1 /*-
2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by McAfee
9 * Research, the Security Research Division of McAfee, Inc. under
10 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
11 * CHATS research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $FreeBSD: src/sys/security/mac_lomac/mac_lomac.c,v 1.32.2.1 2005/01/29 20:31:44 rwatson Exp $
35 */
36
37 /*
38 * Developed by the TrustedBSD Project.
39 * Low-watermark floating label mandatory integrity policy.
40 */
41
42 #include <sys/types.h>
43 #include <sys/param.h>
44 #include <sys/acl.h>
45 #include <sys/conf.h>
46 #include <sys/extattr.h>
47 #include <sys/kernel.h>
48 #include <sys/mac.h>
49 #include <sys/malloc.h>
50 #include <sys/mount.h>
51 #include <sys/proc.h>
52 #include <sys/sbuf.h>
53 #include <sys/systm.h>
54 #include <sys/sysproto.h>
55 #include <sys/sysent.h>
56 #include <sys/systm.h>
57 #include <sys/vnode.h>
58 #include <sys/file.h>
59 #include <sys/socket.h>
60 #include <sys/socketvar.h>
61 #include <sys/pipe.h>
62 #include <sys/sysctl.h>
63 #include <sys/syslog.h>
64
65 #include <fs/devfs/devfs.h>
66
67 #include <net/bpfdesc.h>
68 #include <net/if.h>
69 #include <net/if_types.h>
70 #include <net/if_var.h>
71
72 #include <netinet/in.h>
73 #include <netinet/in_pcb.h>
74 #include <netinet/ip_var.h>
75
76 #include <vm/vm.h>
77
78 #include <sys/mac_policy.h>
79
80 #include <security/mac_lomac/mac_lomac.h>
81
82 struct mac_lomac_proc {
83 struct mac_lomac mac_lomac;
84 struct mtx mtx;
85 };
86
87 SYSCTL_DECL(_security_mac);
88
89 SYSCTL_NODE(_security_mac, OID_AUTO, lomac, CTLFLAG_RW, 0,
90 "TrustedBSD mac_lomac policy controls");
91
92 static int mac_lomac_label_size = sizeof(struct mac_lomac);
93 SYSCTL_INT(_security_mac_lomac, OID_AUTO, label_size, CTLFLAG_RD,
94 &mac_lomac_label_size, 0, "Size of struct mac_lomac");
95
96 static int mac_lomac_enabled = 1;
97 SYSCTL_INT(_security_mac_lomac, OID_AUTO, enabled, CTLFLAG_RW,
98 &mac_lomac_enabled, 0, "Enforce MAC/LOMAC policy");
99 TUNABLE_INT("security.mac.lomac.enabled", &mac_lomac_enabled);
100
101 static int destroyed_not_inited;
102 SYSCTL_INT(_security_mac_lomac, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
103 &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
104
105 static int trust_all_interfaces = 0;
106 SYSCTL_INT(_security_mac_lomac, OID_AUTO, trust_all_interfaces, CTLFLAG_RD,
107 &trust_all_interfaces, 0, "Consider all interfaces 'trusted' by MAC/LOMAC");
108 TUNABLE_INT("security.mac.lomac.trust_all_interfaces", &trust_all_interfaces);
109
110 static char trusted_interfaces[128];
111 SYSCTL_STRING(_security_mac_lomac, OID_AUTO, trusted_interfaces, CTLFLAG_RD,
112 trusted_interfaces, 0, "Interfaces considered 'trusted' by MAC/LOMAC");
113 TUNABLE_STR("security.mac.lomac.trusted_interfaces", trusted_interfaces,
114 sizeof(trusted_interfaces));
115
116 static int ptys_equal = 0;
117 SYSCTL_INT(_security_mac_lomac, OID_AUTO, ptys_equal, CTLFLAG_RW,
118 &ptys_equal, 0, "Label pty devices as lomac/equal on create");
119 TUNABLE_INT("security.mac.lomac.ptys_equal", &ptys_equal);
120
121 static int revocation_enabled = 1;
122 SYSCTL_INT(_security_mac_lomac, OID_AUTO, revocation_enabled, CTLFLAG_RW,
123 &revocation_enabled, 0, "Revoke access to objects on relabel");
124 TUNABLE_INT("security.mac.lomac.revocation_enabled", &revocation_enabled);
125
126 static int mac_lomac_slot;
127 #define SLOT(l) ((struct mac_lomac *)LABEL_TO_SLOT((l), mac_lomac_slot).l_ptr)
128 #define SLOT_SET(l, val) (LABEL_TO_SLOT((l), mac_lomac_slot).l_ptr = (val))
129 #define PSLOT(l) ((struct mac_lomac_proc *) \
130 LABEL_TO_SLOT((l), mac_lomac_slot).l_ptr)
131 #define PSLOT_SET(l, val) (LABEL_TO_SLOT((l), mac_lomac_slot).l_ptr = (val))
132
133 MALLOC_DEFINE(M_MACLOMAC, "lomac label", "MAC/LOMAC labels");
134
135 static struct mac_lomac *
136 lomac_alloc(int flag)
137 {
138 struct mac_lomac *mac_lomac;
139
140 mac_lomac = malloc(sizeof(struct mac_lomac), M_MACLOMAC, M_ZERO | flag);
141
142 return (mac_lomac);
143 }
144
145 static void
146 lomac_free(struct mac_lomac *mac_lomac)
147 {
148
149 if (mac_lomac != NULL)
150 free(mac_lomac, M_MACLOMAC);
151 else
152 atomic_add_int(&destroyed_not_inited, 1);
153 }
154
155 static int
156 lomac_atmostflags(struct mac_lomac *mac_lomac, int flags)
157 {
158
159 if ((mac_lomac->ml_flags & flags) != mac_lomac->ml_flags)
160 return (EINVAL);
161 return (0);
162 }
163
164 static int
165 mac_lomac_dominate_element(struct mac_lomac_element *a,
166 struct mac_lomac_element *b)
167 {
168
169 switch (a->mle_type) {
170 case MAC_LOMAC_TYPE_EQUAL:
171 case MAC_LOMAC_TYPE_HIGH:
172 return (1);
173
174 case MAC_LOMAC_TYPE_LOW:
175 switch (b->mle_type) {
176 case MAC_LOMAC_TYPE_GRADE:
177 case MAC_LOMAC_TYPE_HIGH:
178 return (0);
179
180 case MAC_LOMAC_TYPE_EQUAL:
181 case MAC_LOMAC_TYPE_LOW:
182 return (1);
183
184 default:
185 panic("mac_lomac_dominate_element: b->mle_type invalid");
186 }
187
188 case MAC_LOMAC_TYPE_GRADE:
189 switch (b->mle_type) {
190 case MAC_LOMAC_TYPE_EQUAL:
191 case MAC_LOMAC_TYPE_LOW:
192 return (1);
193
194 case MAC_LOMAC_TYPE_HIGH:
195 return (0);
196
197 case MAC_LOMAC_TYPE_GRADE:
198 return (a->mle_grade >= b->mle_grade);
199
