_fragment; + mpo_netinet_icmp_reply_t mpo_netinet_icmp_reply; + mpo_netinet_tcp_reply_t mpo_netinet_tcp_reply; + mpo_pipe_check_ioctl_t mpo_pipe_check_ioctl; mpo_pipe_check_poll_t mpo_pipe_check_poll; mpo_pipe_check_read_t mpo_pipe_check_read; mpo_pipe_check_relabel_t mpo_pipe_check_relabel; mpo_pipe_check_stat_t mpo_pipe_check_stat; mpo_pipe_check_write_t mpo_pipe_check_write; + mpo_pipe_copy_label_t mpo_pipe_copy_label; + mpo_pipe_create_t mpo_pipe_create; + mpo_pipe_destroy_label_t mpo_pipe_destroy_label; + mpo_pipe_externalize_label_t mpo_pipe_externalize_label; + mpo_pipe_init_label_t mpo_pipe_init_label; + mpo_pipe_internalize_label_t mpo_pipe_internalize_label; + mpo_pipe_relabel_t mpo_pipe_relabel; + mpo_posixsem_check_destroy_t mpo_posixsem_check_destroy; mpo_posixsem_check_getvalue_t mpo_posixsem_check_getvalue; mpo_posixsem_check_open_t mpo_posixsem_check_open; mpo_posixsem_check_post_t mpo_posixsem_check_post; mpo_posixsem_check_unlink_t mpo_posixsem_check_unlink; mpo_posixsem_check_wait_t mpo_posixsem_check_wait; + mpo_posixsem_create_t mpo_posixsem_create; + mpo_posixsem_destroy_label_t mpo_posixsem_destroy_label; + mpo_posixsem_init_label_t mpo_posixsem_init_label; + + mpo_priv_check_t mpo_priv_check; + mpo_priv_grant_t mpo_priv_grant; + + mpo_proc_associate_nfsd_t mpo_proc_associate_nfsd; mpo_proc_check_debug_t mpo_proc_check_debug; mpo_proc_check_sched_t mpo_proc_check_sched; mpo_proc_check_setaudit_t mpo_proc_check_setaudit; @@ -843,12 +738,16 @@ struct mac_policy_ops { mpo_proc_check_setresgid_t mpo_proc_check_setresgid; mpo_proc_check_signal_t mpo_proc_check_signal; mpo_proc_check_wait_t mpo_proc_check_wait; + mpo_proc_create_swapper_t mpo_proc_create_swapper; + mpo_proc_create_init_t mpo_proc_create_init; + mpo_proc_destroy_label_t mpo_proc_destroy_label; + mpo_proc_init_label_t mpo_proc_init_label; + mpo_socket_check_accept_t mpo_socket_check_accept; mpo_socket_check_bind_t mpo_socket_check_bind; mpo_socket_check_connect_t mpo_socket_check_connect; mpo_socket_check_create_t mpo_socket_check_create; mpo_socket_check_deliver_t mpo_socket_check_deliver; - mpo_placeholder_t _mpo_placeholder22; mpo_socket_check_listen_t mpo_socket_check_listen; mpo_socket_check_poll_t mpo_socket_check_poll; mpo_socket_check_receive_t mpo_socket_check_receive; @@ -856,6 +755,27 @@ struct mac_policy_ops { mpo_socket_check_send_t mpo_socket_check_send; mpo_socket_check_stat_t mpo_socket_check_stat; mpo_socket_check_visible_t mpo_socket_check_visible; + mpo_socket_copy_label_t mpo_socket_copy_label; + mpo_socket_create_t mpo_socket_create; + mpo_socket_create_mbuf_t mpo_socket_create_mbuf; + mpo_socket_destroy_label_t mpo_socket_destroy_label; + mpo_socket_externalize_label_t mpo_socket_externalize_label; + mpo_socket_init_label_t mpo_socket_init_label; + mpo_socket_internalize_label_t mpo_socket_internalize_label; + mpo_socket_newconn_t mpo_socket_newconn; + mpo_socket_relabel_t mpo_socket_relabel; + + mpo_socketpeer_destroy_label_t mpo_socketpeer_destroy_label; + mpo_socketpeer_externalize_label_t mpo_socketpeer_externalize_label; + mpo_socketpeer_init_label_t mpo_socketpeer_init_label; + mpo_socketpeer_set_from_mbuf_t mpo_socketpeer_set_from_mbuf; + mpo_socketpeer_set_from_socket_t mpo_socketpeer_set_from_socket; + + mpo_syncache_init_label_t mpo_syncache_init_label; + mpo_syncache_destroy_label_t mpo_syncache_destroy_label; + mpo_syncache_create_t mpo_syncache_create; + mpo_syncache_create_mbuf_t mpo_syncache_create_mbuf; + mpo_system_check_acct_t mpo_system_check_acct; mpo_system_check_audit_t mpo_system_check_audit; mpo_system_check_auditctl_t