1ddcdf265SRobert Watson /*-
29b6dd12eSRobert Watson * Copyright (c) 1999-2002, 2007-2011 Robert N. M. Watson
37f53207bSRobert Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4aed55708SRobert Watson * Copyright (c) 2005-2006 SPARTA, Inc.
5ddcdf265SRobert Watson * All rights reserved.
6ddcdf265SRobert Watson *
7ddcdf265SRobert Watson * This software was developed by Robert Watson for the TrustedBSD Project.
8ddcdf265SRobert Watson *
96201265bSRobert Watson * This software was developed for the FreeBSD Project in part by Network
106201265bSRobert Watson * Associates Laboratories, the Security Research Division of Network
116201265bSRobert Watson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
126201265bSRobert Watson * as part of the DARPA CHATS research program.
13ddcdf265SRobert Watson *
146758f88eSRobert Watson * This software was enhanced by SPARTA ISSO under SPAWAR contract
156758f88eSRobert Watson * N66001-04-C-6019 ("SEFOS").
166758f88eSRobert Watson *
176f6174a7SRobert Watson * This software was developed at the University of Cambridge Computer
186f6174a7SRobert Watson * Laboratory with support from a grant from Google, Inc.
196f6174a7SRobert Watson *
20ddcdf265SRobert Watson * Redistribution and use in source and binary forms, with or without
21ddcdf265SRobert Watson * modification, are permitted provided that the following conditions
22ddcdf265SRobert Watson * are met:
23ddcdf265SRobert Watson * 1. Redistributions of source code must retain the above copyright
24ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer.
25ddcdf265SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright
26ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer in the
27ddcdf265SRobert Watson * documentation and/or other materials provided with the distribution.
28ddcdf265SRobert Watson *
29ddcdf265SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
30ddcdf265SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31ddcdf265SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32ddcdf265SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
33ddcdf265SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34ddcdf265SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35ddcdf265SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36ddcdf265SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37ddcdf265SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38ddcdf265SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39ddcdf265SRobert Watson * SUCH DAMAGE.
40ddcdf265SRobert Watson */
41aed55708SRobert Watson
42ddcdf265SRobert Watson /*
43aed55708SRobert Watson * Kernel interface for Mandatory Access Control -- how kernel services
44aed55708SRobert Watson * interact with the TrustedBSD MAC Framework.
45ddcdf265SRobert Watson */
467f53207bSRobert Watson
47646a9f80SRobert Watson #ifndef _SECURITY_MAC_MAC_FRAMEWORK_H_
48646a9f80SRobert Watson #define _SECURITY_MAC_MAC_FRAMEWORK_H_
49aed55708SRobert Watson
50aed55708SRobert Watson #ifndef _KERNEL
51aed55708SRobert Watson #error "no user-serviceable parts inside"
52aed55708SRobert Watson #endif
53ddcdf265SRobert Watson
5418717f69SRobert Watson struct auditinfo;
55f1e8bf6dSRobert Watson struct auditinfo_addr;
56ddcdf265SRobert Watson struct bpf_d;
5789c9c53dSPoul-Henning Kamp struct cdev;
58ddcdf265SRobert Watson struct componentname;
59ddcdf265SRobert Watson struct devfs_dirent;
60ddcdf265SRobert Watson struct ifnet;
61ddcdf265SRobert Watson struct ifreq;
62670cb89bSRobert Watson struct image_params;
63a557af22SRobert Watson struct inpcb;
644b908c8bSRobert Watson struct ip6q;
65ddcdf265SRobert Watson struct ipq;
662449b9e5SMitchell Horne struct kdb_dbbe;
6752648411SRobert Watson struct ksem;
680142affcSRobert Watson struct label;
69225bff6fSRobert Watson struct m_tag;
70aed55708SRobert Watson struct mac;
71ddcdf265SRobert Watson struct mbuf;
72ddcdf265SRobert Watson struct mount;
7342726d8aSRobert Watson struct msg;
7442726d8aSRobert Watson struct msqid_kernel;
75ddcdf265SRobert Watson struct proc;
7642726d8aSRobert Watson struct semid_kernel;
778e38aeffSJohn Baldwin struct shmfd;
7842726d8aSRobert Watson struct shmid_kernel;
79ddcdf265SRobert Watson struct sockaddr;
80ddcdf265SRobert Watson struct socket;
8163dba32bSPawel Jakub Dawidek struct sysctl_oid;
8263dba32bSPawel Jakub Dawidek struct sysctl_req;
834795b82cSRobert Watson struct pipepair;
8492dbb82aSRobert Watson struct thread;
85ddcdf265SRobert Watson struct timespec;
86ddcdf265SRobert Watson struct ucred;
87ddcdf265SRobert Watson struct vattr;
88ddcdf265SRobert Watson struct vnode;
89aed55708SRobert Watson struct vop_setlabel_args;
90ddcdf265SRobert Watson
91215bab79SShivank Garg struct in_addr;
92215bab79SShivank Garg struct in6_addr;
93215bab79SShivank Garg
94ddcdf265SRobert Watson #include <sys/acl.h> /* XXX acl_type_t */
9515bc6b2bSEdward Tomasz Napierala #include <sys/types.h> /* accmode_t */
96ddcdf265SRobert Watson
972449b9e5SMitchell Horne #include <ddb/ddb.h> /* db_expr_t */
982449b9e5SMitchell Horne
99ddcdf265SRobert Watson /*
1006683b28dSRobert Watson * Entry points to the TrustedBSD MAC Framework from the remainder of the
1016683b28dSRobert Watson * kernel: entry points are named based on a principle object type and an
1026683b28dSRobert Watson * action relating to it. They are sorted alphabetically first by object
1036683b28dSRobert Watson * type and then action. In some situations, the principle object type is
1046683b28dSRobert Watson * obvious, and in other cases, less so as multiple objects may be inolved
1056683b28dSRobert Watson * in the operation.