200 default:
201 panic("mac_lomac_dominate_element: b->mle_type invalid");
202 }
203
204 default:
205 panic("mac_lomac_dominate_element: a->mle_type invalid");
206 }
207 }
208
209 static int
210 mac_lomac_range_in_range(struct mac_lomac *rangea, struct mac_lomac *rangeb)
211 {
212
213 return (mac_lomac_dominate_element(&rangeb->ml_rangehigh,
214 &rangea->ml_rangehigh) &&
215 mac_lomac_dominate_element(&rangea->ml_rangelow,
216 &rangeb->ml_rangelow));
217 }
218
219 static int
220 mac_lomac_single_in_range(struct mac_lomac *single, struct mac_lomac *range)
221 {
222
223 KASSERT((single->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
224 ("mac_lomac_single_in_range: a not single"));
225 KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
226 ("mac_lomac_single_in_range: b not range"));
227
228 return (mac_lomac_dominate_element(&range->ml_rangehigh,
229 &single->ml_single) &&
230 mac_lomac_dominate_element(&single->ml_single,
231 &range->ml_rangelow));
232 }
233
234 static int
235 mac_lomac_auxsingle_in_range(struct mac_lomac *single, struct mac_lomac *range)
236 {
237
238 KASSERT((single->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
239 ("mac_lomac_single_in_range: a not auxsingle"));
240 KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
241 ("mac_lomac_single_in_range: b not range"));
242
243 return (mac_lomac_dominate_element(&range->ml_rangehigh,
244 &single->ml_auxsingle) &&
245 mac_lomac_dominate_element(&single->ml_auxsingle,
246 &range->ml_rangelow));
247 }
248
249 static int
250 mac_lomac_dominate_single(struct mac_lomac *a, struct mac_lomac *b)
251 {
252 KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
253 ("mac_lomac_dominate_single: a not single"));
254 KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
255 ("mac_lomac_dominate_single: b not single"));
256
257 return (mac_lomac_dominate_element(&a->ml_single, &b->ml_single));
258 }
259
260 static int
261 mac_lomac_subject_dominate(struct mac_lomac *a, struct mac_lomac *b)
262 {
263 KASSERT((~a->ml_flags &
264 (MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_RANGE)) == 0,
265 ("mac_lomac_dominate_single: a not subject"));
266 KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
267 ("mac_lomac_dominate_single: b not single"));
268
269 return (mac_lomac_dominate_element(&a->ml_rangehigh,
270 &b->ml_single));
271 }
272
273 static int
274 mac_lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b)
275 {
276
277 if (a->mle_type == MAC_LOMAC_TYPE_EQUAL ||
278 b->mle_type == MAC_LOMAC_TYPE_EQUAL)
279 return (1);
280
281 return (a->mle_type == b->mle_type && a->mle_grade == b->mle_grade);
282 }
283
284 static int
285 mac_lomac_equal_single(struct mac_lomac *a, struct mac_lomac *b)
286 {
287
288 KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
289 ("mac_lomac_equal_single: a not single"));
290 KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
291 ("mac_lomac_equal_single: b not single"));
292
293 return (mac_lomac_equal_element(&a->ml_single, &b->ml_single));
294 }
295
296 static int
297 mac_lomac_contains_equal(struct mac_lomac *mac_lomac)
298 {
299
300 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE)
301 if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
302 return (1);
303 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX)
304 if (mac_lomac->ml_auxsingle.mle_type == MAC_LOMAC_TYPE_EQUAL)
305 return (1);
306
307 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
308 if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL)
309 return (1);
310 if (mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
311 return (1);
312 }
313
314 return (0);
315 }
316
317 static int
318 mac_lomac_subject_privileged(struct mac_lomac *mac_lomac)
319 {
320
321 KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
322 MAC_LOMAC_FLAGS_BOTH,
323 ("mac_lomac_subject_privileged: subject doesn't have both labels"));
324
325 /* If the single is EQUAL, it's ok. */
326 if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
327 return (0);
328
329 /* If either range endpoint is EQUAL, it's ok. */
330 if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL ||
331 mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
332 return (0);
333
334 /* If the range is low-high, it's ok. */
335 if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_LOW &&
336 mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_HIGH)
337 return (0);
338
339 /* It's not ok. */
340 return (EPERM);
341 }
342
343 static int
344 mac_lomac_high_single(struct mac_lomac *mac_lomac)
345 {
346
347 KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
348 ("mac_lomac_high_single: mac_lomac not single"));
349
350 return (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
351 }
352
353 static int
354 mac_lomac_valid(struct mac_lomac *mac_lomac)
355 {
356
357 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
358 switch (mac_lomac->ml_single.mle_type) {
359 case MAC_LOMAC_TYPE_GRADE:
360 case MAC_LOMAC_TYPE_EQUAL:
361 case MAC_LOMAC_TYPE_HIGH:
362 case MAC_LOMAC_TYPE_LOW:
363 break;
364
365 default:
366 return (EINVAL);
367 }
368 } else {
369 if (mac_lomac->ml_single.mle_type != MAC_LOMAC_TYPE_UNDEF)
370 return (EINVAL);
371 }
372
