1 /*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by Network
9 * Associates Laboratories, the Security Research Division of Network
10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
11 * as part of the DARPA CHATS research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $FreeBSD: releng/5.0/sys/security/mac_bsdextended/mac_bsdextended.c 108481 2002-12-31 05:21:33Z rwatson $
35 */
36 /*
37 * Developed by the TrustedBSD Project.
38 * "BSD Extended" MAC policy, allowing the administrator to impose
39 * mandatory rules regarding users and some system objects.
40 *
41 * XXX: Much locking support required here.
42 */
43
44 #include <sys/types.h>
45 #include <sys/param.h>
46 #include <sys/acl.h>
47 #include <sys/conf.h>
48 #include <sys/kernel.h>
49 #include <sys/mac.h>
50 #include <sys/malloc.h>
51 #include <sys/mount.h>
52 #include <sys/proc.h>
53 #include <sys/systm.h>
54 #include <sys/sysproto.h>
55 #include <sys/sysent.h>
56 #include <sys/vnode.h>
57 #include <sys/file.h>
58 #include <sys/socket.h>
59 #include <sys/socketvar.h>
60 #include <sys/sysctl.h>
61
62 #include <net/bpfdesc.h>
63 #include <net/if.h>
64 #include <net/if_types.h>
65 #include <net/if_var.h>
66
67 #include <vm/vm.h>
68
69 #include <sys/mac_policy.h>
70
71 #include <security/mac_bsdextended/mac_bsdextended.h>
72
73 SYSCTL_DECL(_security_mac);
74
75 SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
76 "TrustedBSD extended BSD MAC policy controls");
77
78 static int mac_bsdextended_enabled = 1;
79 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
80 &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
81 TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
82
83 MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
84
85 #define MAC_BSDEXTENDED_MAXRULES 250
86 static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
87 static int rule_count = 0;
88 static int rule_slots = 0;
89
90 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
91 &rule_count, 0, "Number of defined rules\n");
92 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
93 &rule_slots, 0, "Number of used rule slots\n");
94
95 static int mac_bsdextended_debugging;
96 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, debugging, CTLFLAG_RW,
97 &mac_bsdextended_debugging, 0, "Enable debugging on failure");
98
99 static int
100 mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
101 {
102
103 if ((rule->mbr_subject.mbi_flags | MBI_BITS) != MBI_BITS)
104 return (EINVAL);
105
106 if ((rule->mbr_object.mbi_flags | MBI_BITS) != MBI_BITS)
107 return (EINVAL);
108
109 if ((rule->mbr_mode | VALLPERM) != VALLPERM)
110 return (EINVAL);
111
112 return (0);
113 }
114
115 static int
116 sysctl_rule(SYSCTL_HANDLER_ARGS)
117 {
118 struct mac_bsdextended_rule temprule, *ruleptr;
119 u_int namelen;
120 int error, index, *name;
121
122 name = (int *)arg1;
123 namelen = arg2;
124
125 /* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */
126
127 if (namelen != 1)
128 return (EINVAL);
129
130 index = name[0];
131 if (index < 0 || index > rule_slots + 1)
132 return (ENOENT);
133 if (rule_slots >= MAC_BSDEXTENDED_MAXRULES)
134 return (ENOENT);
135
136 if (req->oldptr) {
137 if (rules[index] == NULL)
138 return (ENOENT);
139
140 error = SYSCTL_OUT(req, rules[index], sizeof(*rules[index]));
141 if (error)
142 return (error);
143 }
144
145 if (req->newptr) {
146 if (req->newlen == 0) {
147 /* printf("deletion\n"); */
148 ruleptr = rules[index];
149 if (ruleptr == NULL)
150 return (ENOENT);
151 rule_count--;
152 rules[index] = NULL;
153 FREE(ruleptr, M_MACBSDEXTENDED);
154 return(0);
155 }
156 error = SYSCTL_IN(req, &temprule, sizeof(temprule));
157 if (error)
158 return (error);
159
160 error = mac_bsdextended_rule_valid(&temprule);
161 if (error)
162 return (error);
163
164 if (rules[index] == NULL) {
165 /* printf("addition\n"); */
166 MALLOC(ruleptr, struct mac_bsdextended_rule *,
167 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK |
168 M_ZERO);
169 *ruleptr = temprule;
170 rules[index] = ruleptr;
171 if (index+1 > rule_slots)
172 rule_slots = index+1;
173 rule_count++;
174 } else {
175 /* printf("replacement\n"); */
176 *rules[index] = temprule;
177 }
178 }
179
180 return (0);
181 }
182
183 SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules,
184 CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules");
185
186 static void
187 mac_bsdextended_init(struct mac_policy_conf *mpc)
188 {
189
190 /* Initialize ruleset lock. */
191 /* Register dynamic sysctl's for rules. */
192 }
193
194 static void
195 mac_bsdextended_destroy(struct mac_policy_conf *mpc)
196 {
197
198 /* Tear down sysctls. */
199 /* Destroy ruleset lock. */
200 }
201
202 static int
203 mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
204 struct ucred *cred, uid_t object_uid, gid_t object_gid, int acc_mode)
205 {
206 int match;
207
208 /*
209 * Is there a subject match?
