1ddcdf265SRobert Watson /*- 2f6a41092SRobert Watson * Copyright (c) 1999-2002 Robert N. M. Watson 37f53207bSRobert Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4aed55708SRobert Watson * Copyright (c) 2005-2006 SPARTA, Inc. 5ddcdf265SRobert Watson * All rights reserved. 6ddcdf265SRobert Watson * 7ddcdf265SRobert Watson * This software was developed by Robert Watson for the TrustedBSD Project. 8ddcdf265SRobert Watson * 96201265bSRobert Watson * This software was developed for the FreeBSD Project in part by Network 106201265bSRobert Watson * Associates Laboratories, the Security Research Division of Network 116201265bSRobert Watson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 126201265bSRobert Watson * as part of the DARPA CHATS research program. 13ddcdf265SRobert Watson * 146758f88eSRobert Watson * This software was enhanced by SPARTA ISSO under SPAWAR contract 156758f88eSRobert Watson * N66001-04-C-6019 ("SEFOS"). 166758f88eSRobert Watson * 17ddcdf265SRobert Watson * Redistribution and use in source and binary forms, with or without 18ddcdf265SRobert Watson * modification, are permitted provided that the following conditions 19ddcdf265SRobert Watson * are met: 20ddcdf265SRobert Watson * 1. Redistributions of source code must retain the above copyright 21ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer. 22ddcdf265SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 23ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer in the 24ddcdf265SRobert Watson * documentation and/or other materials provided with the distribution. 25ddcdf265SRobert Watson * 26ddcdf265SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 27ddcdf265SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28ddcdf265SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29ddcdf265SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 30ddcdf265SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31ddcdf265SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32ddcdf265SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33ddcdf265SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34ddcdf265SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35ddcdf265SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36ddcdf265SRobert Watson * SUCH DAMAGE. 37ddcdf265SRobert Watson * 38ddcdf265SRobert Watson * $FreeBSD$ 39ddcdf265SRobert Watson */ 40aed55708SRobert Watson 41ddcdf265SRobert Watson /* 42aed55708SRobert Watson * Kernel interface for Mandatory Access Control -- how kernel services 43aed55708SRobert Watson * interact with the TrustedBSD MAC Framework. 44ddcdf265SRobert Watson */ 457f53207bSRobert Watson 46aed55708SRobert Watson #ifndef _SYS_SECURITY_MAC_MAC_FRAMEWORK_H_ 47f776aa32SRobert Watson #define _SYS_SECURITY_MAC_MAC_FRAMEWORK_H_ 48aed55708SRobert Watson 49aed55708SRobert Watson #ifndef _KERNEL 50aed55708SRobert Watson #error "no user-serviceable parts inside" 51aed55708SRobert Watson #endif 52ddcdf265SRobert Watson 5318717f69SRobert Watson struct auditinfo; 54f1e8bf6dSRobert Watson struct auditinfo_addr; 55ddcdf265SRobert Watson struct bpf_d; 5689c9c53dSPoul-Henning Kamp struct cdev; 57ddcdf265SRobert Watson struct componentname; 58ddcdf265SRobert Watson struct devfs_dirent; 59ddcdf265SRobert Watson struct ifnet; 60ddcdf265SRobert Watson struct ifreq; 61670cb89bSRobert Watson struct image_params; 62a557af22SRobert Watson struct inpcb; 63ddcdf265SRobert Watson struct ipq; 6452648411SRobert Watson struct ksem; 650142affcSRobert Watson struct label; 66225bff6fSRobert Watson struct m_tag; 67aed55708SRobert Watson struct mac; 68ddcdf265SRobert Watson struct mbuf; 69ddcdf265SRobert Watson struct mount; 7042726d8aSRobert Watson struct msg; 7142726d8aSRobert Watson struct msqid_kernel; 72ddcdf265SRobert Watson struct proc; 7342726d8aSRobert Watson struct semid_kernel; 7442726d8aSRobert Watson struct shmid_kernel; 75ddcdf265SRobert