373 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX) {
374 switch (mac_lomac->ml_auxsingle.mle_type) {
375 case MAC_LOMAC_TYPE_GRADE:
376 case MAC_LOMAC_TYPE_EQUAL:
377 case MAC_LOMAC_TYPE_HIGH:
378 case MAC_LOMAC_TYPE_LOW:
379 break;
380
381 default:
382 return (EINVAL);
383 }
384 } else {
385 if (mac_lomac->ml_auxsingle.mle_type != MAC_LOMAC_TYPE_UNDEF)
386 return (EINVAL);
387 }
388
389 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
390 switch (mac_lomac->ml_rangelow.mle_type) {
391 case MAC_LOMAC_TYPE_GRADE:
392 case MAC_LOMAC_TYPE_EQUAL:
393 case MAC_LOMAC_TYPE_HIGH:
394 case MAC_LOMAC_TYPE_LOW:
395 break;
396
397 default:
398 return (EINVAL);
399 }
400
401 switch (mac_lomac->ml_rangehigh.mle_type) {
402 case MAC_LOMAC_TYPE_GRADE:
403 case MAC_LOMAC_TYPE_EQUAL:
404 case MAC_LOMAC_TYPE_HIGH:
405 case MAC_LOMAC_TYPE_LOW:
406 break;
407
408 default:
409 return (EINVAL);
410 }
411 if (!mac_lomac_dominate_element(&mac_lomac->ml_rangehigh,
412 &mac_lomac->ml_rangelow))
413 return (EINVAL);
414 } else {
415 if (mac_lomac->ml_rangelow.mle_type != MAC_LOMAC_TYPE_UNDEF ||
416 mac_lomac->ml_rangehigh.mle_type != MAC_LOMAC_TYPE_UNDEF)
417 return (EINVAL);
418 }
419
420 return (0);
421 }
422
423 static void
424 mac_lomac_set_range(struct mac_lomac *mac_lomac, u_short typelow,
425 u_short gradelow, u_short typehigh, u_short gradehigh)
426 {
427
428 mac_lomac->ml_rangelow.mle_type = typelow;
429 mac_lomac->ml_rangelow.mle_grade = gradelow;
430 mac_lomac->ml_rangehigh.mle_type = typehigh;
431 mac_lomac->ml_rangehigh.mle_grade = gradehigh;
432 mac_lomac->ml_flags |= MAC_LOMAC_FLAG_RANGE;
433 }
434
435 static void
436 mac_lomac_set_single(struct mac_lomac *mac_lomac, u_short type, u_short grade)
437 {
438
439 mac_lomac->ml_single.mle_type = type;
440 mac_lomac->ml_single.mle_grade = grade;
441 mac_lomac->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
442 }
443
444 static void
445 mac_lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
446 {
447
448 KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
449 ("mac_lomac_copy_range: labelfrom not range"));
450
451 labelto->ml_rangelow = labelfrom->ml_rangelow;
452 labelto->ml_rangehigh = labelfrom->ml_rangehigh;
453 labelto->ml_flags |= MAC_LOMAC_FLAG_RANGE;
454 }
455
456 static void
457 mac_lomac_copy_single(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
458 {
459
460 KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
461 ("mac_lomac_copy_single: labelfrom not single"));
462
463 labelto->ml_single = labelfrom->ml_single;
464 labelto->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
465 }
466
467 static void
468 mac_lomac_copy_auxsingle(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
469 {
470
471 KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
472 ("mac_lomac_copy_auxsingle: labelfrom not auxsingle"));
473
474 labelto->ml_auxsingle = labelfrom->ml_auxsingle;
475 labelto->ml_flags |= MAC_LOMAC_FLAG_AUX;
476 }
477
478 static void
479 mac_lomac_copy(struct mac_lomac *source, struct mac_lomac *dest)
480 {
481
482 if (source->ml_flags & MAC_LOMAC_FLAG_SINGLE)
483 mac_lomac_copy_single(source, dest);
484 if (source->ml_flags & MAC_LOMAC_FLAG_AUX)
485 mac_lomac_copy_auxsingle(source, dest);
486 if (source->ml_flags & MAC_LOMAC_FLAG_RANGE)
487 mac_lomac_copy_range(source, dest);
488 }
489
490 static int mac_lomac_to_string(struct sbuf *sb,
491 struct mac_lomac *mac_lomac);
492
493 static int
494 maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
495 const char *actionname, const char *objname, struct vnode *vpq)
496 {
497 struct sbuf subjlabel_sb, subjtext_sb, objlabel_sb;
498 char *subjlabeltext, *objlabeltext, *subjtext;
499 struct mac_lomac cached_subjlabel;
500 struct mac_lomac_proc *subj;
501 struct vattr va;
502 struct proc *p;
503 pid_t pgid;
504
505 subj = PSLOT(curthread->td_proc->p_label);
506
507 p = curthread->td_proc;
508 mtx_lock(&subj->mtx);
509 if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
510 /*
511 * Check to see if the pending demotion would be more or
512 * less severe than this one, and keep the more severe.
513 * This can only happen for a multi-threaded application.
514 */
515 if (mac_lomac_dominate_single(objlabel, &subj->mac_lomac)) {
516 mtx_unlock(&subj->mtx);
517 return (0);
518 }
519 }
520 bzero(&subj->mac_lomac, sizeof(subj->mac_lomac));
521 /*
522 * Always demote the single label.
523 */
524 mac_lomac_copy_single(objlabel, &subj->mac_lomac);
525 /*
526 * Start with the original range, then minimize each side of
527 * the range to the point of not dominating the object. The
528 * high side will always be demoted, of course.
529 */
530 mac_lomac_copy_range(subjlabel, &subj->mac_lomac);
531 if (!mac_lomac_dominate_element(&objlabel->ml_single,
532 &subj->mac_lomac.ml_rangelow))
533 subj->mac_lomac.ml_rangelow = objlabel->ml_single;
534 subj->mac_lomac.ml_rangehigh = objlabel->ml_single;
535 subj->mac_lomac.ml_flags |= MAC_LOMAC_FLAG_UPDATE;
536 mtx_lock_spin(&sched_lock);
537 curthread->td_flags |= TDF_ASTPENDING;
538 curthread->td_proc->p_sflag |= PS_MACPEND;
539 mtx_unlock_spin(&sched_lock);
540
541 /*
542 * Avoid memory allocation while holding a mutex; cache the
543 * label.
