1ddcdf265SRobert Watson /*- 2f6a41092SRobert Watson * Copyright (c) 1999-2002 Robert N. M. Watson 37f53207bSRobert Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 46758f88eSRobert Watson * Copyright (c) 2005 SPARTA, Inc. 5ddcdf265SRobert Watson * All rights reserved. 6ddcdf265SRobert Watson * 7ddcdf265SRobert Watson * This software was developed by Robert Watson for the TrustedBSD Project. 8ddcdf265SRobert Watson * 96201265bSRobert Watson * This software was developed for the FreeBSD Project in part by Network 106201265bSRobert Watson * Associates Laboratories, the Security Research Division of Network 116201265bSRobert Watson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 126201265bSRobert Watson * as part of the DARPA CHATS research program. 13ddcdf265SRobert Watson * 146758f88eSRobert Watson * This software was enhanced by SPARTA ISSO under SPAWAR contract 156758f88eSRobert Watson * N66001-04-C-6019 ("SEFOS"). 166758f88eSRobert Watson * 17ddcdf265SRobert Watson * Redistribution and use in source and binary forms, with or without 18ddcdf265SRobert Watson * modification, are permitted provided that the following conditions 19ddcdf265SRobert Watson * are met: 20ddcdf265SRobert Watson * 1. Redistributions of source code must retain the above copyright 21ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer. 22ddcdf265SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 23ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer in the 24ddcdf265SRobert Watson * documentation and/or other materials provided with the distribution. 25ddcdf265SRobert Watson * 26ddcdf265SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 27ddcdf265SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28ddcdf265SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29ddcdf265SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 30ddcdf265SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31ddcdf265SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32ddcdf265SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33ddcdf265SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34ddcdf265SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35ddcdf265SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36ddcdf265SRobert Watson * SUCH DAMAGE. 37ddcdf265SRobert Watson * 38ddcdf265SRobert Watson * $FreeBSD$ 39ddcdf265SRobert Watson */ 40ddcdf265SRobert Watson /* 41ddcdf265SRobert Watson * Userland/kernel interface for Mandatory Access Control. 42ddcdf265SRobert Watson * 43ddcdf265SRobert Watson * The POSIX.1e implementation page may be reached at: 44ddcdf265SRobert Watson * http://www.trustedbsd.org/ 45ddcdf265SRobert Watson */ 467f53207bSRobert Watson 4702ebd2bcSRobert Watson #ifndef _SYS_MAC_H_ 4802ebd2bcSRobert Watson #define _SYS_MAC_H_ 49ddcdf265SRobert Watson 50f6d4af7cSRobert Watson #include <sys/_label.h> 51f6d4af7cSRobert Watson 52ddcdf265SRobert Watson #ifndef _POSIX_MAC 53ddcdf265SRobert Watson #define _POSIX_MAC 54ddcdf265SRobert Watson #endif 55ddcdf265SRobert Watson 56ddcdf265SRobert Watson /* 5727f2eac7SRobert Watson * MAC framework-related constants and limits. 5827f2eac7SRobert Watson */ 5927f2eac7SRobert Watson #define MAC_MAX_POLICY_NAME 32 60475b9d0aSRobert Watson #define MAC_MAX_LABEL_ELEMENT_NAME 32 61475b9d0aSRobert Watson #define MAC_MAX_LABEL_ELEMENT_DATA 4096 62475b9d0aSRobert Watson #define MAC_MAX_LABEL_BUF_LEN 8192 63475b9d0aSRobert Watson 64475b9d0aSRobert Watson struct mac { 65475b9d0aSRobert Watson size_t m_buflen; 66475b9d0aSRobert Watson char *m_string; 67475b9d0aSRobert Watson }; 68475b9d0aSRobert Watson 69475b9d0aSRobert Watson typedef struct mac *mac_t; 70475b9d0aSRobert Watson 71475b9d0aSRobert Watson #ifndef _KERNEL 7227f2eac7SRobert Watson 7327f2eac7SRobert Watson /* 74475b9d0aSRobert Watson * Location of the userland MAC framework configuration file. mac.conf 75475b9d0aSRobert Watson * binds policy names to shared libraries that understand those policies, 76475b9d0aSRobert Watson * as well as setting defaults for MAC-aware applications. 