Watson struct sockaddr; 76ddcdf265SRobert Watson struct socket; 7763dba32bSPawel Jakub Dawidek struct sysctl_oid; 7863dba32bSPawel Jakub Dawidek struct sysctl_req; 794795b82cSRobert Watson struct pipepair; 8092dbb82aSRobert Watson struct thread; 81ddcdf265SRobert Watson struct timespec; 82ddcdf265SRobert Watson struct ucred; 83ddcdf265SRobert Watson struct uio; 84ddcdf265SRobert Watson struct vattr; 85ddcdf265SRobert Watson struct vnode; 86aed55708SRobert Watson struct vop_setlabel_args; 87ddcdf265SRobert Watson 88ddcdf265SRobert Watson #include <sys/acl.h> /* XXX acl_type_t */ 89ddcdf265SRobert Watson 90ddcdf265SRobert Watson /* 91aed55708SRobert Watson * Kernel functions to manage and evaluate labels. 92ddcdf265SRobert Watson */ 93179da74eSRobert Watson int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp); 94179da74eSRobert Watson void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d); 95179da74eSRobert Watson void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m); 9630d239bcSRobert Watson void mac_bpfdesc_destroy(struct bpf_d *); 97179da74eSRobert Watson void mac_bpfdesc_init(struct bpf_d *); 98179da74eSRobert Watson 99179da74eSRobert Watson int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2); 100179da74eSRobert Watson void mac_cred_copy(struct ucred *cr1, struct ucred *cr2); 10130d239bcSRobert Watson void mac_cred_destroy(struct ucred *); 102179da74eSRobert Watson void mac_cred_init(struct ucred *); 103eca8a663SRobert Watson 10430d239bcSRobert Watson void mac_devfs_create_device(struct ucred *cred, struct mount *mp, 105d26dd2d9SRobert Watson struct cdev *dev, struct devfs_dirent *de); 10630d239bcSRobert Watson void mac_devfs_create_directory(struct mount *mp, char *dirname, 107990b4b2dSRobert Watson int dirnamelen, struct devfs_dirent *de); 10830d239bcSRobert Watson void mac_devfs_create_symlink(struct ucred *cred, struct mount *mp, 109990b4b2dSRobert Watson struct devfs_dirent *dd, struct devfs_dirent *de); 110179da74eSRobert Watson void mac_devfs_destroy(struct devfs_dirent *); 111179da74eSRobert Watson void mac_devfs_init(struct devfs_dirent *); 11230d239bcSRobert Watson void mac_devfs_update(struct mount *mp, struct devfs_dirent *de, 113990b4b2dSRobert Watson struct vnode *vp); 114179da74eSRobert Watson void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de, 115179da74eSRobert Watson struct vnode *vp); 116ddcdf265SRobert Watson 11730d239bcSRobert Watson int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m); 118179da74eSRobert Watson void mac_ifnet_create(struct ifnet *ifp); 119179da74eSRobert Watson void mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m); 120179da74eSRobert Watson void mac_ifnet_destroy(struct ifnet *); 121179da74eSRobert Watson void mac_ifnet_init(struct ifnet *); 122179da74eSRobert Watson int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr, 123179da74eSRobert Watson struct ifnet *ifp); 124179da74eSRobert Watson int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, 125179da74eSRobert Watson struct ifnet *ifp); 126179da74eSRobert Watson 12730d239bcSRobert Watson int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m); 128179da74eSRobert Watson void mac_inpcb_create(struct socket *so, struct inpcb *inp); 129179da74eSRobert Watson void mac_inpcb_create_mbuf(struct inpcb *inp, struct mbuf *m); 130179da74eSRobert Watson void mac_inpcb_destroy(struct inpcb *); 131179da74eSRobert Watson int mac_inpcb_init(struct inpcb *, int); 132179da74eSRobert Watson void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp); 133179da74eSRobert Watson 134179da74eSRobert Watson void mac_ipq_create(struct mbuf *m, struct ipq *ipq); 135179da74eSRobert Watson void mac_ipq_destroy(struct ipq *); 136179da74eSRobert Watson int mac_ipq_init(struct ipq *, int); 137179da74eSRobert Watson int mac_ipq_match(struct mbuf *m, struct ipq *ipq); 138179da74eSRobert Watson void