106ddcdf265SRobert Watson */
107179da74eSRobert Watson int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp);
108179da74eSRobert Watson void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d);
109179da74eSRobert Watson void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m);
11030d239bcSRobert Watson void mac_bpfdesc_destroy(struct bpf_d *);
111179da74eSRobert Watson void mac_bpfdesc_init(struct bpf_d *);
112179da74eSRobert Watson
113212ab0cfSRobert Watson void mac_cred_associate_nfsd(struct ucred *cred);
1146f6174a7SRobert Watson int mac_cred_check_setaudit(struct ucred *cred, struct auditinfo *ai);
1156f6174a7SRobert Watson int mac_cred_check_setaudit_addr(struct ucred *cred,
1166f6174a7SRobert Watson struct auditinfo_addr *aia);
1176f6174a7SRobert Watson int mac_cred_check_setauid(struct ucred *cred, uid_t auid);
1186f6174a7SRobert Watson int mac_cred_check_setegid(struct ucred *cred, gid_t egid);
1196f6174a7SRobert Watson int mac_cred_check_seteuid(struct ucred *cred, uid_t euid);
1206f6174a7SRobert Watson int mac_cred_check_setgid(struct ucred *cred, gid_t gid);
1216f6174a7SRobert Watson int mac_cred_check_setgroups(struct ucred *cred, int ngroups,
1226f6174a7SRobert Watson gid_t *gidset);
1236f6174a7SRobert Watson int mac_cred_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid);
1246f6174a7SRobert Watson int mac_cred_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
1256f6174a7SRobert Watson gid_t sgid);
1266f6174a7SRobert Watson int mac_cred_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
1276f6174a7SRobert Watson uid_t suid);
1286f6174a7SRobert Watson int mac_cred_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid);
1296f6174a7SRobert Watson int mac_cred_check_setuid(struct ucred *cred, uid_t uid);
130179da74eSRobert Watson int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2);
131179da74eSRobert Watson void mac_cred_copy(struct ucred *cr1, struct ucred *cr2);
132212ab0cfSRobert Watson void mac_cred_create_init(struct ucred *cred);
133212ab0cfSRobert Watson void mac_cred_create_swapper(struct ucred *cred);
13430d239bcSRobert Watson void mac_cred_destroy(struct ucred *);
135179da74eSRobert Watson void mac_cred_init(struct ucred *);
136eca8a663SRobert Watson
1372449b9e5SMitchell Horne int mac_ddb_command_register(struct db_command_table *table,
1382449b9e5SMitchell Horne struct db_command *cmd);
1392449b9e5SMitchell Horne int mac_ddb_command_exec(struct db_command *cmd, db_expr_t addr,
1402449b9e5SMitchell Horne bool have_addr, db_expr_t count, char *modif);
1412449b9e5SMitchell Horne
14230d239bcSRobert Watson void mac_devfs_create_device(struct ucred *cred, struct mount *mp,
143d26dd2d9SRobert Watson struct cdev *dev, struct devfs_dirent *de);
14430d239bcSRobert Watson void mac_devfs_create_directory(struct mount *mp, char *dirname,
145990b4b2dSRobert Watson int dirnamelen, struct devfs_dirent *de);
14630d239bcSRobert Watson void mac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
147990b4b2dSRobert Watson struct devfs_dirent *dd, struct devfs_dirent *de);
148179da74eSRobert Watson void mac_devfs_destroy(struct devfs_dirent *);
149179da74eSRobert Watson void mac_devfs_init(struct devfs_dirent *);
15030d239bcSRobert Watson void mac_devfs_update(struct mount *mp, struct devfs_dirent *de,
151990b4b2dSRobert Watson struct vnode *vp);
152179da74eSRobert Watson void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de,
153179da74eSRobert Watson struct vnode *vp);
154ddcdf265SRobert Watson
155f77697ddSMateusz Guzik int mac_ifnet_check_transmit_impl(struct ifnet *ifp, struct mbuf *m);
156f77697ddSMateusz Guzik #ifdef MAC
157f77697ddSMateusz Guzik extern bool mac_ifnet_check_transmit_fp_flag;
158f77697ddSMateusz Guzik #else
15992b5b97cSMateusz Guzik #define mac_ifnet_check_transmit_fp_flag false
160f77697ddSMateusz Guzik #endif
161f77697ddSMateusz Guzik #define mac_ifnet_check_transmit_enabled() __predict_false(mac_ifnet_check_transmit_fp_flag)
162f77697ddSMateusz Guzik static inline int
mac_ifnet_check_transmit(struct ifnet * ifp,struct mbuf * m)163f77697ddSMateusz Guzik mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m)
164f77697ddSMateusz Guzik {
165f77697ddSMateusz Guzik
166f77697ddSMateusz Guzik if (mac_ifnet_check_transmit_enabled())
167f77697ddSMateusz Guzik return (mac_ifnet_check_transmit_impl(ifp, m));
168f77697ddSMateusz Guzik return (0);
169f77697ddSMateusz Guzik }
170f77697ddSMateusz Guzik
171179da74eSRobert Watson void mac_ifnet_create(struct ifnet *ifp);
172f77697ddSMateusz Guzik
173f77697ddSMateusz Guzik void mac_ifnet_create_mbuf_impl(struct ifnet *ifp, struct mbuf *m);
174f77697ddSMateusz Guzik #ifdef MAC
175f77697ddSMateusz Guzik extern bool mac_ifnet_create_mbuf_fp_flag;
176f77697ddSMateusz Guzik #else
17792b5b97cSMateusz Guzik #define mac_ifnet_create_mbuf_fp_flag false
178f77697ddSMateusz Guzik #endif
179f77697ddSMateusz Guzik #define mac_ifnet_create_mbuf_enabled() __predict_false(mac_ifnet_create_mbuf_fp_flag)
180f77697ddSMateusz Guzik static inline void
mac_ifnet_create_mbuf(struct ifnet * ifp,struct mbuf * m)181f77697ddSMateusz Guzik mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m)
182f77697ddSMateusz Guzik {
183f77697ddSMateusz Guzik
184f77697ddSMateusz Guzik if (mac_ifnet_create_mbuf_enabled())
185f77697ddSMateusz Guzik mac_ifnet_create_mbuf_impl(ifp, m);
186f77697ddSMateusz Guzik }
187f77697ddSMateusz Guzik
188179da74eSRobert Watson void mac_ifnet_destroy(struct ifnet *);
189179da74eSRobert Watson void mac_ifnet_init(struct ifnet *);
190179da74eSRobert Watson int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
191179da74eSRobert Watson struct ifnet *ifp);
192179da74eSRobert Watson int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr,