77ddcdf265SRobert Watson */ 78475b9d0aSRobert Watson #define MAC_CONFFILE "/etc/mac.conf" 79ddcdf265SRobert Watson 80ddcdf265SRobert Watson /* 81475b9d0aSRobert Watson * Extended non-POSIX.1e interfaces that offer additional services 82475b9d0aSRobert Watson * available from the userland and kernel MAC frameworks. 83ddcdf265SRobert Watson */ 846b66d5bbSRobert Watson __BEGIN_DECLS 85953222e2SRobert Watson int mac_execve(char *fname, char **argv, char **envv, mac_t _label); 86475b9d0aSRobert Watson int mac_free(mac_t _label); 87475b9d0aSRobert Watson int mac_from_text(mac_t *_label, const char *_text); 88475b9d0aSRobert Watson int mac_get_fd(int _fd, mac_t _label); 89475b9d0aSRobert Watson int mac_get_file(const char *_path, mac_t _label); 90475b9d0aSRobert Watson int mac_get_link(const char *_path, mac_t _label); 91920325eeSRobert Watson int mac_get_peer(int _fd, mac_t _label); 92475b9d0aSRobert Watson int mac_get_pid(pid_t _pid, mac_t _label); 93475b9d0aSRobert Watson int mac_get_proc(mac_t _label); 94475b9d0aSRobert Watson int mac_is_present(const char *_policyname); 95930d4ffaSRobert Watson int mac_prepare(mac_t *_label, const char *_elements); 96475b9d0aSRobert Watson int mac_prepare_file_label(mac_t *_label); 97475b9d0aSRobert Watson int mac_prepare_ifnet_label(mac_t *_label); 98475b9d0aSRobert Watson int mac_prepare_process_label(mac_t *_label); 996139aaa8SRobert Watson int mac_prepare_type(mac_t *_label, const char *_type); 100475b9d0aSRobert Watson int mac_set_fd(int _fildes, const mac_t _label); 101475b9d0aSRobert Watson int mac_set_file(const char *_path, mac_t _label); 102475b9d0aSRobert Watson int mac_set_link(const char *_path, mac_t _label); 103475b9d0aSRobert Watson int mac_set_proc(const mac_t _label); 104475b9d0aSRobert Watson int mac_syscall(const char *_policyname, int _call, void *_arg); 105475b9d0aSRobert Watson int mac_to_text(mac_t mac, char **_text); 1066b66d5bbSRobert Watson __END_DECLS 107475b9d0aSRobert Watson 108f30a9615SRobert Watson #else /* _KERNEL */ 109ddcdf265SRobert Watson 110ddcdf265SRobert Watson /* 111ddcdf265SRobert Watson * Kernel functions to manage and evaluate labels. 112ddcdf265SRobert Watson */ 113ddcdf265SRobert Watson struct bpf_d; 11489c9c53dSPoul-Henning Kamp struct cdev; 115ddcdf265SRobert Watson struct componentname; 116ddcdf265SRobert Watson struct devfs_dirent; 117ddcdf265SRobert Watson struct ifnet; 118ddcdf265SRobert Watson struct ifreq; 119a557af22SRobert Watson struct inpcb; 120670cb89bSRobert Watson struct image_params; 121a557af22SRobert Watson struct inpcb; 122ddcdf265SRobert Watson struct ipq; 12352648411SRobert Watson struct ksem; 124225bff6fSRobert Watson struct m_tag; 125ddcdf265SRobert Watson struct mbuf; 126ddcdf265SRobert Watson struct mount; 12742726d8aSRobert Watson struct msg; 12842726d8aSRobert Watson struct msqid_kernel; 129ddcdf265SRobert Watson struct proc; 13042726d8aSRobert Watson struct semid_kernel; 13142726d8aSRobert Watson struct shmid_kernel; 132ddcdf265SRobert Watson struct sockaddr; 133ddcdf265SRobert Watson struct socket; 13463dba32bSPawel Jakub Dawidek struct sysctl_oid; 13563dba32bSPawel Jakub Dawidek struct sysctl_req; 1364795b82cSRobert Watson struct pipepair; 13792dbb82aSRobert Watson struct thread; 138ddcdf265SRobert Watson struct timespec; 139ddcdf265SRobert Watson struct ucred; 140ddcdf265SRobert Watson struct uio; 141ddcdf265SRobert Watson struct vattr; 142ddcdf265SRobert Watson struct vnode; 143ddcdf265SRobert Watson 144ddcdf265SRobert Watson #include <sys/acl.h> /* XXX acl_type_t */ 145ddcdf265SRobert Watson 146ddcdf265SRobert Watson struct vop_setlabel_args; 147ddcdf265SRobert Watson 148ddcdf265SRobert Watson /* 149ddcdf265SRobert Watson * Label operations. 