mac_ipq_reassemble(struct ipq *ipq, struct mbuf *m); 139179da74eSRobert Watson void mac_ipq_update(struct mbuf *m, struct ipq *ipq); 140179da74eSRobert Watson 14130d239bcSRobert Watson int mac_kenv_check_dump(struct ucred *cred); 14230d239bcSRobert Watson int mac_kenv_check_get(struct ucred *cred, char *name); 14330d239bcSRobert Watson int mac_kenv_check_set(struct ucred *cred, char *name, char *value); 14430d239bcSRobert Watson int mac_kenv_check_unset(struct ucred *cred, char *name); 145179da74eSRobert Watson 14630d239bcSRobert Watson int mac_kld_check_load(struct ucred *cred, struct vnode *vp); 14730d239bcSRobert Watson int mac_kld_check_stat(struct ucred *cred); 148179da74eSRobert Watson 149179da74eSRobert Watson void mac_mbuf_copy(struct mbuf *, struct mbuf *); 150179da74eSRobert Watson void mac_mbuf_create_from_firewall(struct mbuf *m); 151179da74eSRobert Watson void mac_create_mbuf_linklayer(struct ifnet *ifp, struct mbuf *m); 152179da74eSRobert Watson void mac_mbuf_create_multicast_encap(struct mbuf *m, struct ifnet *ifp, 153179da74eSRobert Watson struct mbuf *mnew); 154179da74eSRobert Watson void mac_mbuf_create_netlayer(struct mbuf *m, struct mbuf *mnew); 155179da74eSRobert Watson int mac_mbuf_init(struct mbuf *, int); 156179da74eSRobert Watson 157179da74eSRobert Watson void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *); 158179da74eSRobert Watson void mac_mbuf_tag_destroy(struct m_tag *); 159179da74eSRobert Watson int mac_mbuf_tag_init(struct m_tag *, int); 160179da74eSRobert Watson 16130d239bcSRobert Watson int mac_mount_check_stat(struct ucred *cred, struct mount *mp); 162179da74eSRobert Watson void mac_mount_create(struct ucred *cred, struct mount *mp); 163179da74eSRobert Watson void mac_mount_destroy(struct mount *); 164179da74eSRobert Watson void mac_mount_init(struct mount *); 165179da74eSRobert Watson 166179da74eSRobert Watson void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag); 167179da74eSRobert Watson void mac_netinet_icmp_reply(struct mbuf *m); 168179da74eSRobert Watson void mac_netinet_tcp_reply(struct mbuf *m); 169179da74eSRobert Watson 17030d239bcSRobert Watson int mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 171ddcdf265SRobert Watson unsigned long cmd, void *data); 17230d239bcSRobert Watson int mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp); 17330d239bcSRobert Watson int mac_pipe_check_read(struct ucred *cred, struct pipepair *pp); 17430d239bcSRobert Watson int mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp); 17530d239bcSRobert Watson int mac_pipe_check_write(struct ucred *cred, struct pipepair *pp); 176179da74eSRobert Watson void mac_pipe_create(struct ucred *cred, struct pipepair *pp); 177179da74eSRobert Watson void mac_pipe_destroy(struct pipepair *); 178179da74eSRobert Watson void mac_pipe_init(struct pipepair *); 179179da74eSRobert Watson int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, 180179da74eSRobert Watson struct label *label); 181179da74eSRobert Watson 18230d239bcSRobert Watson int mac_posixsem_check_destroy(struct ucred *cred, struct ksem *ks); 18330d239bcSRobert Watson int mac_posixsem_check_getvalue(struct ucred *cred,struct ksem *ks); 18430d239bcSRobert Watson int mac_posixsem_check_open(struct ucred *cred, struct ksem *ks); 18530d239bcSRobert Watson int mac_posixsem_check_post(struct ucred *cred, struct ksem *ks); 18630d239bcSRobert Watson int mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks); 18730d239bcSRobert Watson int mac_posixsem_check_wait(struct ucred *cred, struct ksem *ks); 188179da74eSRobert Watson void mac_posixsem_create(struct ucred *cred, struct ksem *ks); 189179da74eSRobert Watson void mac_posixsem_destroy(struct ksem *); 190179da74eSRobert Watson void mac_posixsem_init(struct ksem *); 191179da74eSRobert Watson 192179da74eSRobert Watson int mac_priv_check(struct ucred *cred, int priv); 193179da74eSRobert