1ddcdf265SRobert Watson /*- 29b6dd12eSRobert Watson * Copyright (c) 1999-2002, 2007-2011 Robert N. M. Watson 37f53207bSRobert Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4aed55708SRobert Watson * Copyright (c) 2005-2006 SPARTA, Inc. 5ddcdf265SRobert Watson * All rights reserved. 6ddcdf265SRobert Watson * 7ddcdf265SRobert Watson * This software was developed by Robert Watson for the TrustedBSD Project. 8ddcdf265SRobert Watson * 96201265bSRobert Watson * This software was developed for the FreeBSD Project in part by Network 106201265bSRobert Watson * Associates Laboratories, the Security Research Division of Network 116201265bSRobert Watson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 126201265bSRobert Watson * as part of the DARPA CHATS research program. 13ddcdf265SRobert Watson * 146758f88eSRobert Watson * This software was enhanced by SPARTA ISSO under SPAWAR contract 156758f88eSRobert Watson * N66001-04-C-6019 ("SEFOS"). 166758f88eSRobert Watson * 176f6174a7SRobert Watson * This software was developed at the University of Cambridge Computer 186f6174a7SRobert Watson * Laboratory with support from a grant from Google, Inc. 196f6174a7SRobert Watson * 20ddcdf265SRobert Watson * Redistribution and use in source and binary forms, with or without 21ddcdf265SRobert Watson * modification, are permitted provided that the following conditions 22ddcdf265SRobert Watson * are met: 23ddcdf265SRobert Watson * 1. Redistributions of source code must retain the above copyright 24ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer. 25ddcdf265SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 26ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer in the 27ddcdf265SRobert Watson * documentation and/or other materials provided with the distribution. 28ddcdf265SRobert Watson * 29ddcdf265SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 30ddcdf265SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31ddcdf265SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32ddcdf265SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 33ddcdf265SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34ddcdf265SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35ddcdf265SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36ddcdf265SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37ddcdf265SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38ddcdf265SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39ddcdf265SRobert Watson * SUCH DAMAGE. 40ddcdf265SRobert Watson * 41ddcdf265SRobert Watson * $FreeBSD$ 42ddcdf265SRobert Watson */ 43aed55708SRobert Watson 44ddcdf265SRobert Watson /* 45aed55708SRobert Watson * Kernel interface for Mandatory Access Control -- how kernel services 46aed55708SRobert Watson * interact with the TrustedBSD MAC Framework. 47ddcdf265SRobert Watson */ 487f53207bSRobert Watson 49646a9f80SRobert Watson #ifndef _SECURITY_MAC_MAC_FRAMEWORK_H_ 50646a9f80SRobert Watson #define _SECURITY_MAC_MAC_FRAMEWORK_H_ 51aed55708SRobert Watson 52aed55708SRobert Watson #ifndef _KERNEL 53aed55708SRobert Watson #error "no user-serviceable parts inside" 54aed55708SRobert Watson #endif 55ddcdf265SRobert Watson 5618717f69SRobert Watson struct auditinfo; 57f1e8bf6dSRobert Watson struct auditinfo_addr; 58ddcdf265SRobert Watson struct bpf_d; 5989c9c53dSPoul-Henning Kamp struct cdev; 60ddcdf265SRobert Watson struct componentname; 61ddcdf265SRobert Watson struct devfs_dirent; 62ddcdf265SRobert Watson struct ifnet; 63ddcdf265SRobert Watson struct ifreq; 64670cb89bSRobert Watson struct image_params; 65a557af22SRobert Watson struct inpcb; 664b908c8bSRobert Watson struct ip6q; 67ddcdf265SRobert Watson struct ipq; 682449b9e5SMitchell Horne struct kdb_dbbe; 6952648411SRobert Watson struct ksem; 700142affcSRobert Watson struct label; 71225bff6fSRobert Watson struct m_tag; 72aed55708SRobert Watson struct mac; 73ddcdf265SRobert Watson struct mbuf; 74ddcdf265SRobert Watson struct mount; 7542726d8aSRobert Watson struct msg; 7642726d8aSRobert Watson struct msqid_kernel; 77ddcdf265SRobert Watson struct proc; 7842726d8aSRobert Watson struct semid_kernel; 798e38aeffSJohn Baldwin struct shmfd; 8042726d8aSRobert Watson struct shmid_kernel; 81ddcdf265SRobert Watson struct sockaddr; 82ddcdf265SRobert Watson struct socket; 8363dba32bSPawel Jakub Dawidek struct sysctl_oid; 8463dba32bSPawel Jakub Dawidek struct sysctl_req; 854795b82cSRobert Watson struct pipepair; 8692dbb82aSRobert Watson struct thread; 87ddcdf265SRobert Watson struct timespec; 88ddcdf265SRobert Watson struct ucred; 89ddcdf265SRobert Watson struct vattr; 90ddcdf265SRobert Watson struct vnode; 91aed55708SRobert Watson struct vop_setlabel_args; 92ddcdf265SRobert Watson 93ddcdf265SRobert Watson #include <sys/acl.h> /* XXX acl_type_t */ 9415bc6b2bSEdward Tomasz Napierala #include <sys/types.h> /* accmode_t */ 95ddcdf265SRobert Watson 962449b9e5SMitchell Horne #include <ddb/ddb.h> /* db_expr_t */ 972449b9e5SMitchell Horne 98ddcdf265SRobert Watson /* 996683b28dSRobert Watson * Entry points to the TrustedBSD MAC Framework from the remainder of the 1006683b28dSRobert Watson * kernel: entry points are named based on a principle object type and an 1016683b28dSRobert Watson * action relating to it. They are sorted alphabetically first by object 1026683b28dSRobert Watson * type and then action. In some situations, the principle object type is 1036683b28dSRobert Watson * obvious, and in other cases, less so as multiple objects may be inolved 1046683b28dSRobert Watson * in the operation. 