544 */
545 mac_lomac_copy_single(&subj->mac_lomac, &cached_subjlabel);
546 mtx_unlock(&subj->mtx);
547
548 sbuf_new(&subjlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
549 mac_lomac_to_string(&subjlabel_sb, subjlabel);
550 sbuf_finish(&subjlabel_sb);
551 subjlabeltext = sbuf_data(&subjlabel_sb);
552
553 sbuf_new(&subjtext_sb, NULL, 0, SBUF_AUTOEXTEND);
554 mac_lomac_to_string(&subjtext_sb, &subj->mac_lomac);
555 sbuf_finish(&subjtext_sb);
556 subjtext = sbuf_data(&subjtext_sb);
557
558 sbuf_new(&objlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
559 mac_lomac_to_string(&objlabel_sb, objlabel);
560 sbuf_finish(&objlabel_sb);
561 objlabeltext = sbuf_data(&objlabel_sb);
562
563 pgid = p->p_pgrp->pg_id; /* XXX could be stale? */
564 if (vpq != NULL && VOP_GETATTR(vpq, &va, curthread->td_ucred,
565 curthread) == 0) {
566 log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
567 " level %s after %s a level-%s %s (inode=%ld, "
568 "mountpount=%s)\n",
569 subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
570 p->p_comm, subjtext, actionname, objlabeltext, objname,
571 va.va_fileid, vpq->v_mount->mnt_stat.f_mntonname);
572 } else {
573 log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
574 " level %s after %s a level-%s %s\n",
575 subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
576 p->p_comm, subjtext, actionname, objlabeltext, objname);
577 }
578
579 sbuf_delete(&subjlabel_sb);
580 sbuf_delete(&subjtext_sb);
581 sbuf_delete(&objlabel_sb);
582
583 return (0);
584 }
585
586 /*
587 * Relabel "to" to "from" only if "from" is a valid label (contains
588 * at least a single), as for a relabel operation which may or may
589 * not involve a relevant label.
590 */
591 static void
592 try_relabel(struct mac_lomac *from, struct mac_lomac *to)
593 {
594
595 if (from->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
596 bzero(to, sizeof(*to));
597 mac_lomac_copy(from, to);
598 }
599 }
600
601 /*
602 * Policy module operations.
603 */
604 static void
605 mac_lomac_init(struct mac_policy_conf *conf)
606 {
607
608 }
609
610 /*
611 * Label operations.
612 */
613 static void
614 mac_lomac_init_label(struct label *label)
615 {
616
617 SLOT_SET(label, lomac_alloc(M_WAITOK));
618 }
619
620 static int
621 mac_lomac_init_label_waitcheck(struct label *label, int flag)
622 {
623
624 SLOT_SET(label, lomac_alloc(flag));
625 if (SLOT(label) == NULL)
626 return (ENOMEM);
627
628 return (0);
629 }
630
631 static void
632 mac_lomac_init_proc_label(struct label *label)
633 {
634
635 PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_MACLOMAC,
636 M_ZERO | M_WAITOK));
637 mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF);
638 }
639
640 static void
641 mac_lomac_destroy_label(struct label *label)
642 {
643
644 lomac_free(SLOT(label));
645 SLOT_SET(label, NULL);
646 }
647
648 static void
649 mac_lomac_destroy_proc_label(struct label *label)
650 {
651
652 mtx_destroy(&PSLOT(label)->mtx);
653 FREE(PSLOT(label), M_MACLOMAC);
654 PSLOT_SET(label, NULL);
655 }
656
657 static int
658 mac_lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
659 {
660
661 switch (element->mle_type) {
662 case MAC_LOMAC_TYPE_HIGH:
663 return (sbuf_printf(sb, "high"));
664
665 case MAC_LOMAC_TYPE_LOW:
666 return (sbuf_printf(sb, "low"));
667
668 case MAC_LOMAC_TYPE_EQUAL:
669 return (sbuf_printf(sb, "equal"));
670
671 case MAC_LOMAC_TYPE_GRADE:
672 return (sbuf_printf(sb, "%d", element->mle_grade));
673
674 default:
675 panic("mac_lomac_element_to_string: invalid type (%d)",
676 element->mle_type);
677 }
678 }
679
680 static int
681 mac_lomac_to_string(struct sbuf *sb, struct mac_lomac *mac_lomac)
682 {
683
684 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
685 if (mac_lomac_element_to_string(sb, &mac_lomac->ml_single)
686 == -1)
687 return (EINVAL);
688 }
689
690 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX) {
691 if (sbuf_putc(sb, '[') == -1)
692 return (EINVAL);
693
694 if (mac_lomac_element_to_string(sb, &mac_lomac->ml_auxsingle)
695 == -1)
696 return (EINVAL);
697
698 if (sbuf_putc(sb, ']') == -1)
699 return (EINVAL);
700 }
701
702 if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
703 if (sbuf_putc(sb, '(') == -1)
704 return (EINVAL);
705
706 if (mac_lomac_element_to_string(sb, &mac_lomac->ml_rangelow)
707 == -1)
708 return (EINVAL);
709
710 if (sbuf_putc(sb, '-') == -1)
711 return (EINVAL);
712
713 if (mac_lomac_element_to_string(sb, &mac_lomac->ml_rangehigh)
714 == -1)
715 return (EINVAL);
716
717 if (sbuf_putc(sb, ')') == -1)
718 return (EINVAL);
719 }
720
721 return (0);
722 }
723
724 static int
725 mac_lomac_externalize_label(struct label *label, char *element_name,
726 struct sbuf *sb, int *claimed)
727 {
728 struct mac_lomac *mac_lomac;
729
730 if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
731 return (0);
732
733 (*claimed)++;
734
735 mac_lomac = SLOT(label);
736
737 return (mac_lomac_to_string(sb, mac_lomac));
738 }
739
740 static int
741 mac_lomac_parse_element(struct mac_lomac_element *element, char *string)
742 {
743
744 if (strcmp(string, "high") == 0 ||
745 strcmp(string, "hi") == 0) {
746 element->mle_type = MAC_LOMAC_TYPE_HIGH;
747 element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
748 } else if (strcmp(string, "low") == 0 ||
749 strcmp(string, "lo") == 0) {
750 element->mle_type = MAC_LOMAC_TYPE_LOW;
751 element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
752 } else if (strcmp(string, "equal") == 0 ||
753 strcmp(string, "eq") == 0) {
754 element->mle_type = MAC_LOMAC_TYPE_EQUAL;
755 element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
756 } else {
757 char *p0, *p1;
758 int d;
759
760 p0 = string;
761 d = strtol(p0, &p1, 10);
762
763 if (d < 0 || d > 65535)
764 return (EINVAL);
765 element->mle_type = MAC_LOMAC_TYPE_GRADE;
766 element->mle_grade = d;
767
768 if (p1 == p0 || *p1 != '\0')
769 return (EINVAL);
770 }
771
772 return (0);
773 }
774
775 /*
776 * Note: destructively consumes the string, make a local copy before
777 * calling if that's a problem.