150ddcdf265SRobert Watson */ 151ddcdf265SRobert Watson void mac_init_bpfdesc(struct bpf_d *); 152ddcdf265SRobert Watson void mac_init_cred(struct ucred *); 153ddcdf265SRobert Watson void mac_init_devfsdirent(struct devfs_dirent *); 154ddcdf265SRobert Watson void mac_init_ifnet(struct ifnet *); 155a557af22SRobert Watson int mac_init_inpcb(struct inpcb *, int flag); 15642726d8aSRobert Watson void mac_init_sysv_msgmsg(struct msg *); 15742726d8aSRobert Watson void mac_init_sysv_msgqueue(struct msqid_kernel*); 1583831e7d7SRobert Watson void mac_init_sysv_sem(struct semid_kernel*); 15942726d8aSRobert Watson void mac_init_sysv_shm(struct shmid_kernel*); 1605e7ce478SRobert Watson int mac_init_ipq(struct ipq *, int flag); 16183985c26SRobert Watson int mac_init_socket(struct socket *, int flag); 1624795b82cSRobert Watson void mac_init_pipe(struct pipepair *); 16352648411SRobert Watson void mac_init_posix_sem(struct ksem *); 164225bff6fSRobert Watson int mac_init_mbuf(struct mbuf *mbuf, int flag); 165225bff6fSRobert Watson int mac_init_mbuf_tag(struct m_tag *, int flag); 166ddcdf265SRobert Watson void mac_init_mount(struct mount *); 1672555374cSRobert Watson void mac_init_proc(struct proc *); 168ddcdf265SRobert Watson void mac_init_vnode(struct vnode *); 169225bff6fSRobert Watson void mac_copy_mbuf_tag(struct m_tag *, struct m_tag *); 170763bbd2fSRobert Watson void mac_copy_vnode_label(struct label *, struct label *label); 171ddcdf265SRobert Watson void mac_destroy_bpfdesc(struct bpf_d *); 172ddcdf265SRobert Watson void mac_destroy_cred(struct ucred *); 173ddcdf265SRobert Watson void mac_destroy_devfsdirent(struct devfs_dirent *); 174ddcdf265SRobert Watson void mac_destroy_ifnet(struct ifnet *); 175a557af22SRobert Watson void mac_destroy_inpcb(struct inpcb *); 17642726d8aSRobert Watson void mac_destroy_sysv_msgmsg(struct msg *); 17742726d8aSRobert Watson void mac_destroy_sysv_msgqueue(struct msqid_kernel *); 1783831e7d7SRobert Watson void mac_destroy_sysv_sem(struct semid_kernel *); 17942726d8aSRobert Watson void mac_destroy_sysv_shm(struct shmid_kernel *); 180ddcdf265SRobert Watson void mac_destroy_ipq(struct ipq *); 181ddcdf265SRobert Watson void mac_destroy_socket(struct socket *); 1824795b82cSRobert Watson void mac_destroy_pipe(struct pipepair *); 18352648411SRobert Watson void mac_destroy_posix_sem(struct ksem *); 1842555374cSRobert Watson void mac_destroy_proc(struct proc *); 185225bff6fSRobert Watson void mac_destroy_mbuf_tag(struct m_tag *); 186ddcdf265SRobert Watson void mac_destroy_mount(struct mount *); 187ddcdf265SRobert Watson void mac_destroy_vnode(struct vnode *); 188eca8a663SRobert Watson 189eca8a663SRobert Watson struct label *mac_cred_label_alloc(void); 190eca8a663SRobert Watson void mac_cred_label_free(struct label *label); 191eca8a663SRobert Watson struct label *mac_vnode_label_alloc(void); 192eca8a663SRobert Watson void mac_vnode_label_free(struct label *label); 193ddcdf265SRobert Watson 194ddcdf265SRobert Watson /* 195ddcdf265SRobert Watson * Labeling event operations: file system objects, and things that 196ddcdf265SRobert Watson * look a lot like file system objects. 197ddcdf265SRobert Watson */ 198763bbd2fSRobert Watson void mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de, 199763bbd2fSRobert Watson struct vnode *vp); 200763bbd2fSRobert Watson int mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp); 201763bbd2fSRobert Watson void mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp); 20289c9c53dSPoul-Henning Kamp void mac_create_devfs_device(struct mount *mp, struct cdev *dev, 203ddcdf265SRobert Watson struct devfs_dirent *de); 204990b4b2dSRobert Watson void mac_create_devfs_directory(struct mount *mp, char *dirname, 205990b4b2dSRobert Watson int dirnamelen, struct devfs_dirent *de); 206990b4b2dSRobert Watson void mac_create_devfs_symlink(struct ucred *cred, struct mount *mp, 