105ddcdf265SRobert Watson */ 106179da74eSRobert Watson int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp); 107179da74eSRobert Watson void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d); 108179da74eSRobert Watson void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m); 10930d239bcSRobert Watson void mac_bpfdesc_destroy(struct bpf_d *); 110179da74eSRobert Watson void mac_bpfdesc_init(struct bpf_d *); 111179da74eSRobert Watson 112212ab0cfSRobert Watson void mac_cred_associate_nfsd(struct ucred *cred); 1136f6174a7SRobert Watson int mac_cred_check_setaudit(struct ucred *cred, struct auditinfo *ai); 1146f6174a7SRobert Watson int mac_cred_check_setaudit_addr(struct ucred *cred, 1156f6174a7SRobert Watson struct auditinfo_addr *aia); 1166f6174a7SRobert Watson int mac_cred_check_setauid(struct ucred *cred, uid_t auid); 1176f6174a7SRobert Watson int mac_cred_check_setegid(struct ucred *cred, gid_t egid); 1186f6174a7SRobert Watson int mac_cred_check_seteuid(struct ucred *cred, uid_t euid); 1196f6174a7SRobert Watson int mac_cred_check_setgid(struct ucred *cred, gid_t gid); 1206f6174a7SRobert Watson int mac_cred_check_setgroups(struct ucred *cred, int ngroups, 1216f6174a7SRobert Watson gid_t *gidset); 1226f6174a7SRobert Watson int mac_cred_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid); 1236f6174a7SRobert Watson int mac_cred_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid, 1246f6174a7SRobert Watson gid_t sgid); 1256f6174a7SRobert Watson int mac_cred_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid, 1266f6174a7SRobert Watson uid_t suid); 1276f6174a7SRobert Watson int mac_cred_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid); 1286f6174a7SRobert Watson int mac_cred_check_setuid(struct ucred *cred, uid_t uid); 129179da74eSRobert Watson int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2); 130179da74eSRobert Watson void mac_cred_copy(struct ucred *cr1, struct ucred *cr2); 131212ab0cfSRobert Watson void mac_cred_create_init(struct ucred *cred); 132212ab0cfSRobert Watson void mac_cred_create_swapper(struct ucred *cred); 13330d239bcSRobert Watson void mac_cred_destroy(struct ucred *); 134179da74eSRobert Watson void mac_cred_init(struct ucred *); 135eca8a663SRobert Watson 1362449b9e5SMitchell Horne int mac_ddb_command_register(struct db_command_table *table, 1372449b9e5SMitchell Horne struct db_command *cmd); 1382449b9e5SMitchell Horne int mac_ddb_command_exec(struct db_command *cmd, db_expr_t addr, 1392449b9e5SMitchell Horne bool have_addr, db_expr_t count, char *modif); 1402449b9e5SMitchell Horne 14130d239bcSRobert Watson void mac_devfs_create_device(struct ucred *cred, struct mount *mp, 142d26dd2d9SRobert Watson struct cdev *dev, struct devfs_dirent *de); 14330d239bcSRobert Watson void mac_devfs_create_directory(struct mount *mp, char *dirname, 144990b4b2dSRobert Watson int dirnamelen, struct devfs_dirent *de); 14530d239bcSRobert Watson void mac_devfs_create_symlink(struct ucred *cred, struct mount *mp, 146990b4b2dSRobert Watson struct devfs_dirent *dd, struct devfs_dirent *de); 147179da74eSRobert Watson void mac_devfs_destroy(struct devfs_dirent *); 148179da74eSRobert Watson void mac_devfs_init(struct devfs_dirent *); 14930d239bcSRobert Watson void mac_devfs_update(struct mount *mp, struct devfs_dirent *de, 150990b4b2dSRobert Watson struct vnode *vp); 151179da74eSRobert Watson void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de, 152179da74eSRobert Watson struct vnode *vp); 153ddcdf265SRobert Watson 154f77697ddSMateusz Guzik int mac_ifnet_check_transmit_impl(struct ifnet *ifp, struct mbuf *m); 155f77697ddSMateusz Guzik #ifdef MAC 156f77697ddSMateusz Guzik extern bool mac_ifnet_check_transmit_fp_flag; 157f77697ddSMateusz Guzik #else 15892b5b97cSMateusz Guzik #define mac_ifnet_check_transmit_fp_flag false 159f77697ddSMateusz Guzik #endif 160f77697ddSMateusz Guzik #define mac_ifnet_check_transmit_enabled() __predict_false(mac_ifnet_check_transmit_fp_flag) 161f77697ddSMateusz Guzik static inline int 162f77697ddSMateusz Guzik mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m) 163f77697ddSMateusz Guzik { 164f77697ddSMateusz Guzik 165f77697ddSMateusz Guzik if (mac_ifnet_check_transmit_enabled()) 166f77697ddSMateusz Guzik return (mac_ifnet_check_transmit_impl(ifp, m)); 167f77697ddSMateusz Guzik return (0); 168f77697ddSMateusz Guzik } 169f77697ddSMateusz Guzik 170179da74eSRobert Watson void mac_ifnet_create(struct ifnet *ifp); 171f77697ddSMateusz Guzik 172f77697ddSMateusz Guzik void mac_ifnet_create_mbuf_impl(struct ifnet *ifp, struct mbuf *m); 173f77697ddSMateusz Guzik #ifdef MAC 174f77697ddSMateusz Guzik extern bool mac_ifnet_create_mbuf_fp_flag; 175f77697ddSMateusz Guzik #else 17692b5b97cSMateusz Guzik #define mac_ifnet_create_mbuf_fp_flag false 177f77697ddSMateusz Guzik #endif 178f77697ddSMateusz Guzik #define mac_ifnet_create_mbuf_enabled() __predict_false(mac_ifnet_create_mbuf_fp_flag) 179f77697ddSMateusz Guzik static inline void 180f77697ddSMateusz Guzik mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m) 181f77697ddSMateusz Guzik { 182f77697ddSMateusz Guzik 183f77697ddSMateusz Guzik if (mac_ifnet_create_mbuf_enabled()) 184f77697ddSMateusz Guzik mac_ifnet_create_mbuf_impl(ifp, m); 185f77697ddSMateusz Guzik } 186f77697ddSMateusz Guzik 187179da74eSRobert Watson void mac_ifnet_destroy(struct ifnet *); 188179da74eSRobert Watson void mac_ifnet_init(struct ifnet *); 189179da74eSRobert Watson int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr, 190179da74eSRobert