778 */
779 static int
780 mac_lomac_parse(struct mac_lomac *mac_lomac, char *string)
781 {
782 char *range, *rangeend, *rangehigh, *rangelow, *single, *auxsingle,
783 *auxsingleend;
784 int error;
785
786 /* Do we have a range? */
787 single = string;
788 range = index(string, '(');
789 if (range == single)
790 single = NULL;
791 auxsingle = index(string, '[');
792 if (auxsingle == single)
793 single = NULL;
794 if (range != NULL && auxsingle != NULL)
795 return (EINVAL);
796 rangelow = rangehigh = NULL;
797 if (range != NULL) {
798 /* Nul terminate the end of the single string. */
799 *range = '\0';
800 range++;
801 rangelow = range;
802 rangehigh = index(rangelow, '-');
803 if (rangehigh == NULL)
804 return (EINVAL);
805 rangehigh++;
806 if (*rangelow == '\0' || *rangehigh == '\0')
807 return (EINVAL);
808 rangeend = index(rangehigh, ')');
809 if (rangeend == NULL)
810 return (EINVAL);
811 if (*(rangeend + 1) != '\0')
812 return (EINVAL);
813 /* Nul terminate the ends of the ranges. */
814 *(rangehigh - 1) = '\0';
815 *rangeend = '\0';
816 }
817 KASSERT((rangelow != NULL && rangehigh != NULL) ||
818 (rangelow == NULL && rangehigh == NULL),
819 ("mac_lomac_internalize_label: range mismatch"));
820 if (auxsingle != NULL) {
821 /* Nul terminate the end of the single string. */
822 *auxsingle = '\0';
823 auxsingle++;
824 auxsingleend = index(auxsingle, ']');
825 if (auxsingleend == NULL)
826 return (EINVAL);
827 if (*(auxsingleend + 1) != '\0')
828 return (EINVAL);
829 /* Nul terminate the end of the auxsingle. */
830 *auxsingleend = '\0';
831 }
832
833 bzero(mac_lomac, sizeof(*mac_lomac));
834 if (single != NULL) {
835 error = mac_lomac_parse_element(&mac_lomac->ml_single, single);
836 if (error)
837 return (error);
838 mac_lomac->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
839 }
840
841 if (auxsingle != NULL) {
842 error = mac_lomac_parse_element(&mac_lomac->ml_auxsingle,
843 auxsingle);
844 if (error)
845 return (error);
846 mac_lomac->ml_flags |= MAC_LOMAC_FLAG_AUX;
847 }
848
849 if (rangelow != NULL) {
850 error = mac_lomac_parse_element(&mac_lomac->ml_rangelow,
851 rangelow);
852 if (error)
853 return (error);
854 error = mac_lomac_parse_element(&mac_lomac->ml_rangehigh,
855 rangehigh);
856 if (error)
857 return (error);
858 mac_lomac->ml_flags |= MAC_LOMAC_FLAG_RANGE;
859 }
860
861 error = mac_lomac_valid(mac_lomac);
862 if (error)
863 return (error);
864
865 return (0);
866 }
867
868 static int
869 mac_lomac_internalize_label(struct label *label, char *element_name,
870 char *element_data, int *claimed)
871 {
872 struct mac_lomac *mac_lomac, mac_lomac_temp;
873 int error;
874
875 if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
876 return (0);
877
878 (*claimed)++;
879
880 error = mac_lomac_parse(&mac_lomac_temp, element_data);
881 if (error)
882 return (error);
883
884 mac_lomac = SLOT(label);
885 *mac_lomac = mac_lomac_temp;
886
887 return (0);
888 }
889
890 static void
891 mac_lomac_copy_label(struct label *src, struct label *dest)
892 {
893
894 *SLOT(dest) = *SLOT(src);
895 }
896
897 /*
898 * Labeling event operations: file system objects, and things that look
899 * a lot like file system objects.
900 */
901 static void
902 mac_lomac_create_devfs_device(struct mount *mp, struct cdev *dev,
903 struct devfs_dirent *devfs_dirent, struct label *label)
904 {
905 struct mac_lomac *mac_lomac;
906 int lomac_type;
907
908 mac_lomac = SLOT(label);
909 if (strcmp(dev->si_name, "null") == 0 ||
910 strcmp(dev->si_name, "zero") == 0 ||
911 strcmp(dev->si_name, "random") == 0 ||
912 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0 ||
913 strncmp(dev->si_name, "ttyv", strlen("ttyv")) == 0)
914 lomac_type = MAC_LOMAC_TYPE_EQUAL;
915 else if (ptys_equal &&
916 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
917 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
918 lomac_type = MAC_LOMAC_TYPE_EQUAL;
919 else
920 lomac_type = MAC_LOMAC_TYPE_HIGH;
921 mac_lomac_set_single(mac_lomac, lomac_type, 0);
922 }
923
924 static void
925 mac_lomac_create_devfs_directory(struct mount *mp, char *dirname,
926 int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label)
927 {
928 struct mac_lomac *mac_lomac;
929
930 mac_lomac = SLOT(label);
931 mac_lomac_set_single(mac_lomac, MAC_LOMAC_TYPE_HIGH, 0);
932 }
933
934 static void
935 mac_lomac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
936 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
937 struct label *delabel)
938 {
939 struct mac_lomac *source, *dest;
940
941 source = SLOT(cred->cr_label);
942 dest = SLOT(delabel);
943
944 mac_lomac_copy_single(source, dest);
945 }
946
947 static void
948 mac_lomac_create_mount(struct ucred *cred, struct mount *mp,
949 struct label *mntlabel, struct label *fslabel)
950 {
951 struct mac_lomac *source, *dest;
952
953 source = SLOT(cred->cr_label);
954 dest = SLOT(mntlabel);
955 mac_lomac_copy_single(source, dest);
956 dest = SLOT(fslabel);
957 mac_lomac_copy_single(source, dest);
958 }
959
960 static void
961 mac_lomac_create_root_mount(struct ucred *cred, struct mount *mp,
962 struct label *mntlabel, struct label *fslabel)
963 {
964 struct mac_lomac *mac_lomac;
965
966 /* Always mount root as high integrity. */
967 mac_lomac = SLOT(fslabel);
968 mac_lomac_set_single(mac_lomac, MAC_LOMAC_TYPE_HIGH, 0);
969 mac_lomac = SLOT(mntlabel);
970 mac_lomac_set_single(mac_lomac, MAC_LOMAC_TYPE_HIGH, 0);
971 }
972
973 static void
974 mac_lomac_relabel_vnode(struct ucred *cred, struct vnode *vp,
975 struct label *vnodelabel, struct label *label)
976 {
977 struct mac_lomac *source, *dest;
978
979 source = SLOT(label);
980 dest = SLOT(vnodelabel);
981
982 try_relabel(source, dest);
983 }
984
985 static void
986 mac_lomac_update_devfsdirent(struct mount *mp,
987 struct devfs_dirent *devfs_dirent, struct label *direntlabel,
988 struct vnode *vp, struct label *vnodelabel)
989 {
990 struct mac_lomac *source, *dest;
991
992 source = SLOT(vnodelabel);
993 dest = SLOT(direntlabel);
994
995 mac_lomac_copy(source, dest);
996 }
997
998 static void
999 mac_lomac_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
1000 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