193179da74eSRobert Watson struct ifnet *ifp);
194179da74eSRobert Watson
195215bab79SShivank Garg /* Check if the IP address is allowed for the interface. */
196215bab79SShivank Garg int mac_inet_check_add_addr(struct ucred *cred,
197215bab79SShivank Garg const struct in_addr *ia, struct ifnet *ifp);
198215bab79SShivank Garg int mac_inet6_check_add_addr(struct ucred *cred,
199215bab79SShivank Garg const struct in6_addr *ia6, struct ifnet *ifp);
200215bab79SShivank Garg
20130d239bcSRobert Watson int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m);
20237ee7293SBjoern A. Zeeb int mac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp);
203179da74eSRobert Watson void mac_inpcb_create(struct socket *so, struct inpcb *inp);
204179da74eSRobert Watson void mac_inpcb_create_mbuf(struct inpcb *inp, struct mbuf *m);
205179da74eSRobert Watson void mac_inpcb_destroy(struct inpcb *);
206179da74eSRobert Watson int mac_inpcb_init(struct inpcb *, int);
207179da74eSRobert Watson void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
208179da74eSRobert Watson
2094b908c8bSRobert Watson void mac_ip6q_create(struct mbuf *m, struct ip6q *q6);
2104b908c8bSRobert Watson void mac_ip6q_destroy(struct ip6q *q6);
2114b908c8bSRobert Watson int mac_ip6q_init(struct ip6q *q6, int);
2124b908c8bSRobert Watson int mac_ip6q_match(struct mbuf *m, struct ip6q *q6);
2134b908c8bSRobert Watson void mac_ip6q_reassemble(struct ip6q *q6, struct mbuf *m);
2144b908c8bSRobert Watson void mac_ip6q_update(struct mbuf *m, struct ip6q *q6);
2154b908c8bSRobert Watson
21637f44cb4SRobert Watson void mac_ipq_create(struct mbuf *m, struct ipq *q);
21737f44cb4SRobert Watson void mac_ipq_destroy(struct ipq *q);
21837f44cb4SRobert Watson int mac_ipq_init(struct ipq *q, int);
21937f44cb4SRobert Watson int mac_ipq_match(struct mbuf *m, struct ipq *q);
22037f44cb4SRobert Watson void mac_ipq_reassemble(struct ipq *q, struct mbuf *m);
22137f44cb4SRobert Watson void mac_ipq_update(struct mbuf *m, struct ipq *q);
222179da74eSRobert Watson
2232449b9e5SMitchell Horne int mac_kdb_check_backend(struct kdb_dbbe *be);
224cab10561SMark Johnston int mac_kdb_grant_backend(struct kdb_dbbe *be);
2252449b9e5SMitchell Horne
22630d239bcSRobert Watson int mac_kenv_check_dump(struct ucred *cred);
22730d239bcSRobert Watson int mac_kenv_check_get(struct ucred *cred, char *name);
22830d239bcSRobert Watson int mac_kenv_check_set(struct ucred *cred, char *name, char *value);
22930d239bcSRobert Watson int mac_kenv_check_unset(struct ucred *cred, char *name);
230179da74eSRobert Watson
23130d239bcSRobert Watson int mac_kld_check_load(struct ucred *cred, struct vnode *vp);
23230d239bcSRobert Watson int mac_kld_check_stat(struct ucred *cred);
233179da74eSRobert Watson
234179da74eSRobert Watson void mac_mbuf_copy(struct mbuf *, struct mbuf *);
235179da74eSRobert Watson int mac_mbuf_init(struct mbuf *, int);
236179da74eSRobert Watson
237179da74eSRobert Watson void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *);
238179da74eSRobert Watson void mac_mbuf_tag_destroy(struct m_tag *);
239179da74eSRobert Watson int mac_mbuf_tag_init(struct m_tag *, int);
240179da74eSRobert Watson
24130d239bcSRobert Watson int mac_mount_check_stat(struct ucred *cred, struct mount *mp);
242179da74eSRobert Watson void mac_mount_create(struct ucred *cred, struct mount *mp);
243179da74eSRobert Watson void mac_mount_destroy(struct mount *);
244179da74eSRobert Watson void mac_mount_init(struct mount *);
245179da74eSRobert Watson
246b9b0dac3SRobert Watson void mac_netinet_arp_send(struct ifnet *ifp, struct mbuf *m);
247a13e21f7SRobert Watson void mac_netinet_firewall_reply(struct mbuf *mrecv, struct mbuf *msend);
24886407646SRobert Watson void mac_netinet_firewall_send(struct mbuf *m);
249179da74eSRobert Watson void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag);
250a13e21f7SRobert Watson void mac_netinet_icmp_reply(struct mbuf *mrecv, struct mbuf *msend);
251a13e21f7SRobert Watson void mac_netinet_icmp_replyinplace(struct mbuf *m);
252b9b0dac3SRobert Watson void mac_netinet_igmp_send(struct ifnet *ifp, struct mbuf *m);
253179da74eSRobert Watson void mac_netinet_tcp_reply(struct mbuf *m);
254179da74eSRobert Watson
255b9b0dac3SRobert Watson void mac_netinet6_nd6_send(struct ifnet *ifp, struct mbuf *m);
256b9b0dac3SRobert Watson
25730d239bcSRobert Watson int mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
258ddcdf265SRobert Watson unsigned long cmd, void *data);
25989744405SMateusz Guzik int mac_pipe_check_poll_impl(struct ucred *cred, struct pipepair *pp);
26089744405SMateusz Guzik #ifdef MAC
26189744405SMateusz Guzik extern bool mac_pipe_check_poll_fp_flag;
26289744405SMateusz Guzik #else
26392b5b97cSMateusz Guzik #define mac_pipe_check_poll_fp_flag false
26489744405SMateusz Guzik #endif
26589744405SMateusz Guzik #define mac_pipe_check_poll_enabled() __predict_false(mac_pipe_check_poll_fp_flag)
26689744405SMateusz Guzik static inline int
mac_pipe_check_poll(struct ucred * cred,struct pipepair * pp)26789744405SMateusz Guzik mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp)
26889744405SMateusz Guzik {
26989744405SMateusz Guzik
27089744405SMateusz Guzik if (mac_pipe_check_poll_enabled())
27189744405SMateusz Guzik return (mac_pipe_check_poll_impl(cred, pp));
27289744405SMateusz Guzik return (0);
27389744405SMateusz Guzik }
27489744405SMateusz Guzik
27589744405SMateusz Guzik #ifdef MAC
27689744405SMateusz Guzik extern bool mac_pipe_check_stat_fp_flag;
27789744405SMateusz Guzik #else
27892b5b97cSMateusz Guzik #define mac_pipe_check_stat_fp_flag false
27989744405SMateusz Guzik #endif
28089744405SMateusz Guzik #define mac_pipe_check_stat_enabled() __predict_false(mac_pipe_check_stat_fp_flag)