Watson struct ifnet *ifp); 191179da74eSRobert Watson int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, 192179da74eSRobert Watson struct ifnet *ifp); 193179da74eSRobert Watson 19430d239bcSRobert Watson int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m); 19537ee7293SBjoern A. Zeeb int mac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp); 196179da74eSRobert Watson void mac_inpcb_create(struct socket *so, struct inpcb *inp); 197179da74eSRobert Watson void mac_inpcb_create_mbuf(struct inpcb *inp, struct mbuf *m); 198179da74eSRobert Watson void mac_inpcb_destroy(struct inpcb *); 199179da74eSRobert Watson int mac_inpcb_init(struct inpcb *, int); 200179da74eSRobert Watson void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp); 201179da74eSRobert Watson 2024b908c8bSRobert Watson void mac_ip6q_create(struct mbuf *m, struct ip6q *q6); 2034b908c8bSRobert Watson void mac_ip6q_destroy(struct ip6q *q6); 2044b908c8bSRobert Watson int mac_ip6q_init(struct ip6q *q6, int); 2054b908c8bSRobert Watson int mac_ip6q_match(struct mbuf *m, struct ip6q *q6); 2064b908c8bSRobert Watson void mac_ip6q_reassemble(struct ip6q *q6, struct mbuf *m); 2074b908c8bSRobert Watson void mac_ip6q_update(struct mbuf *m, struct ip6q *q6); 2084b908c8bSRobert Watson 20937f44cb4SRobert Watson void mac_ipq_create(struct mbuf *m, struct ipq *q); 21037f44cb4SRobert Watson void mac_ipq_destroy(struct ipq *q); 21137f44cb4SRobert Watson int mac_ipq_init(struct ipq *q, int); 21237f44cb4SRobert Watson int mac_ipq_match(struct mbuf *m, struct ipq *q); 21337f44cb4SRobert Watson void mac_ipq_reassemble(struct ipq *q, struct mbuf *m); 21437f44cb4SRobert Watson void mac_ipq_update(struct mbuf *m, struct ipq *q); 215179da74eSRobert Watson 2162449b9e5SMitchell Horne int mac_kdb_check_backend(struct kdb_dbbe *be); 217cab10561SMark Johnston int mac_kdb_grant_backend(struct kdb_dbbe *be); 2182449b9e5SMitchell Horne 21930d239bcSRobert Watson int mac_kenv_check_dump(struct ucred *cred); 22030d239bcSRobert Watson int mac_kenv_check_get(struct ucred *cred, char *name); 22130d239bcSRobert Watson int mac_kenv_check_set(struct ucred *cred, char *name, char *value); 22230d239bcSRobert Watson int mac_kenv_check_unset(struct ucred *cred, char *name); 223179da74eSRobert Watson 22430d239bcSRobert Watson int mac_kld_check_load(struct ucred *cred, struct vnode *vp); 22530d239bcSRobert Watson int mac_kld_check_stat(struct ucred *cred); 226179da74eSRobert Watson 227179da74eSRobert Watson void mac_mbuf_copy(struct mbuf *, struct mbuf *); 228179da74eSRobert Watson int mac_mbuf_init(struct mbuf *, int); 229179da74eSRobert Watson 230179da74eSRobert Watson void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *); 231179da74eSRobert Watson void mac_mbuf_tag_destroy(struct m_tag *); 232179da74eSRobert Watson int mac_mbuf_tag_init(struct m_tag *, int); 233179da74eSRobert Watson 23430d239bcSRobert Watson int mac_mount_check_stat(struct ucred *cred, struct mount *mp); 235179da74eSRobert Watson void mac_mount_create(struct ucred *cred, struct mount *mp); 236179da74eSRobert Watson void mac_mount_destroy(struct mount *); 237179da74eSRobert Watson void mac_mount_init(struct mount *); 238179da74eSRobert Watson 239b9b0dac3SRobert Watson void mac_netinet_arp_send(struct ifnet *ifp, struct mbuf *m); 240a13e21f7SRobert Watson void mac_netinet_firewall_reply(struct mbuf *mrecv, struct mbuf *msend); 24186407646SRobert Watson void mac_netinet_firewall_send(struct mbuf *m); 242179da74eSRobert Watson void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag); 243a13e21f7SRobert Watson void mac_netinet_icmp_reply(struct mbuf *mrecv, struct mbuf *msend); 244a13e21f7SRobert Watson void mac_netinet_icmp_replyinplace(struct mbuf *m); 245b9b0dac3SRobert Watson void mac_netinet_igmp_send(struct ifnet *ifp, struct mbuf *m); 246179da74eSRobert Watson void mac_netinet_tcp_reply(struct mbuf *m); 247179da74eSRobert Watson 248b9b0dac3SRobert Watson void mac_netinet6_nd6_send(struct ifnet *ifp, struct mbuf *m); 249b9b0dac3SRobert Watson 25030d239bcSRobert Watson int mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 251ddcdf265SRobert Watson unsigned long cmd, void *data); 25289744405SMateusz Guzik int mac_pipe_check_poll_impl(struct ucred *cred, struct pipepair *pp); 25389744405SMateusz Guzik #ifdef MAC 25489744405SMateusz Guzik extern bool mac_pipe_check_poll_fp_flag; 25589744405SMateusz Guzik #else 25692b5b97cSMateusz Guzik #define mac_pipe_check_poll_fp_flag false 25789744405SMateusz Guzik #endif 25889744405SMateusz Guzik #define mac_pipe_check_poll_enabled() __predict_false(mac_pipe_check_poll_fp_flag) 25989744405SMateusz Guzik static inline int 26089744405SMateusz Guzik mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp) 26189744405SMateusz Guzik { 26289744405SMateusz Guzik 26389744405SMateusz Guzik if (mac_pipe_check_poll_enabled()) 26489744405SMateusz Guzik return (mac_pipe_check_poll_impl(cred, pp)); 26589744405SMateusz Guzik return (0); 26689744405SMateusz Guzik } 26789744405SMateusz Guzik 26889744405SMateusz Guzik #ifdef MAC 26989744405SMateusz Guzik extern bool mac_pipe_check_stat_fp_flag; 27089744405SMateusz Guzik #else 27192b5b97cSMateusz Guzik #define mac_pipe_check_stat_fp_flag false 27289744405SMateusz Guzik #endif 27389744405SMateusz Guzik #define mac_pipe_check_stat_enabled() __predict_false(mac_pipe_check_stat_fp_flag) 27430d239bcSRobert Watson int mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp); 27560dae3b8SMateusz Guzik int mac_pipe_check_read_impl(struct ucred *cred, struct