Watson int mac_priv_grant(struct ucred *cred, int priv); 194179da74eSRobert Watson 195179da74eSRobert Watson void mac_proc_associate_nfsd(struct ucred *cred); 19630d239bcSRobert Watson int mac_proc_check_debug(struct ucred *cred, struct proc *p); 19730d239bcSRobert Watson int mac_proc_check_sched(struct ucred *cred, struct proc *p); 19830d239bcSRobert Watson int mac_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai); 19930d239bcSRobert Watson int mac_proc_check_setaudit_addr(struct ucred *cred, 200f1e8bf6dSRobert Watson struct auditinfo_addr *aia); 20130d239bcSRobert Watson int mac_proc_check_setauid(struct ucred *cred, uid_t auid); 202179da74eSRobert Watson int mac_proc_check_setegid(struct proc *p, struct ucred *cred, 203179da74eSRobert Watson gid_t egid); 20430d239bcSRobert Watson int mac_proc_check_seteuid(struct proc *p, struct ucred *cred, 205030a28b3SRobert Watson uid_t euid); 20630d239bcSRobert Watson int mac_proc_check_setgid(struct proc *p, struct ucred *cred, 207030a28b3SRobert Watson gid_t gid); 20830d239bcSRobert Watson int mac_proc_check_setgroups(struct proc *p, struct ucred *cred, 209030a28b3SRobert Watson int ngroups, gid_t *gidset); 21030d239bcSRobert Watson int mac_proc_check_setregid(struct proc *p, struct ucred *cred, 211030a28b3SRobert Watson gid_t rgid, gid_t egid); 21230d239bcSRobert Watson int mac_proc_check_setresgid(struct proc *p, struct ucred *cred, 213030a28b3SRobert Watson gid_t rgid, gid_t egid, gid_t sgid); 214179da74eSRobert Watson int mac_proc_check_setresuid(struct proc *p, struct ucred *cred, 215179da74eSRobert Watson uid_t ruid, uid_t euid, uid_t suid); 216179da74eSRobert Watson int mac_proc_check_setreuid(struct proc *p, struct ucred *cred, 217179da74eSRobert Watson uid_t ruid, uid_t euid); 218179da74eSRobert Watson int mac_proc_check_setuid(struct proc *p, struct ucred *cred, 219179da74eSRobert Watson uid_t uid); 22030d239bcSRobert Watson int mac_proc_check_signal(struct ucred *cred, struct proc *p, 221ddcdf265SRobert Watson int signum); 22230d239bcSRobert Watson int mac_proc_check_wait(struct ucred *cred, struct proc *p); 223179da74eSRobert Watson void mac_proc_create_init(struct ucred *cred); 224179da74eSRobert Watson void mac_proc_create_swapper(struct ucred *cred); 225179da74eSRobert Watson void mac_proc_destroy(struct proc *); 226179da74eSRobert Watson int mac_execve_enter(struct image_params *imgp, struct mac *mac_p); 227179da74eSRobert Watson void mac_execve_exit(struct image_params *imgp); 228179da74eSRobert Watson void mac_proc_init(struct proc *); 229179da74eSRobert Watson 23030d239bcSRobert Watson int mac_socket_check_accept(struct ucred *cred, struct socket *so); 23130d239bcSRobert Watson int mac_socket_check_bind(struct ucred *cred, struct socket *so, 23226ae2b86SRobert Watson struct sockaddr *sa); 23330d239bcSRobert Watson int mac_socket_check_connect(struct ucred *cred, struct socket *so, 23426ae2b86SRobert Watson struct sockaddr *sa); 23530d239bcSRobert Watson int mac_socket_check_create(struct ucred *cred, int domain, int type, 23626ae2b86SRobert Watson int proto); 23730d239bcSRobert Watson int mac_socket_check_deliver(struct socket *so, struct mbuf *m); 23830d239bcSRobert Watson int mac_socket_check_listen(struct ucred *cred, struct socket *so); 23930d239bcSRobert Watson int mac_socket_check_poll(struct ucred *cred, struct socket *so); 24030d239bcSRobert Watson int mac_socket_check_receive(struct ucred *cred, struct socket *so); 24130d239bcSRobert Watson int mac_socket_check_send(struct ucred *cred, struct socket *so); 24230d239bcSRobert Watson int mac_socket_check_stat(struct ucred *cred, struct socket *so); 24330d239bcSRobert Watson int mac_socket_check_visible(struct ucred *cred, struct socket *so); 244179da74eSRobert Watson void mac_socket_create_mbuf(struct socket *so, struct mbuf *m); 245179da74eSRobert Watson void mac_socket_create(struct ucred *cred, struct