210 */
211 if (rule->mbr_subject.mbi_flags & MBI_UID_DEFINED) {
212 match = (rule->mbr_subject.mbi_uid == cred->cr_uid ||
213 rule->mbr_subject.mbi_uid == cred->cr_ruid ||
214 rule->mbr_subject.mbi_uid == cred->cr_svuid);
215
216 if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
217 match = !match;
218
219 if (!match)
220 return (0);
221 }
222
223 if (rule->mbr_subject.mbi_flags & MBI_GID_DEFINED) {
224 match = (groupmember(rule->mbr_subject.mbi_gid, cred) ||
225 rule->mbr_subject.mbi_gid == cred->cr_rgid ||
226 rule->mbr_subject.mbi_gid == cred->cr_svgid);
227
228 if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
229 match = !match;
230
231 if (!match)
232 return (0);
233 }
234
235 /*
236 * Is there an object match?
237 */
238 if (rule->mbr_object.mbi_flags & MBI_UID_DEFINED) {
239 match = (rule->mbr_object.mbi_uid == object_uid);
240
241 if (rule->mbr_object.mbi_flags & MBI_NEGATED)
242 match = !match;
243
244 if (!match)
245 return (0);
246 }
247
248 if (rule->mbr_object.mbi_flags & MBI_GID_DEFINED) {
249 match = (rule->mbr_object.mbi_gid == object_gid);
250
251 if (rule->mbr_object.mbi_flags & MBI_NEGATED)
252 match = !match;
253
254 if (!match)
255 return (0);
256 }
257
258 /*
259 * Is the access permitted?
260 */
261 if ((rule->mbr_mode & acc_mode) != acc_mode) {
262 if (mac_bsdextended_debugging)
263 printf("mac_bsdextended: %d:%d request %d on %d:%d"
264 " fails\n", cred->cr_ruid, cred->cr_rgid,
265 acc_mode, object_uid, object_gid);
266 return (EACCES);
267 }
268
269 return (0);
270 }
271
272 static int
273 mac_bsdextended_check(struct ucred *cred, uid_t object_uid, gid_t object_gid,
274 int acc_mode)
275 {
276 int error, i;
277
278 for (i = 0; i < rule_slots; i++) {
279 if (rules[i] == NULL)
280 continue;
281
282 /*
283 * Since we don't separately handle append, map append to
284 * write.
285 */
286 if (acc_mode & VAPPEND) {
287 acc_mode &= ~VAPPEND;
288 acc_mode |= VWRITE;
289 }
290
291 error = mac_bsdextended_rulecheck(rules[i], cred, object_uid,
292 object_gid, acc_mode);
293 if (error)
294 return (error);
295 }
296
297 return (0);
298 }
299
300 static int
301 mac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp,
302 struct label *label, int acc_mode)
303 {
304 struct vattr vap;
305 int error;
306
307 if (!mac_bsdextended_enabled)
308 return (0);
309
310 error = VOP_GETATTR(vp, &vap, cred, curthread);
311 if (error)
312 return (error);
313 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
314 }
315
316 static int
317 mac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
318 struct label *dlabel)
319 {
320 struct vattr vap;
321 int error;
322
323 if (!mac_bsdextended_enabled)
324 return (0);
325
326 error = VOP_GETATTR(dvp, &vap, cred, curthread);
327 if (error)
328 return (error);
329 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
330 }
331
332 static int
333 mac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
334 struct label *dlabel)
335 {
336 struct vattr vap;
337 int error;
338
339 if (!mac_bsdextended_enabled)
340 return (0);
341
342 error = VOP_GETATTR(dvp, &vap, cred, curthread);
343 if (error)
344 return (error);
345 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
346 }
347
348 static int
349 mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
350 struct label *dlabel, struct componentname *cnp, struct vattr *vap)
351 {
352 struct vattr dvap;
353 int error;
354
355 if (!mac_bsdextended_enabled)
356 return (0);
357
358 error = VOP_GETATTR(dvp, &dvap, cred, curthread);
359 if (error)
360 return (error);
361 return (mac_bsdextended_check(cred, dvap.va_uid, dvap.va_gid, VWRITE));
362 }
363
364 static int
365 mac_bsdextended_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
366 struct label *dlabel, struct vnode *vp, struct label *label,
367 struct componentname *cnp)
368 {
369 struct vattr vap;
370 int error;
371
372 if (!mac_bsdextended_enabled)
373 return (0);
374
375 error = VOP_GETATTR(dvp, &vap, cred, curthread);
376 if (error)
377 return (error);
378 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
379 if (error)
380 return (error);
381
382 error = VOP_GETATTR(vp, &vap, cred, curthread);
383 if (error)
384 return (error);
385 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
386 }
387
388 static int
389 mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
390 struct label *label, acl_type_t type)
391 {
392 struct vattr vap;
393 int error;
394
395 if (!mac_bsdextended_enabled)
396 return (0);
397
398 error = VOP_GETATTR(vp, &vap, cred, curthread);
399 if (error)
400 return (error);
401 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
402 }
403
404 static int
405 mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp,
406 struct label *label, struct image_params *imgp,
407 struct label *execlabel)