pipepair *pp); 27660dae3b8SMateusz Guzik #ifdef MAC 27760dae3b8SMateusz Guzik extern bool mac_pipe_check_read_fp_flag; 27860dae3b8SMateusz Guzik #else 27960dae3b8SMateusz Guzik #define mac_pipe_check_read_fp_flag false 28060dae3b8SMateusz Guzik #endif 28160dae3b8SMateusz Guzik #define mac_pipe_check_read_enabled() __predict_false(mac_pipe_check_read_fp_flag) 28260dae3b8SMateusz Guzik static inline int 28360dae3b8SMateusz Guzik mac_pipe_check_read(struct ucred *cred, struct pipepair *pp) 28460dae3b8SMateusz Guzik { 28560dae3b8SMateusz Guzik 28660dae3b8SMateusz Guzik if (mac_pipe_check_read_enabled()) 28760dae3b8SMateusz Guzik return (mac_pipe_check_read_impl(cred, pp)); 28860dae3b8SMateusz Guzik return (0); 28960dae3b8SMateusz Guzik } 29060dae3b8SMateusz Guzik 29130d239bcSRobert Watson int mac_pipe_check_write(struct ucred *cred, struct pipepair *pp); 292179da74eSRobert Watson void mac_pipe_create(struct ucred *cred, struct pipepair *pp); 293179da74eSRobert Watson void mac_pipe_destroy(struct pipepair *); 294179da74eSRobert Watson void mac_pipe_init(struct pipepair *); 295179da74eSRobert Watson int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, 296179da74eSRobert Watson struct label *label); 297179da74eSRobert Watson 2986bc1e9cdSJohn Baldwin int mac_posixsem_check_getvalue(struct ucred *active_cred, 2996bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks); 30030d239bcSRobert Watson int mac_posixsem_check_open(struct ucred *cred, struct ksem *ks); 3016bc1e9cdSJohn Baldwin int mac_posixsem_check_post(struct ucred *active_cred, 3026bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks); 3039c00bb91SKonstantin Belousov int mac_posixsem_check_setmode(struct ucred *cred, struct ksem *ks, 3049c00bb91SKonstantin Belousov mode_t mode); 3059c00bb91SKonstantin Belousov int mac_posixsem_check_setowner(struct ucred *cred, struct ksem *ks, 3069c00bb91SKonstantin Belousov uid_t uid, gid_t gid); 3076bc1e9cdSJohn Baldwin int mac_posixsem_check_stat(struct ucred *active_cred, 3086bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks); 30930d239bcSRobert Watson int mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks); 3106bc1e9cdSJohn Baldwin int mac_posixsem_check_wait(struct ucred *active_cred, 3116bc1e9cdSJohn Baldwin struct ucred *file_cred, struct ksem *ks); 312179da74eSRobert Watson void mac_posixsem_create(struct ucred *cred, struct ksem *ks); 313179da74eSRobert Watson void mac_posixsem_destroy(struct ksem *); 314179da74eSRobert Watson void mac_posixsem_init(struct ksem *); 315179da74eSRobert Watson 3169b6dd12eSRobert Watson int mac_posixshm_check_create(struct ucred *cred, const char *path); 3178e38aeffSJohn Baldwin int mac_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd, 3188e38aeffSJohn Baldwin int prot, int flags); 3199b6dd12eSRobert Watson int mac_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd, 3209b6dd12eSRobert Watson accmode_t accmode); 321940cb0e2SKonstantin Belousov int mac_posixshm_check_read(struct ucred *active_cred, 322940cb0e2SKonstantin Belousov struct ucred *file_cred, struct shmfd *shmfd); 3239c00bb91SKonstantin Belousov int mac_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd, 3249c00bb91SKonstantin Belousov mode_t mode); 3259c00bb91SKonstantin Belousov int mac_posixshm_check_setowner(struct ucred *cred, struct shmfd *shmfd, 3269c00bb91SKonstantin Belousov uid_t uid, gid_t gid); 3278e38aeffSJohn Baldwin int mac_posixshm_check_stat(struct ucred *active_cred, 3288e38aeffSJohn Baldwin struct ucred *file_cred, struct shmfd *shmfd); 3298e38aeffSJohn Baldwin int mac_posixshm_check_truncate(struct ucred *active_cred, 3308e38aeffSJohn Baldwin struct ucred *file_cred, struct shmfd *shmfd); 3318e38aeffSJohn Baldwin int mac_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd); 332940cb0e2SKonstantin Belousov int mac_posixshm_check_write(struct ucred *active_cred, 333940cb0e2SKonstantin Belousov struct ucred *file_cred, struct shmfd *shmfd); 3348e38aeffSJohn Baldwin void mac_posixshm_create(struct ucred *cred, struct shmfd *shmfd); 3358e38aeffSJohn Baldwin void mac_posixshm_destroy(struct shmfd *); 3368e38aeffSJohn Baldwin void mac_posixshm_init(struct shmfd *); 3378e38aeffSJohn Baldwin 33891061084SMateusz Guzik int mac_priv_check_impl(struct ucred *cred, int priv); 3395b0acaf7SMateusz Guzik #ifdef MAC 34091061084SMateusz Guzik extern bool mac_priv_check_fp_flag; 3415b0acaf7SMateusz Guzik #else 34292b5b97cSMateusz Guzik #define mac_priv_check_fp_flag false 3435b0acaf7SMateusz Guzik #endif 3444ec34a90SMateusz Guzik #define mac_priv_check_enabled() __predict_false(mac_priv_check_fp_flag) 34591061084SMateusz Guzik static inline int 34691061084SMateusz Guzik mac_priv_check(struct ucred *cred, int priv) 34791061084SMateusz Guzik { 34891061084SMateusz Guzik 3494ec34a90SMateusz Guzik if (mac_priv_check_enabled()) 35091061084SMateusz Guzik return (mac_priv_check_impl(cred, priv)); 35191061084SMateusz Guzik return (0); 35291061084SMateusz Guzik } 35391061084SMateusz Guzik 35491061084SMateusz Guzik int mac_priv_grant_impl(struct ucred *cred, int priv); 3555b0acaf7SMateusz Guzik #ifdef MAC 35691061084SMateusz Guzik extern bool mac_priv_grant_fp_flag; 3575b0acaf7SMateusz Guzik #else 35892b5b97cSMateusz Guzik #define mac_priv_grant_fp_flag false 3595b0acaf7SMateusz Guzik #endif 3604ec34a90SMateusz Guzik #define mac_priv_grant_enabled() __predict_false(mac_priv_grant_fp_flag) 36191061084SMateusz Guzik static inline int 36291061084SMateusz Guzik mac_priv_grant(struct ucred *cred, int priv) 