207990b4b2dSRobert Watson struct devfs_dirent *dd, struct devfs_dirent *de); 208763bbd2fSRobert Watson int mac_create_vnode_extattr(struct ucred *cred, struct mount *mp, 209763bbd2fSRobert Watson struct vnode *dvp, struct vnode *vp, struct componentname *cnp); 210ddcdf265SRobert Watson void mac_create_mount(struct ucred *cred, struct mount *mp); 211ddcdf265SRobert Watson void mac_create_root_mount(struct ucred *cred, struct mount *mp); 212ddcdf265SRobert Watson void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, 213ddcdf265SRobert Watson struct label *newlabel); 214990b4b2dSRobert Watson void mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de, 215990b4b2dSRobert Watson struct vnode *vp); 216ddcdf265SRobert Watson 217ddcdf265SRobert Watson /* 218ddcdf265SRobert Watson * Labeling event operations: IPC objects. 219ddcdf265SRobert Watson */ 220ddcdf265SRobert Watson void mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m); 221ddcdf265SRobert Watson void mac_create_socket(struct ucred *cred, struct socket *socket); 222ddcdf265SRobert Watson void mac_create_socket_from_socket(struct socket *oldsocket, 223ddcdf265SRobert Watson struct socket *newsocket); 224ddcdf265SRobert Watson void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, 225ddcdf265SRobert Watson struct socket *socket); 226ddcdf265SRobert Watson void mac_set_socket_peer_from_socket(struct socket *oldsocket, 227ddcdf265SRobert Watson struct socket *newsocket); 2284795b82cSRobert Watson void mac_create_pipe(struct ucred *cred, struct pipepair *pp); 229ddcdf265SRobert Watson 230ddcdf265SRobert Watson /* 23142726d8aSRobert Watson * Labeling event operations: System V IPC primitives 23242726d8aSRobert Watson */ 23342726d8aSRobert Watson void mac_create_sysv_msgmsg(struct ucred *cred, 23442726d8aSRobert Watson struct msqid_kernel *msqkptr, struct msg *msgptr); 23542726d8aSRobert Watson void mac_create_sysv_msgqueue(struct ucred *cred, 23642726d8aSRobert Watson struct msqid_kernel *msqkptr); 2373831e7d7SRobert Watson void mac_create_sysv_sem(struct ucred *cred, 23842726d8aSRobert Watson struct semid_kernel *semakptr); 23942726d8aSRobert Watson void mac_create_sysv_shm(struct ucred *cred, 24042726d8aSRobert Watson struct shmid_kernel *shmsegptr); 24142726d8aSRobert Watson 24242726d8aSRobert Watson /* 24352648411SRobert Watson * Labeling event operations: POSIX (global/inter-process) semaphores. 24452648411SRobert Watson */ 24552648411SRobert Watson void mac_create_posix_sem(struct ucred *cred, struct ksem *ksemptr); 24652648411SRobert Watson 24752648411SRobert Watson 24852648411SRobert Watson /* 249ddcdf265SRobert Watson * Labeling event operations: network objects. 250ddcdf265SRobert Watson */ 251ddcdf265SRobert Watson void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d); 252ddcdf265SRobert Watson void mac_create_ifnet(struct ifnet *ifp); 253a557af22SRobert Watson void mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp); 254ddcdf265SRobert Watson void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq); 255ddcdf265SRobert Watson void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram); 256ddcdf265SRobert Watson void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment); 2572d92ec98SRobert Watson void mac_create_mbuf_from_inpcb(struct inpcb *inp, struct mbuf *m); 258ddcdf265SRobert Watson void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf); 259ddcdf265SRobert Watson void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *m); 260ddcdf265SRobert Watson void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); 261ddcdf265SRobert Watson void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *m); 262ddcdf265SRobert Watson void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 263ddcdf265SRobert Watson struct ifnet *ifnet, struct mbuf *newmbuf); 264ddcdf265SRobert Watson void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf); 265ddcdf265SRobert Watson int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq); 266eb8c7f99SRobert Watson void mac_reflect_mbuf_icmp(struct mbuf *m); 267eb8c7f99SRobert Watson void mac_reflect_mbuf_tcp(struct mbuf *m); 268ddcdf265SRobert Watson void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq); 269a557af22SRobert Watson void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp); 270ddcdf265SRobert Watson 271ddcdf265SRobert Watson /* 272ddcdf265SRobert Watson * Labeling event operations: processes. 