socket *so); 246179da74eSRobert Watson void mac_socket_destroy(struct socket *); 247179da74eSRobert Watson int mac_socket_init(struct socket *, int); 248179da74eSRobert Watson void mac_socket_newconn(struct socket *oldso, struct socket *newso); 249179da74eSRobert Watson int mac_getsockopt_label(struct ucred *cred, struct socket *so, 250179da74eSRobert Watson struct mac *extmac); 251179da74eSRobert Watson int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, 252179da74eSRobert Watson struct mac *extmac); 253179da74eSRobert Watson int mac_setsockopt_label(struct ucred *cred, struct socket *so, 254179da74eSRobert Watson struct mac *extmac); 255179da74eSRobert Watson 256179da74eSRobert Watson void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so); 257179da74eSRobert Watson void mac_socketpeer_set_from_socket(struct socket *oldso, 258179da74eSRobert Watson struct socket *newso); 259179da74eSRobert Watson 260179da74eSRobert Watson void mac_syncache_create(struct label *l, struct inpcb *inp); 261179da74eSRobert Watson void mac_syncache_create_mbuf(struct label *l, struct mbuf *m); 262179da74eSRobert Watson void mac_syncache_destroy(struct label **l); 263179da74eSRobert Watson int mac_syncache_init(struct label **l); 264179da74eSRobert Watson 26530d239bcSRobert Watson int mac_system_check_acct(struct ucred *cred, struct vnode *vp); 26630d239bcSRobert Watson int mac_system_check_audit(struct ucred *cred, void *record, int length); 26730d239bcSRobert Watson int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp); 26830d239bcSRobert Watson int mac_system_check_auditon(struct ucred *cred, int cmd); 26930d239bcSRobert Watson int mac_system_check_reboot(struct ucred *cred, int howto); 27030d239bcSRobert Watson int mac_system_check_swapon(struct ucred *cred, struct vnode *vp); 27130d239bcSRobert Watson int mac_system_check_swapoff(struct ucred *cred, struct vnode *vp); 27230d239bcSRobert Watson int mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, 27363dba32bSPawel Jakub Dawidek void *arg1, int arg2, struct sysctl_req *req); 274179da74eSRobert Watson 275179da74eSRobert Watson void mac_sysvmsg_cleanup(struct msg *msgptr); 276179da74eSRobert Watson void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, 277179da74eSRobert Watson struct msg *msgptr); 278179da74eSRobert Watson void mac_sysvmsg_destroy(struct msg *); 279179da74eSRobert Watson void mac_sysvmsg_init(struct msg *); 280179da74eSRobert Watson 281179da74eSRobert Watson int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, 282179da74eSRobert Watson struct msqid_kernel *msqkptr); 283179da74eSRobert Watson int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr); 284179da74eSRobert Watson int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr); 285179da74eSRobert Watson int mac_sysvmsq_check_msqctl(struct ucred *cred, 286179da74eSRobert Watson struct msqid_kernel *msqkptr, int cmd); 287179da74eSRobert Watson int mac_sysvmsq_check_msqget(struct ucred *cred, 288179da74eSRobert Watson struct msqid_kernel *msqkptr); 289179da74eSRobert Watson int mac_sysvmsq_check_msqrcv(struct ucred *cred, 290179da74eSRobert Watson struct msqid_kernel *msqkptr); 291179da74eSRobert Watson int mac_sysvmsq_check_msqsnd(struct ucred *cred, 292179da74eSRobert Watson struct msqid_kernel *msqkptr); 293179da74eSRobert Watson void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr); 294179da74eSRobert Watson void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr); 295179da74eSRobert Watson void mac_sysvmsq_destroy(struct msqid_kernel *); 296179da74eSRobert Watson void mac_sysvmsq_init(struct msqid_kernel *); 297179da74eSRobert Watson 298179da74eSRobert Watson int mac_sysvsem_check_semctl(struct ucred *cred, 299179da74eSRobert Watson struct semid_kernel *semakptr, int cmd); 300179da74eSRobert Watson int mac_sysvsem_check_semget(struct ucred *cred, 301179da74eSRobert