36391061084SMateusz Guzik { 36491061084SMateusz Guzik 3654ec34a90SMateusz Guzik if (mac_priv_grant_enabled()) 36691061084SMateusz Guzik return (mac_priv_grant_impl(cred, priv)); 36791061084SMateusz Guzik return (EPERM); 36891061084SMateusz Guzik } 369179da74eSRobert Watson 37030d239bcSRobert Watson int mac_proc_check_debug(struct ucred *cred, struct proc *p); 37130d239bcSRobert Watson int mac_proc_check_sched(struct ucred *cred, struct proc *p); 37230d239bcSRobert Watson int mac_proc_check_signal(struct ucred *cred, struct proc *p, 373ddcdf265SRobert Watson int signum); 37430d239bcSRobert Watson int mac_proc_check_wait(struct ucred *cred, struct proc *p); 375179da74eSRobert Watson void mac_proc_destroy(struct proc *); 3766356dba0SRobert Watson void mac_proc_init(struct proc *); 3779215889dSRobert Watson void mac_proc_vm_revoke(struct thread *td); 378179da74eSRobert Watson int mac_execve_enter(struct image_params *imgp, struct mac *mac_p); 379179da74eSRobert Watson void mac_execve_exit(struct image_params *imgp); 3806356dba0SRobert Watson void mac_execve_interpreter_enter(struct vnode *interpvp, 3816356dba0SRobert Watson struct label **interplabel); 3826356dba0SRobert Watson void mac_execve_interpreter_exit(struct label *interpvplabel); 383179da74eSRobert Watson 38430d239bcSRobert Watson int mac_socket_check_accept(struct ucred *cred, struct socket *so); 38530d239bcSRobert Watson int mac_socket_check_bind(struct ucred *cred, struct socket *so, 38626ae2b86SRobert Watson struct sockaddr *sa); 38730d239bcSRobert Watson int mac_socket_check_connect(struct ucred *cred, struct socket *so, 38826ae2b86SRobert Watson struct sockaddr *sa); 38930d239bcSRobert Watson int mac_socket_check_create(struct ucred *cred, int domain, int type, 39026ae2b86SRobert Watson int proto); 39130d239bcSRobert Watson int mac_socket_check_deliver(struct socket *so, struct mbuf *m); 39230d239bcSRobert Watson int mac_socket_check_listen(struct ucred *cred, struct socket *so); 39330d239bcSRobert Watson int mac_socket_check_poll(struct ucred *cred, struct socket *so); 39430d239bcSRobert Watson int mac_socket_check_receive(struct ucred *cred, struct socket *so); 39530d239bcSRobert Watson int mac_socket_check_send(struct ucred *cred, struct socket *so); 39630d239bcSRobert Watson int mac_socket_check_stat(struct ucred *cred, struct socket *so); 39730d239bcSRobert Watson int mac_socket_check_visible(struct ucred *cred, struct socket *so); 398179da74eSRobert Watson void mac_socket_create_mbuf(struct socket *so, struct mbuf *m); 399179da74eSRobert Watson void mac_socket_create(struct ucred *cred, struct socket *so); 400179da74eSRobert Watson void mac_socket_destroy(struct socket *); 401179da74eSRobert Watson int mac_socket_init(struct socket *, int); 402179da74eSRobert Watson void mac_socket_newconn(struct socket *oldso, struct socket *newso); 403179da74eSRobert Watson int mac_getsockopt_label(struct ucred *cred, struct socket *so, 404179da74eSRobert Watson struct mac *extmac); 405179da74eSRobert Watson int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, 406179da74eSRobert Watson struct mac *extmac); 407179da74eSRobert Watson int mac_setsockopt_label(struct ucred *cred, struct socket *so, 408179da74eSRobert Watson struct mac *extmac); 409179da74eSRobert Watson 410179da74eSRobert Watson void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so); 411179da74eSRobert Watson void mac_socketpeer_set_from_socket(struct socket *oldso, 412179da74eSRobert Watson struct socket *newso); 413179da74eSRobert Watson 414179da74eSRobert Watson void mac_syncache_create(struct label *l, struct inpcb *inp); 415179da74eSRobert Watson void mac_syncache_create_mbuf(struct label *l, struct mbuf *m); 416179da74eSRobert Watson void mac_syncache_destroy(struct label **l); 417179da74eSRobert Watson int mac_syncache_init(struct label **l); 418179da74eSRobert Watson 41930d239bcSRobert Watson int mac_system_check_acct(struct ucred *cred, struct vnode *vp); 42030d239bcSRobert Watson int mac_system_check_audit(struct ucred *cred, void *record, int length); 42130d239bcSRobert Watson int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp); 42230d239bcSRobert Watson int mac_system_check_auditon(struct ucred *cred, int cmd); 42330d239bcSRobert Watson int mac_system_check_reboot(struct ucred *cred, int howto); 42430d239bcSRobert Watson int mac_system_check_swapon(struct ucred *cred, struct vnode *vp); 42530d239bcSRobert Watson int mac_system_check_swapoff(struct ucred *cred, struct vnode *vp); 42630d239bcSRobert Watson int mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, 42763dba32bSPawel Jakub Dawidek void *arg1, int arg2, struct sysctl_req *req); 428179da74eSRobert Watson 429179da74eSRobert Watson void mac_sysvmsg_cleanup(struct msg *msgptr); 430179da74eSRobert Watson void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, 431179da74eSRobert Watson struct msg *msgptr); 432179da74eSRobert Watson void mac_sysvmsg_destroy(struct msg *); 433179da74eSRobert Watson void mac_sysvmsg_init(struct msg *); 434179da74eSRobert Watson 435179da74eSRobert Watson int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, 436179da74eSRobert Watson struct msqid_kernel *msqkptr); 437179da74eSRobert Watson int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr); 438179da74eSRobert Watson int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr); 439179da74eSRobert Watson int mac_sysvmsq_check_msqctl(struct ucred *cred, 440179da74eSRobert Watson struct msqid_kernel *msqkptr, int cmd); 441179da74eSRobert