273ddcdf265SRobert Watson */ 27456d9e932SRobert Watson void mac_copy_cred(struct ucred *cr1, struct ucred *cr2); 275eca8a663SRobert Watson int mac_execve_enter(struct image_params *imgp, struct mac *mac_p); 276670cb89bSRobert Watson void mac_execve_exit(struct image_params *imgp); 277ddcdf265SRobert Watson void mac_execve_transition(struct ucred *old, struct ucred *new, 278670cb89bSRobert Watson struct vnode *vp, struct label *interpvnodelabel, 279670cb89bSRobert Watson struct image_params *imgp); 280670cb89bSRobert Watson int mac_execve_will_transition(struct ucred *old, struct vnode *vp, 281670cb89bSRobert Watson struct label *interpvnodelabel, struct image_params *imgp); 282ddcdf265SRobert Watson void mac_create_proc0(struct ucred *cred); 283ddcdf265SRobert Watson void mac_create_proc1(struct ucred *cred); 28492dbb82aSRobert Watson void mac_thread_userret(struct thread *td); 285ddcdf265SRobert Watson 28642726d8aSRobert Watson /* 28742726d8aSRobert Watson * Label cleanup operation: This is the inverse complement for the 28842726d8aSRobert Watson * mac_create and associate type of hooks. This hook lets the policy 28942726d8aSRobert Watson * module(s) perform a cleanup/flushing operation on the label 29042726d8aSRobert Watson * associated with the objects, without freeing up the space allocated. 29142726d8aSRobert Watson * This hook is useful in cases where it is desirable to remove any 29242726d8aSRobert Watson * labeling reference when recycling any object to a pool. This hook 29342726d8aSRobert Watson * does not replace the mac_destroy hooks. 29442726d8aSRobert Watson */ 29542726d8aSRobert Watson void mac_cleanup_sysv_msgmsg(struct msg *msgptr); 29642726d8aSRobert Watson void mac_cleanup_sysv_msgqueue(struct msqid_kernel *msqkptr); 2973831e7d7SRobert Watson void mac_cleanup_sysv_sem(struct semid_kernel *semakptr); 29842726d8aSRobert Watson void mac_cleanup_sysv_shm(struct shmid_kernel *shmsegptr); 29942726d8aSRobert Watson 300ddcdf265SRobert Watson /* Access control checks. */ 301ddcdf265SRobert Watson int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet); 302ddcdf265SRobert Watson int mac_check_cred_visible(struct ucred *u1, struct ucred *u2); 303ddcdf265SRobert Watson int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m); 304a557af22SRobert Watson int mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m); 30542726d8aSRobert Watson int mac_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr, 30642726d8aSRobert Watson struct msqid_kernel *msqkptr); 30742726d8aSRobert Watson int mac_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr); 30842726d8aSRobert Watson int mac_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr); 30942726d8aSRobert Watson int mac_check_sysv_msqget(struct ucred *cred, 31042726d8aSRobert Watson struct msqid_kernel *msqkptr); 31142726d8aSRobert Watson int mac_check_sysv_msqsnd(struct ucred *cred, 31242726d8aSRobert Watson struct msqid_kernel *msqkptr); 31342726d8aSRobert Watson int mac_check_sysv_msqrcv(struct ucred *cred, 31442726d8aSRobert Watson struct msqid_kernel *msqkptr); 31542726d8aSRobert Watson int mac_check_sysv_msqctl(struct ucred *cred, 31642726d8aSRobert Watson struct msqid_kernel *msqkptr, int cmd); 31742726d8aSRobert Watson int mac_check_sysv_semctl(struct ucred *cred, 31842726d8aSRobert Watson struct semid_kernel *semakptr, int cmd); 31942726d8aSRobert Watson int mac_check_sysv_semget(struct ucred *cred, 32042726d8aSRobert Watson struct semid_kernel *semakptr); 32142726d8aSRobert Watson int mac_check_sysv_semop(struct ucred *cred,struct semid_kernel *semakptr, 32242726d8aSRobert Watson size_t accesstype); 32342726d8aSRobert Watson int mac_check_sysv_shmat(struct ucred *cred, 32442726d8aSRobert Watson struct shmid_kernel *shmsegptr, int shmflg); 32542726d8aSRobert Watson int mac_check_sysv_shmctl(struct ucred *cred, 32642726d8aSRobert Watson struct shmid_kernel *shmsegptr, int cmd); 32742726d8aSRobert Watson int mac_check_sysv_shmdt(struct ucred *cred, 32842726d8aSRobert Watson struct shmid_kernel *shmsegptr); 32942726d8aSRobert Watson int mac_check_sysv_shmget(struct ucred *cred, 33042726d8aSRobert Watson struct shmid_kernel *shmsegptr, int shmflg); 331e686e5aeSRobert Watson int mac_check_kenv_dump(struct ucred *cred); 332e686e5aeSRobert Watson int mac_check_kenv_get(struct ucred *cred, char *name); 333e686e5aeSRobert Watson int mac_check_kenv_set(struct ucred *cred, char *name, char *value); 334e686e5aeSRobert Watson int mac_check_kenv_unset(struct ucred *cred, char *name); 335a3df768bSRobert Watson int mac_check_kld_load(struct ucred *cred, struct vnode *vp); 336a3df768bSRobert Watson int mac_check_kld_stat(struct ucred *cred); 337a3df768bSRobert Watson int mac_check_kld_unload(struct ucred *cred); 338ddcdf265SRobert Watson int mac_check_mount_stat(struct ucred *cred, struct mount *mp); 3394795b82cSRobert Watson int mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp, 340ddcdf265SRobert Watson unsigned long cmd, void *data); 3414795b82cSRobert Watson int mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp); 3424795b82cSRobert Watson int mac_check_pipe_read(struct ucred *cred, struct pipepair *pp); 3434795b82cSRobert Watson int mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp); 3444795b82cSRobert Watson int mac_check_pipe_write(struct ucred *cred, struct pipepair *pp); 34552648411SRobert Watson int mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr); 34652648411SRobert Watson int mac_check_posix_sem_getvalue(struct ucred *cred,struct ksem *ksemptr); 34752648411SRobert Watson int mac_check_posix_sem_open(struct ucred *cred, struct ksem *ksemptr); 34852648411SRobert Watson int mac_check_posix_sem_post(struct ucred *cred, struct ksem *ksemptr); 34952648411SRobert Watson int mac_check_posix_sem_unlink(struct ucred *cred, struct ksem *ksemptr); 35052648411SRobert Watson int mac_check_posix_sem_wait(struct ucred *cred, struct ksem *ksemptr); 351ddcdf265SRobert Watson int mac_check_proc_debug(struct ucred *cred, struct proc *proc); 352ddcdf265SRobert Watson int mac_check_proc_sched(struct ucred *cred, struct proc *proc); 353030a28b3SRobert Watson int mac_check_proc_setuid(struct proc *proc, struct ucred *cred, 354030a28b3SRobert Watson uid_t uid); 355030a28b3SRobert Watson int mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, 356030a28b3SRobert Watson uid_t euid); 357030a28b3SRobert Watson int mac_check_proc_setgid(struct proc *proc, struct ucred *cred, 358030a28b3SRobert Watson gid_t gid); 359030a28b3SRobert Watson int mac_check_proc_setegid(struct proc *proc, struct ucred *cred, 360030a28b3SRobert Watson gid_t egid); 361030a28b3SRobert Watson int mac_check_proc_setgroups(struct proc *proc, struct ucred *cred, 362030a28b3SRobert Watson int ngroups, gid_t *gidset); 363030a28b3SRobert Watson int mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, 364030a28b3SRobert Watson uid_t ruid, uid_t euid); 365030a28b3SRobert Watson int mac_check_proc_setregid(struct proc *proc, struct ucred *cred, 366030a28b3SRobert Watson gid_t rgid, gid_t egid); 367030a28b3SRobert Watson int mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, 368030a28b3SRobert Watson uid_t ruid, uid_t euid, uid_t suid); 369030a28b3SRobert