28130d239bcSRobert Watson int mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp);
28260dae3b8SMateusz Guzik int mac_pipe_check_read_impl(struct ucred *cred, struct pipepair *pp);
28360dae3b8SMateusz Guzik #ifdef MAC
28460dae3b8SMateusz Guzik extern bool mac_pipe_check_read_fp_flag;
28560dae3b8SMateusz Guzik #else
28660dae3b8SMateusz Guzik #define mac_pipe_check_read_fp_flag false
28760dae3b8SMateusz Guzik #endif
28860dae3b8SMateusz Guzik #define mac_pipe_check_read_enabled() __predict_false(mac_pipe_check_read_fp_flag)
28960dae3b8SMateusz Guzik static inline int
mac_pipe_check_read(struct ucred * cred,struct pipepair * pp)29060dae3b8SMateusz Guzik mac_pipe_check_read(struct ucred *cred, struct pipepair *pp)
29160dae3b8SMateusz Guzik {
29260dae3b8SMateusz Guzik
29360dae3b8SMateusz Guzik if (mac_pipe_check_read_enabled())
29460dae3b8SMateusz Guzik return (mac_pipe_check_read_impl(cred, pp));
29560dae3b8SMateusz Guzik return (0);
29660dae3b8SMateusz Guzik }
29760dae3b8SMateusz Guzik
29830d239bcSRobert Watson int mac_pipe_check_write(struct ucred *cred, struct pipepair *pp);
299179da74eSRobert Watson void mac_pipe_create(struct ucred *cred, struct pipepair *pp);
300179da74eSRobert Watson void mac_pipe_destroy(struct pipepair *);
301179da74eSRobert Watson void mac_pipe_init(struct pipepair *);
302179da74eSRobert Watson int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
303179da74eSRobert Watson struct label *label);
304179da74eSRobert Watson
3056bc1e9cdSJohn Baldwin int mac_posixsem_check_getvalue(struct ucred *active_cred,
3066bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks);
30730d239bcSRobert Watson int mac_posixsem_check_open(struct ucred *cred, struct ksem *ks);
3086bc1e9cdSJohn Baldwin int mac_posixsem_check_post(struct ucred *active_cred,
3096bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks);
3109c00bb91SKonstantin Belousov int mac_posixsem_check_setmode(struct ucred *cred, struct ksem *ks,
3119c00bb91SKonstantin Belousov mode_t mode);
3129c00bb91SKonstantin Belousov int mac_posixsem_check_setowner(struct ucred *cred, struct ksem *ks,
3139c00bb91SKonstantin Belousov uid_t uid, gid_t gid);
3146bc1e9cdSJohn Baldwin int mac_posixsem_check_stat(struct ucred *active_cred,
3156bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks);
31630d239bcSRobert Watson int mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks);
3176bc1e9cdSJohn Baldwin int mac_posixsem_check_wait(struct ucred *active_cred,
3186bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks);
319179da74eSRobert Watson void mac_posixsem_create(struct ucred *cred, struct ksem *ks);
320179da74eSRobert Watson void mac_posixsem_destroy(struct ksem *);
321179da74eSRobert Watson void mac_posixsem_init(struct ksem *);
322179da74eSRobert Watson
3239b6dd12eSRobert Watson int mac_posixshm_check_create(struct ucred *cred, const char *path);
3248e38aeffSJohn Baldwin int mac_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd,
3258e38aeffSJohn Baldwin int prot, int flags);
3269b6dd12eSRobert Watson int mac_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd,
3279b6dd12eSRobert Watson accmode_t accmode);
328940cb0e2SKonstantin Belousov int mac_posixshm_check_read(struct ucred *active_cred,
329940cb0e2SKonstantin Belousov struct ucred *file_cred, struct shmfd *shmfd);
3309c00bb91SKonstantin Belousov int mac_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd,
3319c00bb91SKonstantin Belousov mode_t mode);
3329c00bb91SKonstantin Belousov int mac_posixshm_check_setowner(struct ucred *cred, struct shmfd *shmfd,
3339c00bb91SKonstantin Belousov uid_t uid, gid_t gid);
3348e38aeffSJohn Baldwin int mac_posixshm_check_stat(struct ucred *active_cred,
3358e38aeffSJohn Baldwin struct ucred *file_cred, struct shmfd *shmfd);
3368e38aeffSJohn Baldwin int mac_posixshm_check_truncate(struct ucred *active_cred,
3378e38aeffSJohn Baldwin struct ucred *file_cred, struct shmfd *shmfd);
3388e38aeffSJohn Baldwin int mac_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd);
339940cb0e2SKonstantin Belousov int mac_posixshm_check_write(struct ucred *active_cred,
340940cb0e2SKonstantin Belousov struct ucred *file_cred, struct shmfd *shmfd);
3418e38aeffSJohn Baldwin void mac_posixshm_create(struct ucred *cred, struct shmfd *shmfd);
3428e38aeffSJohn Baldwin void mac_posixshm_destroy(struct shmfd *);
3438e38aeffSJohn Baldwin void mac_posixshm_init(struct shmfd *);
3448e38aeffSJohn Baldwin
34591061084SMateusz Guzik int mac_priv_check_impl(struct ucred *cred, int priv);
3465b0acaf7SMateusz Guzik #ifdef MAC
34791061084SMateusz Guzik extern bool mac_priv_check_fp_flag;
3485b0acaf7SMateusz Guzik #else
34992b5b97cSMateusz Guzik #define mac_priv_check_fp_flag false
3505b0acaf7SMateusz Guzik #endif
3514ec34a90SMateusz Guzik #define mac_priv_check_enabled() __predict_false(mac_priv_check_fp_flag)
35291061084SMateusz Guzik static inline int
mac_priv_check(struct ucred * cred,int priv)35391061084SMateusz Guzik mac_priv_check(struct ucred *cred, int priv)
35491061084SMateusz Guzik {
35591061084SMateusz Guzik
3564ec34a90SMateusz Guzik if (mac_priv_check_enabled())
35791061084SMateusz Guzik return (mac_priv_check_impl(cred, priv));
35891061084SMateusz Guzik return (0);
35991061084SMateusz Guzik }
36091061084SMateusz Guzik
36191061084SMateusz Guzik int mac_priv_grant_impl(struct ucred *cred, int priv);
3625b0acaf7SMateusz Guzik #ifdef MAC
36391061084SMateusz Guzik extern bool mac_priv_grant_fp_flag;
3645b0acaf7SMateusz Guzik #else
36592b5b97cSMateusz Guzik #define mac_priv_grant_fp_flag false
3665b0acaf7SMateusz Guzik #endif
3674ec34a90SMateusz Guzik #define mac_priv_grant_enabled() __predict_false(mac_priv_grant_fp_flag)
36891061084SMateusz Guzik static inline int