408 {
409 struct vattr vap;
410 int error;
411
412 if (!mac_bsdextended_enabled)
413 return (0);
414
415 error = VOP_GETATTR(vp, &vap, cred, curthread);
416 if (error)
417 return (error);
418 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
419 VREAD|VEXEC));
420 }
421
422 static int
423 mac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
424 struct label *label, acl_type_t type)
425 {
426 struct vattr vap;
427 int error;
428
429 if (!mac_bsdextended_enabled)
430 return (0);
431
432 error = VOP_GETATTR(vp, &vap, cred, curthread);
433 if (error)
434 return (error);
435 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VSTAT));
436 }
437
438 static int
439 mac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
440 struct label *label, int attrnamespace, const char *name, struct uio *uio)
441 {
442 struct vattr vap;
443 int error;
444
445 if (!mac_bsdextended_enabled)
446 return (0);
447
448 error = VOP_GETATTR(vp, &vap, cred, curthread);
449 if (error)
450 return (error);
451 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
452 }
453
454 static int
455 mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp,
456 struct label *dlabel, struct vnode *vp, struct label *label,
457 struct componentname *cnp)
458 {
459 struct vattr vap;
460 int error;
461
462 if (!mac_bsdextended_enabled)
463 return (0);
464
465 error = VOP_GETATTR(dvp, &vap, cred, curthread);
466 if (error)
467 return (error);
468 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
469 if (error)
470 return (error);
471
472 error = VOP_GETATTR(vp, &vap, cred, curthread);
473 if (error)
474 return (error);
475 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
476 if (error)
477 return (error);
478 return (0);
479 }
480
481 static int
482 mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
483 struct label *dlabel, struct componentname *cnp)
484 {
485 struct vattr vap;
486 int error;
487
488 if (!mac_bsdextended_enabled)
489 return (0);
490
491 error = VOP_GETATTR(dvp, &vap, cred, curthread);
492 if (error)
493 return (error);
494 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
495 }
496
497 static int
498 mac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp,
499 struct label *filelabel, int acc_mode)
500 {
501 struct vattr vap;
502 int error;
503
504 if (!mac_bsdextended_enabled)
505 return (0);
506
507 error = VOP_GETATTR(vp, &vap, cred, curthread);
508 if (error)
509 return (error);
510 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
511 }
512
513 static int
514 mac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
515 struct label *dlabel)
516 {
517 struct vattr vap;
518 int error;
519
520 if (!mac_bsdextended_enabled)
521 return (0);
522
523 error = VOP_GETATTR(dvp, &vap, cred, curthread);
524 if (error)
525 return (error);
526 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
527 }
528
529 static int
530 mac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
531 struct label *label)
532 {
533 struct vattr vap;
534 int error;
535
536 if (!mac_bsdextended_enabled)
537 return (0);
538
539 error = VOP_GETATTR(vp, &vap, cred, curthread);
540 if (error)
541 return (error);
542 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
543 }
544
545 static int
546 mac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
547 struct label *dlabel, struct vnode *vp, struct label *label,
548 struct componentname *cnp)
549 {
550 struct vattr vap;
551 int error;
552
553 if (!mac_bsdextended_enabled)
554 return (0);
555
556 error = VOP_GETATTR(dvp, &vap, cred, curthread);
557 if (error)
558 return (error);
559 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
560 if (error)
561 return (error);
562 error = VOP_GETATTR(vp, &vap, cred, curthread);
563 if (error)
564 return (error);
565 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
566
567 return (error);
568 }
569
570 static int
571 mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
572 struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
573 struct componentname *cnp)
574 {
575 struct vattr vap;
576 int error;
577
578 if (!mac_bsdextended_enabled)
579 return (0);
580
581 error = VOP_GETATTR(dvp, &vap, cred, curthread);
582 if (error)
583 return (error);
584 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
585 if (error)
586 return (error);
587
588 if (vp != NULL) {
589 error = VOP_GETATTR(vp, &vap, cred, curthread);
590 if (error)
591 return (error);
592 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
593 VWRITE);
594 }
595
596 return (error);
597 }
598
599 static int
600 mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
601 struct label *label)
602 {
603 struct vattr vap;
604 int error;
605
606 if (!mac_bsdextended_enabled)
607 return (0);
608
609 error = VOP_GETATTR(vp, &vap, cred, curthread);