Watson int mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, 370030a28b3SRobert Watson gid_t rgid, gid_t egid, gid_t sgid); 371ddcdf265SRobert Watson int mac_check_proc_signal(struct ucred *cred, struct proc *proc, 372ddcdf265SRobert Watson int signum); 373babe9a2bSRobert Watson int mac_check_proc_wait(struct ucred *cred, struct proc *proc); 3747f53207bSRobert Watson int mac_check_socket_accept(struct ucred *cred, struct socket *so); 375ddcdf265SRobert Watson int mac_check_socket_bind(struct ucred *cred, struct socket *so, 376ddcdf265SRobert Watson struct sockaddr *sockaddr); 377ddcdf265SRobert Watson int mac_check_socket_connect(struct ucred *cred, struct socket *so, 378ddcdf265SRobert Watson struct sockaddr *sockaddr); 3796758f88eSRobert Watson int mac_check_socket_create(struct ucred *cred, int domain, int type, 3806758f88eSRobert Watson int protocol); 381fb95b5d3SRobert Watson int mac_check_socket_deliver(struct socket *so, struct mbuf *m); 382ddcdf265SRobert Watson int mac_check_socket_listen(struct ucred *cred, struct socket *so); 3837f53207bSRobert Watson int mac_check_socket_poll(struct ucred *cred, struct socket *so); 384b371c939SRobert Watson int mac_check_socket_receive(struct ucred *cred, struct socket *so); 385b371c939SRobert Watson int mac_check_socket_send(struct ucred *cred, struct socket *so); 3867f53207bSRobert Watson int mac_check_socket_stat(struct ucred *cred, struct socket *so); 387ddcdf265SRobert Watson int mac_check_socket_visible(struct ucred *cred, struct socket *so); 38892835789SRobert Watson int mac_check_sysarch_ioperm(struct ucred *cred); 389e5e820fdSRobert Watson int mac_check_system_acct(struct ucred *cred, struct vnode *vp); 390e5e820fdSRobert Watson int mac_check_system_nfsd(struct ucred *cred); 391a2ecb9b7SRobert Watson int mac_check_system_reboot(struct ucred *cred, int howto); 3924b8d5f2dSRobert Watson int mac_check_system_settime(struct ucred *cred); 39303ce2c0cSRobert Watson int mac_check_system_swapon(struct ucred *cred, struct vnode *vp); 3941b2c2ab2SRobert Watson int mac_check_system_swapoff(struct ucred *cred, struct vnode *vp); 39563dba32bSPawel Jakub Dawidek int mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp, 39663dba32bSPawel Jakub Dawidek void *arg1, int arg2, struct sysctl_req *req); 397ddcdf265SRobert Watson int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, 398b914de36SRobert Watson int acc_mode); 399ddcdf265SRobert Watson int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp); 400ddcdf265SRobert Watson int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp); 401ddcdf265SRobert Watson int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 402ddcdf265SRobert Watson struct componentname *cnp, struct vattr *vap); 403ddcdf265SRobert Watson int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 404ddcdf265SRobert Watson struct vnode *vp, struct componentname *cnp); 405ddcdf265SRobert Watson int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 406ddcdf265SRobert Watson acl_type_t type); 407c096756cSRobert Watson int mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, 408c096756cSRobert Watson int attrnamespace, const char *name); 409670cb89bSRobert Watson int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, 410670cb89bSRobert Watson struct image_params *imgp); 411ddcdf265SRobert Watson int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 412ddcdf265SRobert Watson acl_type_t type); 413ddcdf265SRobert Watson int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 414ddcdf265SRobert Watson int attrnamespace, const char *name, struct uio *uio); 4150a694196SRobert Watson int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, 4160a694196SRobert Watson struct vnode *vp, struct componentname *cnp); 417c096756cSRobert Watson int mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, 418c096756cSRobert Watson int attrnamespace); 