mac_priv_grant(struct ucred * cred,int priv)36991061084SMateusz Guzik mac_priv_grant(struct ucred *cred, int priv)
37091061084SMateusz Guzik {
37191061084SMateusz Guzik
3724ec34a90SMateusz Guzik if (mac_priv_grant_enabled())
37391061084SMateusz Guzik return (mac_priv_grant_impl(cred, priv));
37491061084SMateusz Guzik return (EPERM);
37591061084SMateusz Guzik }
376179da74eSRobert Watson
37730d239bcSRobert Watson int mac_proc_check_debug(struct ucred *cred, struct proc *p);
37830d239bcSRobert Watson int mac_proc_check_sched(struct ucred *cred, struct proc *p);
37930d239bcSRobert Watson int mac_proc_check_signal(struct ucred *cred, struct proc *p,
380ddcdf265SRobert Watson int signum);
38130d239bcSRobert Watson int mac_proc_check_wait(struct ucred *cred, struct proc *p);
382179da74eSRobert Watson void mac_proc_destroy(struct proc *);
3836356dba0SRobert Watson void mac_proc_init(struct proc *);
3849215889dSRobert Watson void mac_proc_vm_revoke(struct thread *td);
385179da74eSRobert Watson int mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
386179da74eSRobert Watson void mac_execve_exit(struct image_params *imgp);
3876356dba0SRobert Watson void mac_execve_interpreter_enter(struct vnode *interpvp,
3886356dba0SRobert Watson struct label **interplabel);
3896356dba0SRobert Watson void mac_execve_interpreter_exit(struct label *interpvplabel);
390179da74eSRobert Watson
39130d239bcSRobert Watson int mac_socket_check_accept(struct ucred *cred, struct socket *so);
39230d239bcSRobert Watson int mac_socket_check_bind(struct ucred *cred, struct socket *so,
39326ae2b86SRobert Watson struct sockaddr *sa);
39430d239bcSRobert Watson int mac_socket_check_connect(struct ucred *cred, struct socket *so,
39526ae2b86SRobert Watson struct sockaddr *sa);
39630d239bcSRobert Watson int mac_socket_check_create(struct ucred *cred, int domain, int type,
39726ae2b86SRobert Watson int proto);
39830d239bcSRobert Watson int mac_socket_check_deliver(struct socket *so, struct mbuf *m);
39930d239bcSRobert Watson int mac_socket_check_listen(struct ucred *cred, struct socket *so);
40030d239bcSRobert Watson int mac_socket_check_poll(struct ucred *cred, struct socket *so);
40130d239bcSRobert Watson int mac_socket_check_receive(struct ucred *cred, struct socket *so);
40230d239bcSRobert Watson int mac_socket_check_send(struct ucred *cred, struct socket *so);
40330d239bcSRobert Watson int mac_socket_check_stat(struct ucred *cred, struct socket *so);
40430d239bcSRobert Watson int mac_socket_check_visible(struct ucred *cred, struct socket *so);
405179da74eSRobert Watson void mac_socket_create_mbuf(struct socket *so, struct mbuf *m);
406179da74eSRobert Watson void mac_socket_create(struct ucred *cred, struct socket *so);
407179da74eSRobert Watson void mac_socket_destroy(struct socket *);
408179da74eSRobert Watson int mac_socket_init(struct socket *, int);
409179da74eSRobert Watson void mac_socket_newconn(struct socket *oldso, struct socket *newso);
410179da74eSRobert Watson int mac_getsockopt_label(struct ucred *cred, struct socket *so,
411f64a688dSBrooks Davis const struct mac *extmac);
412179da74eSRobert Watson int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
413f64a688dSBrooks Davis const struct mac *extmac);
414179da74eSRobert Watson int mac_setsockopt_label(struct ucred *cred, struct socket *so,
415f64a688dSBrooks Davis const struct mac *extmac);
416179da74eSRobert Watson
417179da74eSRobert Watson void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so);
418179da74eSRobert Watson void mac_socketpeer_set_from_socket(struct socket *oldso,
419179da74eSRobert Watson struct socket *newso);
420179da74eSRobert Watson
421179da74eSRobert Watson void mac_syncache_create(struct label *l, struct inpcb *inp);
422179da74eSRobert Watson void mac_syncache_create_mbuf(struct label *l, struct mbuf *m);
423179da74eSRobert Watson void mac_syncache_destroy(struct label **l);
424179da74eSRobert Watson int mac_syncache_init(struct label **l);
425179da74eSRobert Watson
42630d239bcSRobert Watson int mac_system_check_acct(struct ucred *cred, struct vnode *vp);
42730d239bcSRobert Watson int mac_system_check_audit(struct ucred *cred, void *record, int length);
42830d239bcSRobert Watson int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp);
42930d239bcSRobert Watson int mac_system_check_auditon(struct ucred *cred, int cmd);
43030d239bcSRobert Watson int mac_system_check_reboot(struct ucred *cred, int howto);
43130d239bcSRobert Watson int mac_system_check_swapon(struct ucred *cred, struct vnode *vp);
43230d239bcSRobert Watson int mac_system_check_swapoff(struct ucred *cred, struct vnode *vp);
43330d239bcSRobert Watson int mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
43463dba32bSPawel Jakub Dawidek void *arg1, int arg2, struct sysctl_req *req);
435179da74eSRobert Watson
436179da74eSRobert Watson void mac_sysvmsg_cleanup(struct msg *msgptr);
437179da74eSRobert Watson void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
438179da74eSRobert Watson struct msg *msgptr);
439179da74eSRobert Watson void mac_sysvmsg_destroy(struct msg *);
440179da74eSRobert Watson void mac_sysvmsg_init(struct msg *);
441179da74eSRobert Watson
442179da74eSRobert Watson int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr,
443179da74eSRobert Watson struct msqid_kernel *msqkptr);
444179da74eSRobert Watson int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr);
445179da74eSRobert Watson int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr);
446179da74eSRobert Watson int mac_sysvmsq_check_msqctl(struct ucred *cred,
447179da74eSRobert Watson struct msqid_kernel *msqkptr, int cmd);
448179da74eSRobert Watson int mac_sysvmsq_check_msqget(struct ucred *cred,
449179da74eSRobert Watson struct msqid_kernel *msqkptr);