Watson struct semid_kernel *semakptr); 302179da74eSRobert Watson int mac_sysvsem_check_semop(struct ucred *cred, 303179da74eSRobert Watson struct semid_kernel *semakptr, size_t accesstype); 304179da74eSRobert Watson void mac_sysvsem_cleanup(struct semid_kernel *semakptr); 305179da74eSRobert Watson void mac_sysvsem_create(struct ucred *cred, 306179da74eSRobert Watson struct semid_kernel *semakptr); 307179da74eSRobert Watson void mac_sysvsem_destroy(struct semid_kernel *); 308179da74eSRobert Watson void mac_sysvsem_init(struct semid_kernel *); 309179da74eSRobert Watson 310179da74eSRobert Watson int mac_sysvshm_check_shmat(struct ucred *cred, 311179da74eSRobert Watson struct shmid_kernel *shmsegptr, int shmflg); 312179da74eSRobert Watson int mac_sysvshm_check_shmctl(struct ucred *cred, 313179da74eSRobert Watson struct shmid_kernel *shmsegptr, int cmd); 314179da74eSRobert Watson int mac_sysvshm_check_shmdt(struct ucred *cred, 315179da74eSRobert Watson struct shmid_kernel *shmsegptr); 316179da74eSRobert Watson int mac_sysvshm_check_shmget(struct ucred *cred, 317179da74eSRobert Watson struct shmid_kernel *shmsegptr, int shmflg); 318179da74eSRobert Watson void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr); 319179da74eSRobert Watson void mac_sysvshm_create(struct ucred *cred, 320179da74eSRobert Watson struct shmid_kernel *shmsegptr); 321179da74eSRobert Watson void mac_sysvshm_destroy(struct shmid_kernel *); 322179da74eSRobert Watson void mac_sysvshm_init(struct shmid_kernel *); 323179da74eSRobert Watson 324179da74eSRobert Watson void mac_thread_userret(struct thread *td); 325179da74eSRobert Watson 326179da74eSRobert Watson int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp); 327179da74eSRobert Watson void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp); 32830d239bcSRobert Watson int mac_vnode_check_access(struct ucred *cred, struct vnode *vp, 329b914de36SRobert Watson int acc_mode); 33030d239bcSRobert Watson int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp); 33130d239bcSRobert Watson int mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp); 33230d239bcSRobert Watson int mac_vnode_check_create(struct ucred *cred, struct vnode *dvp, 333ddcdf265SRobert Watson struct componentname *cnp, struct vattr *vap); 33430d239bcSRobert Watson int mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, 335ddcdf265SRobert Watson acl_type_t type); 33630d239bcSRobert Watson int mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, 337c096756cSRobert Watson int attrnamespace, const char *name); 33830d239bcSRobert Watson int mac_vnode_check_exec(struct ucred *cred, struct vnode *vp, 339670cb89bSRobert Watson struct image_params *imgp); 34030d239bcSRobert Watson int mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp, 341ddcdf265SRobert Watson acl_type_t type); 34230d239bcSRobert Watson int mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, 343ddcdf265SRobert Watson int attrnamespace, const char *name, struct uio *uio); 34430d239bcSRobert Watson int mac_vnode_check_link(struct ucred *cred, struct vnode *dvp, 3450a694196SRobert Watson struct vnode *vp, struct componentname *cnp); 34630d239bcSRobert Watson int mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, 347c096756cSRobert Watson int attrnamespace); 34830d239bcSRobert Watson int mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, 349ddcdf265SRobert Watson struct componentname *cnp); 35030d239bcSRobert Watson int mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot, 35126ae2b86SRobert Watson int flags); 35230d239bcSRobert Watson int mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, 353e183f80eSRobert Watson int prot); 35430d239bcSRobert Watson int mac_vnode_check_open(struct ucred *cred, struct vnode *vp, 355b914de36SRobert Watson int acc_mode); 35630d239bcSRobert Watson int mac_vnode_check_poll(struct ucred *active_cred, 