Watson int mac_sysvmsq_check_msqget(struct ucred *cred, 442179da74eSRobert Watson struct msqid_kernel *msqkptr); 443179da74eSRobert Watson int mac_sysvmsq_check_msqrcv(struct ucred *cred, 444179da74eSRobert Watson struct msqid_kernel *msqkptr); 445179da74eSRobert Watson int mac_sysvmsq_check_msqsnd(struct ucred *cred, 446179da74eSRobert Watson struct msqid_kernel *msqkptr); 447179da74eSRobert Watson void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr); 448179da74eSRobert Watson void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr); 449179da74eSRobert Watson void mac_sysvmsq_destroy(struct msqid_kernel *); 450179da74eSRobert Watson void mac_sysvmsq_init(struct msqid_kernel *); 451179da74eSRobert Watson 452179da74eSRobert Watson int mac_sysvsem_check_semctl(struct ucred *cred, 453179da74eSRobert Watson struct semid_kernel *semakptr, int cmd); 454179da74eSRobert Watson int mac_sysvsem_check_semget(struct ucred *cred, 455179da74eSRobert Watson struct semid_kernel *semakptr); 456179da74eSRobert Watson int mac_sysvsem_check_semop(struct ucred *cred, 457179da74eSRobert Watson struct semid_kernel *semakptr, size_t accesstype); 458179da74eSRobert Watson void mac_sysvsem_cleanup(struct semid_kernel *semakptr); 459179da74eSRobert Watson void mac_sysvsem_create(struct ucred *cred, 460179da74eSRobert Watson struct semid_kernel *semakptr); 461179da74eSRobert Watson void mac_sysvsem_destroy(struct semid_kernel *); 462179da74eSRobert Watson void mac_sysvsem_init(struct semid_kernel *); 463179da74eSRobert Watson 464179da74eSRobert Watson int mac_sysvshm_check_shmat(struct ucred *cred, 465179da74eSRobert Watson struct shmid_kernel *shmsegptr, int shmflg); 466179da74eSRobert Watson int mac_sysvshm_check_shmctl(struct ucred *cred, 467179da74eSRobert Watson struct shmid_kernel *shmsegptr, int cmd); 468179da74eSRobert Watson int mac_sysvshm_check_shmdt(struct ucred *cred, 469179da74eSRobert Watson struct shmid_kernel *shmsegptr); 470179da74eSRobert Watson int mac_sysvshm_check_shmget(struct ucred *cred, 471179da74eSRobert Watson struct shmid_kernel *shmsegptr, int shmflg); 472179da74eSRobert Watson void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr); 473179da74eSRobert Watson void mac_sysvshm_create(struct ucred *cred, 474179da74eSRobert Watson struct shmid_kernel *shmsegptr); 475179da74eSRobert Watson void mac_sysvshm_destroy(struct shmid_kernel *); 476179da74eSRobert Watson void mac_sysvshm_init(struct shmid_kernel *); 477179da74eSRobert Watson 478179da74eSRobert Watson void mac_thread_userret(struct thread *td); 479179da74eSRobert Watson 480137d26e8SAndriy Gapon #if defined(MAC) && defined(DEBUG_VFS_LOCKS) 4816ebab6baSMateusz Guzik void mac_vnode_assert_locked(struct vnode *vp, const char *func); 4826ebab6baSMateusz Guzik #else 4836ebab6baSMateusz Guzik #define mac_vnode_assert_locked(vp, func) do { } while (0) 4846ebab6baSMateusz Guzik #endif 4856ebab6baSMateusz Guzik 486179da74eSRobert Watson int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp); 487179da74eSRobert Watson void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp); 48818f67bc4SMateusz Guzik int mac_vnode_check_access_impl(struct ucred *cred, struct vnode *dvp, 48915bc6b2bSEdward Tomasz Napierala accmode_t accmode); 49018f67bc4SMateusz Guzik extern bool mac_vnode_check_access_fp_flag; 49118f67bc4SMateusz Guzik #define mac_vnode_check_access_enabled() __predict_false(mac_vnode_check_access_fp_flag) 49218f67bc4SMateusz Guzik static inline int 49318f67bc4SMateusz Guzik mac_vnode_check_access(struct ucred *cred, struct vnode *dvp, 49418f67bc4SMateusz Guzik accmode_t accmode) 49518f67bc4SMateusz Guzik { 49618f67bc4SMateusz Guzik 49718f67bc4SMateusz Guzik mac_vnode_assert_locked(dvp, "mac_vnode_check_access"); 49818f67bc4SMateusz Guzik if (mac_vnode_check_access_enabled()) 49918f67bc4SMateusz Guzik return (mac_vnode_check_access_impl(cred, dvp, accmode)); 50018f67bc4SMateusz Guzik return (0); 50118f67bc4SMateusz Guzik } 50230d239bcSRobert Watson int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp); 50330d239bcSRobert Watson int mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp); 50430d239bcSRobert Watson int mac_vnode_check_create(struct ucred *cred, struct vnode *dvp, 505ddcdf265SRobert Watson struct componentname *cnp, struct vattr *vap); 50630d239bcSRobert Watson int mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, 507ddcdf265SRobert Watson acl_type_t type); 50830d239bcSRobert Watson int mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, 509c096756cSRobert Watson int attrnamespace, const char *name); 51030d239bcSRobert Watson int mac_vnode_check_exec(struct ucred *cred, struct vnode *vp, 511670cb89bSRobert Watson struct image_params *imgp); 51230d239bcSRobert Watson int mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp, 513ddcdf265SRobert Watson acl_type_t type); 51430d239bcSRobert Watson int mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, 515fefd0ac8SRobert Watson int attrnamespace, const char *name); 51630d239bcSRobert Watson int mac_vnode_check_link(struct ucred *cred, struct vnode *dvp, 5170a694196SRobert Watson struct vnode *vp, struct componentname *cnp); 51830d239bcSRobert Watson int mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, 519c096756cSRobert Watson int attrnamespace); 5206ebab6baSMateusz Guzik 5216ebab6baSMateusz Guzik int mac_vnode_check_lookup_impl(struct ucred *cred, struct vnode *dvp, 522ddcdf265SRobert Watson struct componentname *cnp); 5234ec34a90SMateusz Guzik #ifdef MAC 5246ebab6baSMateusz