1001 struct label *vlabel)
1002 {
1003 struct mac_lomac *source, *dest;
1004
1005 source = SLOT(delabel);
1006 dest = SLOT(vlabel);
1007
1008 mac_lomac_copy_single(source, dest);
1009 }
1010
1011 static int
1012 mac_lomac_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
1013 struct vnode *vp, struct label *vlabel)
1014 {
1015 struct mac_lomac temp, *source, *dest;
1016 int buflen, error;
1017
1018 source = SLOT(fslabel);
1019 dest = SLOT(vlabel);
1020
1021 buflen = sizeof(temp);
1022 bzero(&temp, buflen);
1023
1024 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
1025 MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&temp, curthread);
1026 if (error == ENOATTR || error == EOPNOTSUPP) {
1027 /* Fall back to the fslabel. */
1028 mac_lomac_copy_single(source, dest);
1029 return (0);
1030 } else if (error)
1031 return (error);
1032
1033 if (buflen != sizeof(temp)) {
1034 if (buflen != sizeof(temp) - sizeof(temp.ml_auxsingle)) {
1035 printf("mac_lomac_associate_vnode_extattr: bad size %d\n",
1036 buflen);
1037 return (EPERM);
1038 }
1039 bzero(&temp.ml_auxsingle, sizeof(temp.ml_auxsingle));
1040 buflen = sizeof(temp);
1041 (void)vn_extattr_set(vp, IO_NODELOCKED,
1042 MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME,
1043 buflen, (char *)&temp, curthread);
1044 }
1045 if (mac_lomac_valid(&temp) != 0) {
1046 printf("mac_lomac_associate_vnode_extattr: invalid\n");
1047 return (EPERM);
1048 }
1049 if ((temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) != MAC_LOMAC_FLAG_SINGLE) {
1050 printf("mac_lomac_associate_vnode_extattr: not single\n");
1051 return (EPERM);
1052 }
1053
1054 mac_lomac_copy_single(&temp, dest);
1055 return (0);
1056 }
1057
1058 static void
1059 mac_lomac_associate_vnode_singlelabel(struct mount *mp,
1060 struct label *fslabel, struct vnode *vp, struct label *vlabel)
1061 {
1062 struct mac_lomac *source, *dest;
1063
1064 source = SLOT(fslabel);
1065 dest = SLOT(vlabel);
1066
1067 mac_lomac_copy_single(source, dest);
1068 }
1069
1070 static int
1071 mac_lomac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
1072 struct label *fslabel, struct vnode *dvp, struct label *dlabel,
1073 struct vnode *vp, struct label *vlabel, struct componentname *cnp)
1074 {
1075 struct mac_lomac *source, *dest, *dir, temp;
1076 size_t buflen;
1077 int error;
1078
1079 buflen = sizeof(temp);
1080 bzero(&temp, buflen);
1081
1082 source = SLOT(cred->cr_label);
1083 dest = SLOT(vlabel);
1084 dir = SLOT(dlabel);
1085 if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) {
1086 mac_lomac_copy_auxsingle(dir, &temp);
1087 mac_lomac_set_single(&temp, dir->ml_auxsingle.mle_type,
1088 dir->ml_auxsingle.mle_grade);
1089 } else {
1090 mac_lomac_copy_single(source, &temp);
1091 }
1092
1093 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
1094 MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
1095 if (error == 0)
1096 mac_lomac_copy(&temp, dest);
1097 return (error);
1098 }
1099
1100 static int
1101 mac_lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
1102 struct label *vlabel, struct label *intlabel)
1103 {
1104 struct mac_lomac *source, temp;
1105 size_t buflen;
1106 int error;
1107
1108 buflen = sizeof(temp);
1109 bzero(&temp, buflen);
1110
1111 source = SLOT(intlabel);
1112 if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
1113 return (0);
1114
1115 mac_lomac_copy_single(source, &temp);
1116 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
1117 MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
1118 return (error);
1119 }
1120
1121 /*
1122 * Labeling event operations: IPC object.
1123 */
1124 static void
1125 mac_lomac_create_inpcb_from_socket(struct socket *so, struct label *solabel,
1126 struct inpcb *inp, struct label *inplabel)
1127 {
1128 struct mac_lomac *source, *dest;
1129
1130 source = SLOT(solabel);
1131 dest = SLOT(inplabel);
1132
1133 mac_lomac_copy_single(source, dest);
1134 }
1135
1136 static void
1137 mac_lomac_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
1138 struct mbuf *m, struct label *mbuflabel)
1139 {
1140 struct mac_lomac *source, *dest;
1141
1142 source = SLOT(socketlabel);
1143 dest = SLOT(mbuflabel);
1144
1145 mac_lomac_copy_single(source, dest);
1146 }
1147
1148 static void
1149 mac_lomac_create_socket(struct ucred *cred, struct socket *socket,
1150 struct label *socketlabel)
1151 {
1152 struct mac_lomac *source, *dest;
1153
1154 source = SLOT(cred->cr_label);
1155 dest = SLOT(socketlabel);
1156
1157 mac_lomac_copy_single(source, dest);
1158 }
1159
1160 static void
1161 mac_lomac_create_pipe(struct ucred *cred, struct pipepair *pp,
1162 struct label *pipelabel)
1163 {
1164 struct mac_lomac *source, *dest;
1165
1166 source = SLOT(cred->cr_label);
1167 dest = SLOT(pipelabel);
1168
1169 mac_lomac_copy_single(source, dest);
1170 }
1171
1172 static void
1173 mac_lomac_create_socket_from_socket(struct socket *oldsocket,
1174 struct label *oldsocketlabel, struct socket *newsocket,
1175 struct label *newsocketlabel)
1176 {
1177 struct mac_lomac *source, *dest;
1178
1179 source = SLOT(oldsocketlabel);
1180 dest = SLOT(newsocketlabel);
1181
1182 mac_lomac_copy_single(source, dest);
1183 }
1184
1185 static void
1186 mac_lomac_relabel_socket(struct ucred *cred, struct socket *socket,
1187 struct label *socketlabel, struct label *newlabel)
1188 {
1189 struct mac_lomac *source, *dest;
1190
1191 source = SLOT(newlabel);
1192 dest = SLOT(socketlabel);
1193
1194 try_relabel(source, dest);
1195 }
1196
1197 static void
1198 mac_lomac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
1199 struct label *pipelabel, struct label *newlabel)
1200 {
1201 struct mac_lomac *source, *dest;
1202
1203 source = SLOT(newlabel);
1204 dest = SLOT(pipelabel);
1205
1206 try_relabel(source, dest);
1207 }
1208
1209 static void
1210 mac_lomac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,
1211 struct socket *socket, struct label *socketpeerlabel)
1212 {
1213 struct mac_lomac *source, *dest;
1214
1215 source = SLOT(mbuflabel);
1216 dest = SLOT(socketpeerlabel);
1217
1218 mac_lomac_copy_single(source, dest);
1219 }
1220
1221 /*
1222 * Labeling event operations: network objects.