450179da74eSRobert Watson int mac_sysvmsq_check_msqrcv(struct ucred *cred,
451179da74eSRobert Watson struct msqid_kernel *msqkptr);
452179da74eSRobert Watson int mac_sysvmsq_check_msqsnd(struct ucred *cred,
453179da74eSRobert Watson struct msqid_kernel *msqkptr);
454179da74eSRobert Watson void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr);
455179da74eSRobert Watson void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr);
456179da74eSRobert Watson void mac_sysvmsq_destroy(struct msqid_kernel *);
457179da74eSRobert Watson void mac_sysvmsq_init(struct msqid_kernel *);
458179da74eSRobert Watson
459179da74eSRobert Watson int mac_sysvsem_check_semctl(struct ucred *cred,
460179da74eSRobert Watson struct semid_kernel *semakptr, int cmd);
461179da74eSRobert Watson int mac_sysvsem_check_semget(struct ucred *cred,
462179da74eSRobert Watson struct semid_kernel *semakptr);
463179da74eSRobert Watson int mac_sysvsem_check_semop(struct ucred *cred,
464179da74eSRobert Watson struct semid_kernel *semakptr, size_t accesstype);
465179da74eSRobert Watson void mac_sysvsem_cleanup(struct semid_kernel *semakptr);
466179da74eSRobert Watson void mac_sysvsem_create(struct ucred *cred,
467179da74eSRobert Watson struct semid_kernel *semakptr);
468179da74eSRobert Watson void mac_sysvsem_destroy(struct semid_kernel *);
469179da74eSRobert Watson void mac_sysvsem_init(struct semid_kernel *);
470179da74eSRobert Watson
471179da74eSRobert Watson int mac_sysvshm_check_shmat(struct ucred *cred,
472179da74eSRobert Watson struct shmid_kernel *shmsegptr, int shmflg);
473179da74eSRobert Watson int mac_sysvshm_check_shmctl(struct ucred *cred,
474179da74eSRobert Watson struct shmid_kernel *shmsegptr, int cmd);
475179da74eSRobert Watson int mac_sysvshm_check_shmdt(struct ucred *cred,
476179da74eSRobert Watson struct shmid_kernel *shmsegptr);
477179da74eSRobert Watson int mac_sysvshm_check_shmget(struct ucred *cred,
478179da74eSRobert Watson struct shmid_kernel *shmsegptr, int shmflg);
479179da74eSRobert Watson void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr);
480179da74eSRobert Watson void mac_sysvshm_create(struct ucred *cred,
481179da74eSRobert Watson struct shmid_kernel *shmsegptr);
482179da74eSRobert Watson void mac_sysvshm_destroy(struct shmid_kernel *);
483179da74eSRobert Watson void mac_sysvshm_init(struct shmid_kernel *);
484179da74eSRobert Watson
485179da74eSRobert Watson void mac_thread_userret(struct thread *td);
486179da74eSRobert Watson
487137d26e8SAndriy Gapon #if defined(MAC) && defined(DEBUG_VFS_LOCKS)
4886ebab6baSMateusz Guzik void mac_vnode_assert_locked(struct vnode *vp, const char *func);
4896ebab6baSMateusz Guzik #else
4906ebab6baSMateusz Guzik #define mac_vnode_assert_locked(vp, func) do { } while (0)
4916ebab6baSMateusz Guzik #endif
4926ebab6baSMateusz Guzik
493179da74eSRobert Watson int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp);
494179da74eSRobert Watson void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp);
49518f67bc4SMateusz Guzik int mac_vnode_check_access_impl(struct ucred *cred, struct vnode *dvp,
49615bc6b2bSEdward Tomasz Napierala accmode_t accmode);
49718f67bc4SMateusz Guzik extern bool mac_vnode_check_access_fp_flag;
49818f67bc4SMateusz Guzik #define mac_vnode_check_access_enabled() __predict_false(mac_vnode_check_access_fp_flag)
49918f67bc4SMateusz Guzik static inline int
mac_vnode_check_access(struct ucred * cred,struct vnode * dvp,accmode_t accmode)50018f67bc4SMateusz Guzik mac_vnode_check_access(struct ucred *cred, struct vnode *dvp,
50118f67bc4SMateusz Guzik accmode_t accmode)
50218f67bc4SMateusz Guzik {
50318f67bc4SMateusz Guzik
50418f67bc4SMateusz Guzik mac_vnode_assert_locked(dvp, "mac_vnode_check_access");
50518f67bc4SMateusz Guzik if (mac_vnode_check_access_enabled())
50618f67bc4SMateusz Guzik return (mac_vnode_check_access_impl(cred, dvp, accmode));
50718f67bc4SMateusz Guzik return (0);
50818f67bc4SMateusz Guzik }
50930d239bcSRobert Watson int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp);
51030d239bcSRobert Watson int mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp);
51130d239bcSRobert Watson int mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
512ddcdf265SRobert Watson struct componentname *cnp, struct vattr *vap);
51330d239bcSRobert Watson int mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
514ddcdf265SRobert Watson acl_type_t type);
51530d239bcSRobert Watson int mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
516c096756cSRobert Watson int attrnamespace, const char *name);
51730d239bcSRobert Watson int mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
518670cb89bSRobert Watson struct image_params *imgp);
51930d239bcSRobert Watson int mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
520ddcdf265SRobert Watson acl_type_t type);
52130d239bcSRobert Watson int mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
522fefd0ac8SRobert Watson int attrnamespace, const char *name);
52330d239bcSRobert Watson int mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
5240a694196SRobert Watson struct vnode *vp, struct componentname *cnp);
52530d239bcSRobert Watson int mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
526c096756cSRobert Watson int attrnamespace);
5276ebab6baSMateusz Guzik
5286ebab6baSMateusz Guzik int mac_vnode_check_lookup_impl(struct ucred *cred, struct vnode *dvp,
529ddcdf265SRobert Watson struct componentname *cnp);
5304ec34a90SMateusz Guzik #ifdef MAC
5316ebab6baSMateusz Guzik extern bool mac_vnode_check_lookup_fp_flag;
5324ec34a90SMateusz Guzik #else
53392b5b97cSMateusz Guzik #define mac_vnode_check_lookup_fp_flag false
5344ec34a90SMateusz Guzik #endif