419ddcdf265SRobert Watson int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 420ddcdf265SRobert Watson struct componentname *cnp); 421e183f80eSRobert Watson int mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 422c92163dcSChristian S.J. Peron int prot, int flags); 423e183f80eSRobert Watson int mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 424e183f80eSRobert Watson int prot); 425ddcdf265SRobert Watson int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, 426b914de36SRobert Watson int acc_mode); 427177142e4SRobert Watson int mac_check_vnode_poll(struct ucred *active_cred, 428177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 429177142e4SRobert Watson int mac_check_vnode_read(struct ucred *active_cred, 430177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 431ddcdf265SRobert Watson int mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp); 432ddcdf265SRobert Watson int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp); 433ddcdf265SRobert Watson int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 434ddcdf265SRobert Watson struct vnode *vp, struct componentname *cnp); 435ddcdf265SRobert Watson int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 436ddcdf265SRobert Watson struct vnode *vp, int samedir, struct componentname *cnp); 437ddcdf265SRobert Watson int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp); 438ddcdf265SRobert Watson int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 439ddcdf265SRobert Watson acl_type_t type, struct acl *acl); 440ddcdf265SRobert Watson int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 441ddcdf265SRobert Watson int attrnamespace, const char *name, struct uio *uio); 442ddcdf265SRobert Watson int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 443ddcdf265SRobert Watson u_long flags); 444ddcdf265SRobert Watson int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 445ddcdf265SRobert Watson mode_t mode); 446ddcdf265SRobert Watson int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 447ddcdf265SRobert Watson uid_t uid, gid_t gid); 448ddcdf265SRobert Watson int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 449ddcdf265SRobert Watson struct timespec atime, struct timespec mtime); 450177142e4SRobert Watson int mac_check_vnode_stat(struct ucred *active_cred, 451177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 452177142e4SRobert Watson int mac_check_vnode_write(struct ucred *active_cred, 453177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 4549e71dd0fSRobert Watson int mac_getsockopt_label(struct ucred *cred, struct socket *so, 455ddcdf265SRobert Watson struct mac *extmac); 4569e71dd0fSRobert Watson int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, 457ddcdf265SRobert Watson struct mac *extmac); 458ddcdf265SRobert Watson int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 459ddcdf265SRobert Watson struct ifnet *ifnet); 460ddcdf265SRobert Watson int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 461ddcdf265SRobert Watson struct ifnet *ifnet); 4629e71dd0fSRobert Watson int mac_setsockopt_label(struct ucred *cred, struct socket *so, 463ddcdf265SRobert Watson struct mac *extmac); 4644795b82cSRobert Watson int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, 465ddcdf265SRobert Watson struct label *label); 4664d10c0ceSRobert Watson void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); 467ddcdf265SRobert Watson 468ddcdf265SRobert Watson /* 469ddcdf265SRobert Watson * Calls to help various file systems implement labeling functionality 470ddcdf265SRobert Watson * using their existing EA implementation. 471ddcdf265SRobert Watson */ 472ddcdf265SRobert Watson int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); 473ddcdf265SRobert Watson 474f30a9615SRobert Watson #endif /* !_KERNEL */ 475ddcdf265SRobert Watson 47602ebd2bcSRobert Watson #endif /* !_SYS_MAC_H_ */ 477