1223 */
1224 static void
1225 mac_lomac_set_socket_peer_from_socket(struct socket *oldsocket,
1226 struct label *oldsocketlabel, struct socket *newsocket,
1227 struct label *newsocketpeerlabel)
1228 {
1229 struct mac_lomac *source, *dest;
1230
1231 source = SLOT(oldsocketlabel);
1232 dest = SLOT(newsocketpeerlabel);
1233
1234 mac_lomac_copy_single(source, dest);
1235 }
1236
1237 static void
1238 mac_lomac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
1239 struct label *bpflabel)
1240 {
1241 struct mac_lomac *source, *dest;
1242
1243 source = SLOT(cred->cr_label);
1244 dest = SLOT(bpflabel);
1245
1246 mac_lomac_copy_single(source, dest);
1247 }
1248
1249 static void
1250 mac_lomac_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
1251 {
1252 char tifname[IFNAMSIZ], *p, *q;
1253 char tiflist[sizeof(trusted_interfaces)];
1254 struct mac_lomac *dest;
1255 int len, grade;
1256
1257 dest = SLOT(ifnetlabel);
1258
1259 if (ifnet->if_type == IFT_LOOP) {
1260 grade = MAC_LOMAC_TYPE_EQUAL;
1261 goto set;
1262 }
1263
1264 if (trust_all_interfaces) {
1265 grade = MAC_LOMAC_TYPE_HIGH;
1266 goto set;
1267 }
1268
1269 grade = MAC_LOMAC_TYPE_LOW;
1270
1271 if (trusted_interfaces[0] == '\0' ||
1272 !strvalid(trusted_interfaces, sizeof(trusted_interfaces)))
1273 goto set;
1274
1275 bzero(tiflist, sizeof(tiflist));
1276 for (p = trusted_interfaces, q = tiflist; *p != '\0'; p++, q++)
1277 if(*p != ' ' && *p != '\t')
1278 *q = *p;
1279
1280 for (p = q = tiflist;; p++) {
1281 if (*p == ',' || *p == '\0') {
1282 len = p - q;
1283 if (len < IFNAMSIZ) {
1284 bzero(tifname, sizeof(tifname));
1285 bcopy(q, tifname, len);
1286 if (strcmp(tifname, ifnet->if_xname) == 0) {
1287 grade = MAC_LOMAC_TYPE_HIGH;
1288 break;
1289 }
1290 }
1291 else {
1292 *p = '\0';
1293 printf("MAC/LOMAC warning: interface name "
1294 "\"%s\" is too long (must be < %d)\n",
1295 q, IFNAMSIZ);
1296 }
1297 if (*p == '\0')
1298 break;
1299 q = p + 1;
1300 }
1301 }
1302 set:
1303 mac_lomac_set_single(dest, grade, 0);
1304 mac_lomac_set_range(dest, grade, 0, grade, 0);
1305 }
1306
1307 static void
1308 mac_lomac_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
1309 struct ipq *ipq, struct label *ipqlabel)
1310 {
1311 struct mac_lomac *source, *dest;
1312
1313 source = SLOT(fragmentlabel);
1314 dest = SLOT(ipqlabel);
1315
1316 mac_lomac_copy_single(source, dest);
1317 }
1318
1319 static void
1320 mac_lomac_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
1321 struct mbuf *datagram, struct label *datagramlabel)
1322 {
1323 struct mac_lomac *source, *dest;
1324
1325 source = SLOT(ipqlabel);
1326 dest = SLOT(datagramlabel);
1327
1328 /* Just use the head, since we require them all to match. */
1329 mac_lomac_copy_single(source, dest);
1330 }
1331
1332 static void
1333 mac_lomac_create_fragment(struct mbuf *datagram, struct label *datagramlabel,
1334 struct mbuf *fragment, struct label *fragmentlabel)
1335 {
1336 struct mac_lomac *source, *dest;
1337
1338 source = SLOT(datagramlabel);
1339 dest = SLOT(fragmentlabel);
1340
1341 mac_lomac_copy_single(source, dest);
1342 }
1343
1344 static void
1345 mac_lomac_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
1346 struct mbuf *m, struct label *mlabel)
1347 {
1348 struct mac_lomac *source, *dest;
1349
1350 source = SLOT(inplabel);
1351 dest = SLOT(mlabel);
1352
1353 mac_lomac_copy_single(source, dest);
1354 }
1355
1356 static void
1357 mac_lomac_create_mbuf_from_mbuf(struct mbuf *oldmbuf,
1358 struct label *oldmbuflabel, struct mbuf *newmbuf,
1359 struct label *newmbuflabel)
1360 {
1361 struct mac_lomac *source, *dest;
1362
1363 source = SLOT(oldmbuflabel);
1364 dest = SLOT(newmbuflabel);
1365
1366 /*
1367 * Because the source mbuf may not yet have been "created",
1368 * just initialized, we do a conditional copy. Since we don't
1369 * allow mbufs to have ranges, do a KASSERT to make sure that
1370 * doesn't happen.