Guzik extern bool mac_vnode_check_lookup_fp_flag; 5254ec34a90SMateusz Guzik #else 52692b5b97cSMateusz Guzik #define mac_vnode_check_lookup_fp_flag false 5274ec34a90SMateusz Guzik #endif 52807d2145aSMateusz Guzik #define mac_vnode_check_lookup_enabled() __predict_false(mac_vnode_check_lookup_fp_flag) 5296ebab6baSMateusz Guzik static inline int 5306ebab6baSMateusz Guzik mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, 5316ebab6baSMateusz Guzik struct componentname *cnp) 5326ebab6baSMateusz Guzik { 5336ebab6baSMateusz Guzik 5346ebab6baSMateusz Guzik mac_vnode_assert_locked(dvp, "mac_vnode_check_lookup"); 53507d2145aSMateusz Guzik if (mac_vnode_check_lookup_enabled()) 5366ebab6baSMateusz Guzik return (mac_vnode_check_lookup_impl(cred, dvp, cnp)); 5376ebab6baSMateusz Guzik return (0); 5386ebab6baSMateusz Guzik } 5396ebab6baSMateusz Guzik 5406ebab6baSMateusz Guzik int mac_vnode_check_mmap_impl(struct ucred *cred, struct vnode *vp, int prot, 54126ae2b86SRobert Watson int flags); 5424ec34a90SMateusz Guzik #ifdef MAC 5436ebab6baSMateusz Guzik extern bool mac_vnode_check_mmap_fp_flag; 5444ec34a90SMateusz Guzik #else 54592b5b97cSMateusz Guzik #define mac_vnode_check_mmap_fp_flag false 5464ec34a90SMateusz Guzik #endif 5474ec34a90SMateusz Guzik #define mac_vnode_check_mmap_enabled() __predict_false(mac_vnode_check_mmap_fp_flag) 5486ebab6baSMateusz Guzik static inline int 5496ebab6baSMateusz Guzik mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot, 5506ebab6baSMateusz Guzik int flags) 5516ebab6baSMateusz Guzik { 5526ebab6baSMateusz Guzik 5536ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_mmap"); 5544ec34a90SMateusz Guzik if (mac_vnode_check_mmap_enabled()) 5556ebab6baSMateusz Guzik return (mac_vnode_check_mmap_impl(cred, vp, prot, flags)); 5566ebab6baSMateusz Guzik return (0); 5576ebab6baSMateusz Guzik } 5586ebab6baSMateusz Guzik 5596ebab6baSMateusz Guzik int mac_vnode_check_open_impl(struct ucred *cred, struct vnode *vp, 5606ebab6baSMateusz Guzik accmode_t accmode); 5614ec34a90SMateusz Guzik #ifdef MAC 5626ebab6baSMateusz Guzik extern bool mac_vnode_check_open_fp_flag; 5634ec34a90SMateusz Guzik #else 56492b5b97cSMateusz Guzik #define mac_vnode_check_open_fp_flag false 5654ec34a90SMateusz Guzik #endif 5664ec34a90SMateusz Guzik #define mac_vnode_check_open_enabled() __predict_false(mac_vnode_check_open_fp_flag) 5676ebab6baSMateusz Guzik static inline int 5686ebab6baSMateusz Guzik mac_vnode_check_open(struct ucred *cred, struct vnode *vp, 5696ebab6baSMateusz Guzik accmode_t accmode) 5706ebab6baSMateusz Guzik { 5716ebab6baSMateusz Guzik 5726ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_open"); 5734ec34a90SMateusz Guzik if (mac_vnode_check_open_enabled()) 5746ebab6baSMateusz Guzik return (mac_vnode_check_open_impl(cred, vp, accmode)); 5756ebab6baSMateusz Guzik return (0); 5766ebab6baSMateusz Guzik } 5776ebab6baSMateusz Guzik 57830d239bcSRobert Watson int mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, 579e183f80eSRobert Watson int prot); 5803ea3fbe6SMateusz Guzik 5813ea3fbe6SMateusz Guzik #define mac_vnode_check_poll_enabled() __predict_false(mac_vnode_check_poll_fp_flag) 582ab06a305SMateusz Guzik #ifdef MAC 5833ea3fbe6SMateusz Guzik extern bool mac_vnode_check_poll_fp_flag; 58430d239bcSRobert Watson int mac_vnode_check_poll(struct ucred *active_cred, 585177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 586ab06a305SMateusz Guzik #else 58792b5b97cSMateusz Guzik #define mac_vnode_check_poll_fp_flag false 588ab06a305SMateusz Guzik static inline int 589ab06a305SMateusz Guzik mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, 590ab06a305SMateusz Guzik struct vnode *vp) 591ab06a305SMateusz Guzik { 592ab06a305SMateusz Guzik 593ab06a305SMateusz Guzik return (0); 594ab06a305SMateusz Guzik } 595ab06a305SMateusz Guzik #endif 59630d239bcSRobert Watson int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp); 59777589de8SMateusz Guzik int mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *dvp); 59877589de8SMateusz Guzik #ifdef MAC 59977589de8SMateusz Guzik extern bool mac_vnode_check_readlink_fp_flag; 60077589de8SMateusz Guzik #else 60192b5b97cSMateusz Guzik #define mac_vnode_check_readlink_fp_flag false 60277589de8SMateusz Guzik #endif 60377589de8SMateusz Guzik #define mac_vnode_check_readlink_enabled() __predict_false(mac_vnode_check_readlink_fp_flag) 60477589de8SMateusz Guzik static inline int 60577589de8SMateusz Guzik mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp) 60677589de8SMateusz Guzik { 60777589de8SMateusz Guzik 60877589de8SMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_readlink"); 60977589de8SMateusz Guzik if (mac_vnode_check_readlink_enabled()) 61077589de8SMateusz Guzik return (mac_vnode_check_readlink_impl(cred, vp)); 61177589de8SMateusz Guzik return (0); 61277589de8SMateusz Guzik } 613fad6dd77SMateusz Guzik #define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag) 614fad6dd77SMateusz Guzik #ifdef MAC 615fad6dd77SMateusz Guzik extern bool mac_vnode_check_rename_from_fp_flag; 616fad6dd77SMateusz Guzik #endif 61730d239bcSRobert Watson int mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, 618ddcdf265SRobert Watson struct vnode *vp, struct componentname *cnp); 61930d239bcSRobert Watson int mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, 620ddcdf265SRobert Watson struct vnode *vp, int samedir, struct componentname *cnp); 62130d239bcSRobert Watson int mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp); 62230d239bcSRobert Watson int mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp, 623ddcdf265SRobert Watson acl_type_t type, struct acl *acl); 62430d239bcSRobert Watson int mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, 625fefd0ac8SRobert Watson int attrnamespace, const char *name); 62630d239bcSRobert Watson int mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp, 627ddcdf265SRobert Watson u_long flags); 62830d239bcSRobert Watson int mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp, 629ddcdf265SRobert Watson mode_t mode); 63030d239bcSRobert Watson int mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp, 631ddcdf265SRobert Watson uid_t uid, gid_t gid); 63230d239bcSRobert Watson int mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, 633ddcdf265SRobert Watson struct timespec atime, struct timespec mtime); 6346ebab6baSMateusz Guzik 6356ebab6baSMateusz Guzik int mac_vnode_check_stat_impl(struct ucred *active_cred, 636177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp); 6374ec34a90SMateusz Guzik #ifdef MAC 6386ebab6baSMateusz Guzik extern bool mac_vnode_check_stat_fp_flag; 6394ec34a90SMateusz Guzik #else 64092b5b97cSMateusz Guzik #define mac_vnode_check_stat_fp_flag false 6414ec34a90SMateusz Guzik #endif 6424ec34a90SMateusz Guzik #define mac_vnode_check_stat_enabled() __predict_false(mac_vnode_check_stat_fp_flag) 6436ebab6baSMateusz Guzik static inline int 6446ebab6baSMateusz Guzik mac_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, 6456ebab6baSMateusz Guzik struct vnode *vp) 6466ebab6baSMateusz Guzik { 6476ebab6baSMateusz Guzik 6486ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_stat"); 6494ec34a90SMateusz Guzik if (mac_vnode_check_stat_enabled()) 6506ebab6baSMateusz Guzik return (mac_vnode_check_stat_impl(active_cred, file_cred, vp)); 6516ebab6baSMateusz Guzik return (0); 6526ebab6baSMateusz Guzik } 6536ebab6baSMateusz Guzik 6546ebab6baSMateusz Guzik int mac_vnode_check_read_impl(struct ucred *active_cred, 6556ebab6baSMateusz Guzik struct ucred *file_cred, struct vnode *vp); 6564ec34a90SMateusz Guzik #ifdef MAC 6576ebab6baSMateusz Guzik extern bool mac_vnode_check_read_fp_flag; 6584ec34a90SMateusz Guzik #else 65992b5b97cSMateusz Guzik #define mac_vnode_check_read_fp_flag false 6604ec34a90SMateusz Guzik #endif 6614ec34a90SMateusz Guzik #define mac_vnode_check_read_enabled() __predict_false(mac_vnode_check_read_fp_flag) 6626ebab6baSMateusz Guzik static inline int 6636ebab6baSMateusz Guzik mac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, 6646ebab6baSMateusz Guzik struct vnode *vp) 6656ebab6baSMateusz Guzik { 6666ebab6baSMateusz Guzik 6676ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_read"); 6684ec34a90SMateusz Guzik if (mac_vnode_check_read_enabled()) 6696ebab6baSMateusz Guzik return (mac_vnode_check_read_impl(active_cred, file_cred, vp)); 6706ebab6baSMateusz Guzik return (0); 6716ebab6baSMateusz Guzik } 6726ebab6baSMateusz Guzik 6736ebab6baSMateusz Guzik int mac_vnode_check_write_impl(struct ucred *active_cred, 6746ebab6baSMateusz Guzik struct ucred *file_cred, struct vnode *vp); 6754ec34a90SMateusz Guzik #ifdef MAC 6766ebab6baSMateusz Guzik extern bool mac_vnode_check_write_fp_flag; 6774ec34a90SMateusz Guzik #else 67892b5b97cSMateusz Guzik #define mac_vnode_check_write_fp_flag false 6794ec34a90SMateusz Guzik #endif 6804ec34a90SMateusz Guzik #define mac_vnode_check_write_enabled() __predict_false(mac_vnode_check_write_fp_flag) 6816ebab6baSMateusz Guzik static inline int 6826ebab6baSMateusz Guzik mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, 6836ebab6baSMateusz Guzik struct vnode *vp) 6846ebab6baSMateusz Guzik { 6856ebab6baSMateusz Guzik 6866ebab6baSMateusz Guzik mac_vnode_assert_locked(vp, "mac_vnode_check_write"); 6874ec34a90SMateusz Guzik if (mac_vnode_check_write_enabled()) 6886ebab6baSMateusz Guzik return (mac_vnode_check_write_impl(active_cred, file_cred, vp)); 6896ebab6baSMateusz Guzik return (0); 6906ebab6baSMateusz Guzik } 6916ebab6baSMateusz Guzik 69230d239bcSRobert Watson int mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, 69345e0f3d6SRobert Watson struct vnode *vp, struct componentname *cnp); 694179da74eSRobert Watson void mac_vnode_copy_label(struct label *, struct label *); 695179da74eSRobert Watson void mac_vnode_init(struct vnode *); 696179da74eSRobert Watson int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp, 697179da74eSRobert Watson struct vnode *dvp, struct vnode *vp, struct componentname *cnp); 698179da74eSRobert Watson void mac_vnode_destroy(struct vnode *); 699179da74eSRobert Watson void mac_vnode_execve_transition(struct ucred *oldcred, 700179da74eSRobert Watson struct ucred *newcred, struct vnode *vp, 701179da74eSRobert Watson struct label *interpvplabel, struct image_params *imgp); 702179da74eSRobert Watson int mac_vnode_execve_will_transition(struct ucred *cred, 703179da74eSRobert Watson struct vnode *vp, struct label *interpvplabel, 704179da74eSRobert Watson struct image_params *imgp); 705179da74eSRobert Watson void mac_vnode_relabel(struct ucred *cred, struct vnode *vp, 706179da74eSRobert Watson struct label *newlabel); 707179da74eSRobert Watson 708ddcdf265SRobert Watson /* 7099caab7a2SRobert Watson * Calls to help various file systems implement labeling functionality using 7109caab7a2SRobert Watson * their existing EA implementation. 711ddcdf265SRobert Watson */ 712ddcdf265SRobert Watson int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); 713ddcdf265SRobert Watson 714646a9f80SRobert Watson #endif /* !_SECURITY_MAC_MAC_FRAMEWORK_H_ */ 715