53507d2145aSMateusz Guzik #define mac_vnode_check_lookup_enabled() __predict_false(mac_vnode_check_lookup_fp_flag)
5366ebab6baSMateusz Guzik static inline int
mac_vnode_check_lookup(struct ucred * cred,struct vnode * dvp,struct componentname * cnp)5376ebab6baSMateusz Guzik mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
5386ebab6baSMateusz Guzik struct componentname *cnp)
5396ebab6baSMateusz Guzik {
5406ebab6baSMateusz Guzik
5416ebab6baSMateusz Guzik mac_vnode_assert_locked(dvp, "mac_vnode_check_lookup");
54207d2145aSMateusz Guzik if (mac_vnode_check_lookup_enabled())
5436ebab6baSMateusz Guzik return (mac_vnode_check_lookup_impl(cred, dvp, cnp));
5446ebab6baSMateusz Guzik return (0);
5456ebab6baSMateusz Guzik }
5466ebab6baSMateusz Guzik
5476ebab6baSMateusz Guzik int mac_vnode_check_mmap_impl(struct ucred *cred, struct vnode *vp, int prot,
54826ae2b86SRobert Watson int flags);
5494ec34a90SMateusz Guzik #ifdef MAC
5506ebab6baSMateusz Guzik extern bool mac_vnode_check_mmap_fp_flag;
5514ec34a90SMateusz Guzik #else
55292b5b97cSMateusz Guzik #define mac_vnode_check_mmap_fp_flag false
5534ec34a90SMateusz Guzik #endif
5544ec34a90SMateusz Guzik #define mac_vnode_check_mmap_enabled() __predict_false(mac_vnode_check_mmap_fp_flag)
5556ebab6baSMateusz Guzik static inline int
mac_vnode_check_mmap(struct ucred * cred,struct vnode * vp,int prot,int flags)5566ebab6baSMateusz Guzik mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
5576ebab6baSMateusz Guzik int flags)
5586ebab6baSMateusz Guzik {
5596ebab6baSMateusz Guzik
5606ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_mmap");
5614ec34a90SMateusz Guzik if (mac_vnode_check_mmap_enabled())
5626ebab6baSMateusz Guzik return (mac_vnode_check_mmap_impl(cred, vp, prot, flags));
5636ebab6baSMateusz Guzik return (0);
5646ebab6baSMateusz Guzik }
5656ebab6baSMateusz Guzik
5666ebab6baSMateusz Guzik int mac_vnode_check_open_impl(struct ucred *cred, struct vnode *vp,
5676ebab6baSMateusz Guzik accmode_t accmode);
5684ec34a90SMateusz Guzik #ifdef MAC
5696ebab6baSMateusz Guzik extern bool mac_vnode_check_open_fp_flag;
5704ec34a90SMateusz Guzik #else
57192b5b97cSMateusz Guzik #define mac_vnode_check_open_fp_flag false
5724ec34a90SMateusz Guzik #endif
5734ec34a90SMateusz Guzik #define mac_vnode_check_open_enabled() __predict_false(mac_vnode_check_open_fp_flag)
5746ebab6baSMateusz Guzik static inline int
mac_vnode_check_open(struct ucred * cred,struct vnode * vp,accmode_t accmode)5756ebab6baSMateusz Guzik mac_vnode_check_open(struct ucred *cred, struct vnode *vp,
5766ebab6baSMateusz Guzik accmode_t accmode)
5776ebab6baSMateusz Guzik {
5786ebab6baSMateusz Guzik
5796ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_open");
5804ec34a90SMateusz Guzik if (mac_vnode_check_open_enabled())
5816ebab6baSMateusz Guzik return (mac_vnode_check_open_impl(cred, vp, accmode));
5826ebab6baSMateusz Guzik return (0);
5836ebab6baSMateusz Guzik }
5846ebab6baSMateusz Guzik
58530d239bcSRobert Watson int mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp,
586e183f80eSRobert Watson int prot);
5873ea3fbe6SMateusz Guzik
5883ea3fbe6SMateusz Guzik #define mac_vnode_check_poll_enabled() __predict_false(mac_vnode_check_poll_fp_flag)
589ab06a305SMateusz Guzik #ifdef MAC
5903ea3fbe6SMateusz Guzik extern bool mac_vnode_check_poll_fp_flag;
59130d239bcSRobert Watson int mac_vnode_check_poll(struct ucred *active_cred,
592177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp);
593ab06a305SMateusz Guzik #else
59492b5b97cSMateusz Guzik #define mac_vnode_check_poll_fp_flag false
595ab06a305SMateusz Guzik static inline int
mac_vnode_check_poll(struct ucred * active_cred,struct ucred * file_cred,struct vnode * vp)596ab06a305SMateusz Guzik mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
597ab06a305SMateusz Guzik struct vnode *vp)
598ab06a305SMateusz Guzik {
599ab06a305SMateusz Guzik
600ab06a305SMateusz Guzik return (0);
601ab06a305SMateusz Guzik }
602ab06a305SMateusz Guzik #endif
60330d239bcSRobert Watson int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp);
60477589de8SMateusz Guzik int mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *dvp);
60577589de8SMateusz Guzik #ifdef MAC
60677589de8SMateusz Guzik extern bool mac_vnode_check_readlink_fp_flag;
60777589de8SMateusz Guzik #else
60892b5b97cSMateusz Guzik #define mac_vnode_check_readlink_fp_flag false
60977589de8SMateusz Guzik #endif
61077589de8SMateusz Guzik #define mac_vnode_check_readlink_enabled() __predict_false(mac_vnode_check_readlink_fp_flag)
61177589de8SMateusz Guzik static inline int
mac_vnode_check_readlink(struct ucred * cred,struct vnode * vp)61277589de8SMateusz Guzik mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
61377589de8SMateusz Guzik {
61477589de8SMateusz Guzik
61577589de8SMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_readlink");
61677589de8SMateusz Guzik if (mac_vnode_check_readlink_enabled())
61777589de8SMateusz Guzik return (mac_vnode_check_readlink_impl(cred, vp));
61877589de8SMateusz Guzik return (0);
61977589de8SMateusz Guzik }
620fad6dd77SMateusz Guzik #define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag)
621fad6dd77SMateusz Guzik #ifdef MAC
622fad6dd77SMateusz Guzik extern bool mac_vnode_check_rename_from_fp_flag;
623fad6dd77SMateusz Guzik #endif
62430d239bcSRobert Watson int mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
625ddcdf265SRobert Watson struct vnode *vp, struct componentname *cnp);
62630d239bcSRobert Watson int mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
627ddcdf265SRobert Watson struct vnode *vp, int samedir, struct componentname *cnp);
62830d239bcSRobert Watson int mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp);
62930d239bcSRobert Watson int mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