357177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 35830d239bcSRobert Watson int mac_vnode_check_read(struct ucred *active_cred, 359177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 36030d239bcSRobert Watson int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp); 36130d239bcSRobert Watson int mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp); 36230d239bcSRobert Watson int mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, 363ddcdf265SRobert Watson struct vnode *vp, struct componentname *cnp); 36430d239bcSRobert Watson int mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, 365ddcdf265SRobert Watson struct vnode *vp, int samedir, struct componentname *cnp); 36630d239bcSRobert Watson int mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp); 36730d239bcSRobert Watson int mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp, 368ddcdf265SRobert Watson acl_type_t type, struct acl *acl); 36930d239bcSRobert Watson int mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, 370ddcdf265SRobert Watson int attrnamespace, const char *name, struct uio *uio); 37130d239bcSRobert Watson int mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp, 372ddcdf265SRobert Watson u_long flags); 37330d239bcSRobert Watson int mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp, 374ddcdf265SRobert Watson mode_t mode); 37530d239bcSRobert Watson int mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp, 376ddcdf265SRobert Watson uid_t uid, gid_t gid); 37730d239bcSRobert Watson int mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, 378ddcdf265SRobert Watson struct timespec atime, struct timespec mtime); 37930d239bcSRobert Watson int mac_vnode_check_stat(struct ucred *active_cred, 380177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 38130d239bcSRobert Watson int mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, 38245e0f3d6SRobert Watson struct vnode *vp, struct componentname *cnp); 38330d239bcSRobert Watson int mac_vnode_check_write(struct ucred *active_cred, 384177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 385179da74eSRobert Watson void mac_vnode_copy_label(struct label *, struct label *); 386179da74eSRobert Watson void mac_vnode_init(struct vnode *); 387179da74eSRobert Watson int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp, 388179da74eSRobert Watson struct vnode *dvp, struct vnode *vp, struct componentname *cnp); 389179da74eSRobert Watson void mac_vnode_destroy(struct vnode *); 390179da74eSRobert Watson void mac_vnode_execve_transition(struct ucred *oldcred, 391179da74eSRobert Watson struct ucred *newcred, struct vnode *vp, 392179da74eSRobert Watson struct label *interpvplabel, struct image_params *imgp); 393179da74eSRobert Watson int mac_vnode_execve_will_transition(struct ucred *cred, 394179da74eSRobert Watson struct vnode *vp, struct label *interpvplabel, 395179da74eSRobert Watson struct image_params *imgp); 396179da74eSRobert Watson void mac_vnode_relabel(struct ucred *cred, struct vnode *vp, 397179da74eSRobert Watson struct label *newlabel); 398179da74eSRobert Watson 399179da74eSRobert Watson struct label *mac_cred_label_alloc(void); 400179da74eSRobert Watson void mac_cred_label_free(struct label *); 401179da74eSRobert Watson struct label *mac_vnode_label_alloc(void); 402179da74eSRobert Watson void mac_vnode_label_free(struct label *); 403179da74eSRobert Watson 4044d10c0ceSRobert Watson void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); 405ddcdf265SRobert Watson 406ddcdf265SRobert Watson /* 4079caab7a2SRobert Watson * Calls to help various file systems implement labeling functionality using 4089caab7a2SRobert Watson * their existing EA implementation. 409ddcdf265SRobert Watson */ 410ddcdf265SRobert Watson int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); 411ddcdf265SRobert Watson 412aed55708SRobert Watson #endif /* !_SYS_SECURITY_MAC_MAC_FRAMEWORK_H_ */ 413