610 if (error)
611 return (error);
612 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
613 }
614
615 static int
616 mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
617 struct label *label, acl_type_t type, struct acl *acl)
618 {
619 struct vattr vap;
620 int error;
621
622 if (!mac_bsdextended_enabled)
623 return (0);
624
625 error = VOP_GETATTR(vp, &vap, cred, curthread);
626 if (error)
627 return (error);
628 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
629 }
630
631 static int
632 mac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
633 struct label *label, int attrnamespace, const char *name, struct uio *uio)
634 {
635 struct vattr vap;
636 int error;
637
638 if (!mac_bsdextended_enabled)
639 return (0);
640
641 error = VOP_GETATTR(vp, &vap, cred, curthread);
642 if (error)
643 return (error);
644 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
645 }
646
647 static int
648 mac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
649 struct label *label, u_long flags)
650 {
651 struct vattr vap;
652 int error;
653
654 if (!mac_bsdextended_enabled)
655 return (0);
656
657 error = VOP_GETATTR(vp, &vap, cred, curthread);
658 if (error)
659 return (error);
660 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
661 }
662
663 static int
664 mac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
665 struct label *label, mode_t mode)
666 {
667 struct vattr vap;
668 int error;
669
670 if (!mac_bsdextended_enabled)
671 return (0);
672
673 error = VOP_GETATTR(vp, &vap, cred, curthread);
674 if (error)
675 return (error);
676 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
677 }
678
679 static int
680 mac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
681 struct label *label, uid_t uid, gid_t gid)
682 {
683 struct vattr vap;
684 int error;
685
686 if (!mac_bsdextended_enabled)
687 return (0);
688
689 error = VOP_GETATTR(vp, &vap, cred, curthread);
690 if (error)
691 return (error);
692 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
693 }
694
695 static int
696 mac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
697 struct label *label, struct timespec atime, struct timespec utime)
698 {
699 struct vattr vap;
700 int error;
701
702 if (!mac_bsdextended_enabled)
703 return (0);
704
705 error = VOP_GETATTR(vp, &vap, cred, curthread);
706 if (error)
707 return (error);
708 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
709 }
710
711 static int
712 mac_bsdextended_check_vnode_stat(struct ucred *active_cred,
713 struct ucred *file_cred, struct vnode *vp, struct label *label)
714 {
715 struct vattr vap;
716 int error;
717
718 if (!mac_bsdextended_enabled)
719 return (0);
720
721 error = VOP_GETATTR(vp, &vap, active_cred, curthread);
722 if (error)
723 return (error);
724 return (mac_bsdextended_check(active_cred, vap.va_uid, vap.va_gid,
725 VSTAT));
726 }
727
728 static struct mac_policy_ops mac_bsdextended_ops =
729 {
730 .mpo_destroy = mac_bsdextended_destroy,
731 .mpo_init = mac_bsdextended_init,
732 .mpo_check_vnode_access = mac_bsdextended_check_vnode_access,
733 .mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir,
734 .mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot,
735 .mpo_check_vnode_create = mac_bsdextended_check_create_vnode,
736 .mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete,
737 .mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl,
738 .mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec,
739 .mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl,
740 .mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr,
741 .mpo_check_vnode_link = mac_bsdextended_check_vnode_link,
742 .mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup,
743 .mpo_check_vnode_open = mac_bsdextended_check_vnode_open,
744 .mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir,
745 .mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink,
746 .mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from,
747 .mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to,
748 .mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke,
749 .mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode,
750 .mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr,
751 .mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags,
752 .mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode,
753 .mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner,
754 .mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes,
755 .mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat,
756 };
757
758 MAC_POLICY_SET(&mac_bsdextended_ops, trustedbsd_mac_bsdextended,
759 "TrustedBSD MAC/BSD Extended", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
Cache object: 255a423eb97e74d104db8300797fad66
|