630ddcdf265SRobert Watson acl_type_t type, struct acl *acl);
63130d239bcSRobert Watson int mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
632fefd0ac8SRobert Watson int attrnamespace, const char *name);
63330d239bcSRobert Watson int mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
634ddcdf265SRobert Watson u_long flags);
63530d239bcSRobert Watson int mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
636ddcdf265SRobert Watson mode_t mode);
63730d239bcSRobert Watson int mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
638ddcdf265SRobert Watson uid_t uid, gid_t gid);
63930d239bcSRobert Watson int mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
640ddcdf265SRobert Watson struct timespec atime, struct timespec mtime);
6416ebab6baSMateusz Guzik
6426ebab6baSMateusz Guzik int mac_vnode_check_stat_impl(struct ucred *active_cred,
643177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp);
6444ec34a90SMateusz Guzik #ifdef MAC
6456ebab6baSMateusz Guzik extern bool mac_vnode_check_stat_fp_flag;
6464ec34a90SMateusz Guzik #else
64792b5b97cSMateusz Guzik #define mac_vnode_check_stat_fp_flag false
6484ec34a90SMateusz Guzik #endif
6494ec34a90SMateusz Guzik #define mac_vnode_check_stat_enabled() __predict_false(mac_vnode_check_stat_fp_flag)
6506ebab6baSMateusz Guzik static inline int
mac_vnode_check_stat(struct ucred * active_cred,struct ucred * file_cred,struct vnode * vp)6516ebab6baSMateusz Guzik mac_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
6526ebab6baSMateusz Guzik struct vnode *vp)
6536ebab6baSMateusz Guzik {
6546ebab6baSMateusz Guzik
6556ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_stat");
6564ec34a90SMateusz Guzik if (mac_vnode_check_stat_enabled())
6576ebab6baSMateusz Guzik return (mac_vnode_check_stat_impl(active_cred, file_cred, vp));
6586ebab6baSMateusz Guzik return (0);
6596ebab6baSMateusz Guzik }
6606ebab6baSMateusz Guzik
6616ebab6baSMateusz Guzik int mac_vnode_check_read_impl(struct ucred *active_cred,
6626ebab6baSMateusz Guzik struct ucred *file_cred, struct vnode *vp);
6634ec34a90SMateusz Guzik #ifdef MAC
6646ebab6baSMateusz Guzik extern bool mac_vnode_check_read_fp_flag;
6654ec34a90SMateusz Guzik #else
66692b5b97cSMateusz Guzik #define mac_vnode_check_read_fp_flag false
6674ec34a90SMateusz Guzik #endif
6684ec34a90SMateusz Guzik #define mac_vnode_check_read_enabled() __predict_false(mac_vnode_check_read_fp_flag)
6696ebab6baSMateusz Guzik static inline int
mac_vnode_check_read(struct ucred * active_cred,struct ucred * file_cred,struct vnode * vp)6706ebab6baSMateusz Guzik mac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
6716ebab6baSMateusz Guzik struct vnode *vp)
6726ebab6baSMateusz Guzik {
6736ebab6baSMateusz Guzik
6746ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_read");
6754ec34a90SMateusz Guzik if (mac_vnode_check_read_enabled())
6766ebab6baSMateusz Guzik return (mac_vnode_check_read_impl(active_cred, file_cred, vp));
6776ebab6baSMateusz Guzik return (0);
6786ebab6baSMateusz Guzik }
6796ebab6baSMateusz Guzik
6806ebab6baSMateusz Guzik int mac_vnode_check_write_impl(struct ucred *active_cred,
6816ebab6baSMateusz Guzik struct ucred *file_cred, struct vnode *vp);
6824ec34a90SMateusz Guzik #ifdef MAC
6836ebab6baSMateusz Guzik extern bool mac_vnode_check_write_fp_flag;
6844ec34a90SMateusz Guzik #else
68592b5b97cSMateusz Guzik #define mac_vnode_check_write_fp_flag false
6864ec34a90SMateusz Guzik #endif
6874ec34a90SMateusz Guzik #define mac_vnode_check_write_enabled() __predict_false(mac_vnode_check_write_fp_flag)
6886ebab6baSMateusz Guzik static inline int
mac_vnode_check_write(struct ucred * active_cred,struct ucred * file_cred,struct vnode * vp)6896ebab6baSMateusz Guzik mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred,
6906ebab6baSMateusz Guzik struct vnode *vp)
6916ebab6baSMateusz Guzik {
6926ebab6baSMateusz Guzik
6936ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_write");
6944ec34a90SMateusz Guzik if (mac_vnode_check_write_enabled())
6956ebab6baSMateusz Guzik return (mac_vnode_check_write_impl(active_cred, file_cred, vp));
6966ebab6baSMateusz Guzik return (0);
6976ebab6baSMateusz Guzik }
6986ebab6baSMateusz Guzik
69930d239bcSRobert Watson int mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
70045e0f3d6SRobert Watson struct vnode *vp, struct componentname *cnp);
701179da74eSRobert Watson void mac_vnode_copy_label(struct label *, struct label *);
702179da74eSRobert Watson void mac_vnode_init(struct vnode *);
703179da74eSRobert Watson int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
704179da74eSRobert Watson struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
705179da74eSRobert Watson void mac_vnode_destroy(struct vnode *);
706179da74eSRobert Watson void mac_vnode_execve_transition(struct ucred *oldcred,
707179da74eSRobert Watson struct ucred *newcred, struct vnode *vp,
708179da74eSRobert Watson struct label *interpvplabel, struct image_params *imgp);
709179da74eSRobert Watson int mac_vnode_execve_will_transition(struct ucred *cred,
710179da74eSRobert Watson struct vnode *vp, struct label *interpvplabel,
711179da74eSRobert Watson struct image_params *imgp);
712179da74eSRobert Watson void mac_vnode_relabel(struct ucred *cred, struct vnode *vp,
713179da74eSRobert Watson struct label *newlabel);
714179da74eSRobert Watson
715ddcdf265SRobert Watson /*
7169caab7a2SRobert Watson * Calls to help various file systems implement labeling functionality using
7179caab7a2SRobert Watson * their existing EA implementation.
718ddcdf265SRobert Watson */
719ddcdf265SRobert Watson int vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
720ddcdf265SRobert Watson
721646a9f80SRobert Watson #endif /* !_SECURITY_MAC_MAC_FRAMEWORK_H_ */
722