mpo_system_check_auditctl; @@ -864,7 +784,43 @@ struct mac_policy_ops { mpo_system_check_swapon_t mpo_system_check_swapon; mpo_system_check_swapoff_t mpo_system_check_swapoff; mpo_system_check_sysctl_t mpo_system_check_sysctl; - mpo_placeholder_t _mpo_placeholder23; + + mpo_sysvmsg_cleanup_t mpo_sysvmsg_cleanup; + mpo_sysvmsg_create_t mpo_sysvmsg_create; + mpo_sysvmsg_destroy_label_t mpo_sysvmsg_destroy_label; + mpo_sysvmsg_init_label_t mpo_sysvmsg_init_label; + + mpo_sysvmsq_check_msgmsq_t mpo_sysvmsq_check_msgmsq; + mpo_sysvmsq_check_msgrcv_t mpo_sysvmsq_check_msgrcv; + mpo_sysvmsq_check_msgrmid_t mpo_sysvmsq_check_msgrmid; + mpo_sysvmsq_check_msqctl_t mpo_sysvmsq_check_msqctl; + mpo_sysvmsq_check_msqget_t mpo_sysvmsq_check_msqget; + mpo_sysvmsq_check_msqrcv_t mpo_sysvmsq_check_msqrcv; + mpo_sysvmsq_check_msqsnd_t mpo_sysvmsq_check_msqsnd; + mpo_sysvmsq_cleanup_t mpo_sysvmsq_cleanup; + mpo_sysvmsq_create_t mpo_sysvmsq_create; + mpo_sysvmsq_destroy_label_t mpo_sysvmsq_destroy_label; + mpo_sysvmsq_init_label_t mpo_sysvmsq_init_label; + + mpo_sysvsem_check_semctl_t mpo_sysvsem_check_semctl; + mpo_sysvsem_check_semget_t mpo_sysvsem_check_semget; + mpo_sysvsem_check_semop_t mpo_sysvsem_check_semop; + mpo_sysvsem_cleanup_t mpo_sysvsem_cleanup; + mpo_sysvsem_create_t mpo_sysvsem_create; + mpo_sysvsem_destroy_label_t mpo_sysvsem_destroy_label; + mpo_sysvsem_init_label_t mpo_sysvsem_init_label; + + mpo_sysvshm_check_shmat_t mpo_sysvshm_check_shmat; + mpo_sysvshm_check_shmctl_t mpo_sysvshm_check_shmctl; + mpo_sysvshm_check_shmdt_t mpo_sysvshm_check_shmdt; + mpo_sysvshm_check_shmget_t mpo_sysvshm_check_shmget; + mpo_sysvshm_cleanup_t mpo_sysvshm_cleanup; + mpo_sysvshm_create_t mpo_sysvshm_create; + mpo_sysvshm_destroy_label_t mpo_sysvshm_destroy_label; + mpo_sysvshm_init_label_t mpo_sysvshm_init_label; + + mpo_thread_userret_t mpo_thread_userret; + mpo_vnode_check_access_t mpo_vnode_check_access; mpo_vnode_check_chdir_t mpo_vnode_check_chdir; mpo_vnode_check_chroot_t mpo_vnode_check_chroot; @@ -874,7 +830,6 @@ struct mac_policy_ops { mpo_vnode_check_exec_t mpo_vnode_check_exec; mpo_vnode_check_getacl_t mpo_vnode_check_getacl; mpo_vnode_check_getextattr_t mpo_vnode_check_getextattr; - mpo_placeholder_t _mpo_placeholder24; mpo_vnode_check_link_t mpo_vnode_check_link; mpo_vnode_check_listextattr_t mpo_vnode_check_listextattr; mpo_vnode_check_lookup_t mpo_vnode_check_lookup; @@ -899,13 +854,18 @@ struct mac_policy_ops { mpo_vnode_check_stat_t mpo_vnode_check_stat; mpo_vnode_check_unlink_t mpo_vnode_check_unlink; mpo_vnode_check_write_t mpo_vnode_check_write; - mpo_mbuf_create_from_firewall_t mpo_mbuf_create_from_firewall; - mpo_syncache_init_label_t mpo_syncache_init_label; - mpo_syncache_destroy_label_t mpo_syncache_destroy_label; - mpo_syncache_create_t mpo_syncache_create; - mpo_syncache_create_mbuf_t mpo_syncache_create_mbuf; - mpo_priv_check_t mpo_priv_check; - mpo_priv_grant_t mpo_priv_grant; + mpo_vnode_associate_extattr_t mpo_vnode_associate_extattr; + mpo_vnode_associate_singlelabel_t mpo_vnode_associate_singlelabel; + mpo_vnode_destroy_label_t mpo_vnode_destroy_label; + mpo_vnode_copy_label_t mpo_vnode_copy_label; + mpo_vnode_create_extattr_t mpo_vnode_create_extattr; + mpo_vnode_execve_transition_t mpo_vnode_execve_transition; + mpo_vnode_execve_will_transition_t mpo_vnode_execve_will_transition; + mpo_vnode_externalize_label_t mpo_vnode_externalize_label; + mpo_vnode_init_label_t mpo_vnode_init_label; + mpo_vnode_internalize_label_t mpo_vnode_internalize_label; + mpo_vnode_relabel_t mpo_vnode_relabel; + mpo_vnode_setlabel_extattr_t mpo_vnode_setlabel_extattr; }; /* |