1371 */
1372 KASSERT((source->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0,
1373 ("mac_lomac_create_mbuf_from_mbuf: source mbuf has range"));
1374 mac_lomac_copy(source, dest);
1375 }
1376
1377 static void
1378 mac_lomac_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,
1379 struct mbuf *mbuf, struct label *mbuflabel)
1380 {
1381 struct mac_lomac *dest;
1382
1383 dest = SLOT(mbuflabel);
1384
1385 mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1386 }
1387
1388 static void
1389 mac_lomac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,
1390 struct mbuf *mbuf, struct label *mbuflabel)
1391 {
1392 struct mac_lomac *source, *dest;
1393
1394 source = SLOT(bpflabel);
1395 dest = SLOT(mbuflabel);
1396
1397 mac_lomac_copy_single(source, dest);
1398 }
1399
1400 static void
1401 mac_lomac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,
1402 struct mbuf *m, struct label *mbuflabel)
1403 {
1404 struct mac_lomac *source, *dest;
1405
1406 source = SLOT(ifnetlabel);
1407 dest = SLOT(mbuflabel);
1408
1409 mac_lomac_copy_single(source, dest);
1410 }
1411
1412 static void
1413 mac_lomac_create_mbuf_multicast_encap(struct mbuf *oldmbuf,
1414 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel,
1415 struct mbuf *newmbuf, struct label *newmbuflabel)
1416 {
1417 struct mac_lomac *source, *dest;
1418
1419 source = SLOT(oldmbuflabel);
1420 dest = SLOT(newmbuflabel);
1421
1422 mac_lomac_copy_single(source, dest);
1423 }
1424
1425 static void
1426 mac_lomac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel,
1427 struct mbuf *newmbuf, struct label *newmbuflabel)
1428 {
1429 struct mac_lomac *source, *dest;
1430
1431 source = SLOT(oldmbuflabel);
1432 dest = SLOT(newmbuflabel);
1433
1434 mac_lomac_copy_single(source, dest);
1435 }
1436
1437 static int
1438 mac_lomac_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,
1439 struct ipq *ipq, struct label *ipqlabel)
1440 {
1441 struct mac_lomac *a, *b;
1442
1443 a = SLOT(ipqlabel);
1444 b = SLOT(fragmentlabel);
1445
1446 return (mac_lomac_equal_single(a, b));
1447 }
1448
1449 static void
1450 mac_lomac_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,
1451 struct label *ifnetlabel, struct label *newlabel)
1452 {
1453 struct mac_lomac *source, *dest;
1454
1455 source = SLOT(newlabel);
1456 dest = SLOT(ifnetlabel);
1457
1458 try_relabel(source, dest);
1459 }
1460
1461 static void
1462 mac_lomac_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
1463 struct ipq *ipq, struct label *ipqlabel)
1464 {
1465
1466 /* NOOP: we only accept matching labels, so no need to update */
1467 }
1468
1469 static void
1470 mac_lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1471 struct inpcb *inp, struct label *inplabel)
1472 {
1473 struct mac_lomac *source, *dest;
1474
1475 source = SLOT(solabel);
1476 dest = SLOT(inplabel);
1477
1478 mac_lomac_copy_single(source, dest);
1479 }
1480
1481 /*
1482 * Labeling event operations: processes.
1483 */
1484 static void
1485 mac_lomac_execve_transition(struct ucred *old, struct ucred *new,
1486 struct vnode *vp, struct label *vnodelabel,
1487 struct label *interpvnodelabel, struct image_params *imgp,
1488 struct label *execlabel)
1489 {
1490 struct mac_lomac *source, *dest, *obj, *robj;
1491
1492 source = SLOT(old->cr_label);
1493 dest = SLOT(new->cr_label);
1494 obj = SLOT(vnodelabel);
1495 robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
1496
1497 mac_lomac_copy(source, dest);
1498 /*
1499 * If there's an auxiliary label on the real object, respect it
1500 * and assume that this level should be assumed immediately if
1501 * a higher level is currently in place.
1502 */
1503 if (robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
1504 !mac_lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single)
1505 && mac_lomac_auxsingle_in_range(robj, dest))
1506 mac_lomac_set_single(dest, robj->ml_auxsingle.mle_type,
1507 robj->ml_auxsingle.mle_grade);
1508 /*
1509 * Restructuring to use the execve transitioning mechanism
1510 * instead of the normal demotion mechanism here would be
1511 * difficult, so just copy the label over and perform standard
1512 * demotion. This is also non-optimal because it will result
1513 * in the intermediate label "new" being created and immediately
1514 * recycled.
1515 */
1516 if (mac_lomac_enabled && revocation_enabled &&
1517 !mac_lomac_dominate_single(obj, source))
1518 (void)maybe_demote(source, obj, "executing", "file", vp);
1519 }
1520
1521 static int
1522 mac_lomac_execve_will_transition(struct ucred *old, struct vnode *vp,
1523 struct label *vnodelabel, struct label *interpvnodelabel,
1524 struct image_params *imgp, struct label *execlabel)
1525 {
1526 struct mac_lomac *subj, *obj, *robj;
1527
1528 if (!mac_lomac_enabled || !revocation_enabled)
1529 return (0);
1530
1531 subj = SLOT(old->cr_label);
1532 obj = SLOT(vnodelabel);
1533 robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
1534
1535 return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
1536 !mac_lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single)
1537 && mac_lomac_auxsingle_in_range(robj, subj)) ||
1538 !mac_lomac_dominate_single(obj, subj));
1539 }
1540
1541 static void
1542 mac_lomac_create_proc0(struct ucred *cred)
1543 {
1544 struct mac_lomac *dest;
1545
1546 dest = SLOT(cred->cr_label);
1547
1548 mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1549 mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
1550 0);
1551 }
1552
1553 static void
1554 mac_lomac_create_proc1(struct ucred *cred)
1555 {
1556 struct mac_lomac *dest;
1557
1558 dest = SLOT(cred->cr_label);
1559
1560 mac_lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
1561 mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
1562 0);
1563 }
1564
1565 static void
1566 mac_lomac_relabel_cred(struct ucred *cred, struct label *newlabel)
1567 {
1568 struct mac_lomac *source, *dest;
1569
1570 source = SLOT(newlabel);
1571 dest = SLOT(cred->cr_label);
1572
1573 try_relabel(source, dest);
1574 }
1575
1576 /*
1577 * Access control checks.
1578 */
1579 static int
1580 mac_lomac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,
1581 struct ifnet *ifnet, struct label *ifnetlabel)
1582 {
1583 struct mac_lomac *a, *b;
1584
1585 if (!mac_lomac_enabled)
1586 return (0);
1587
1588 a = SLOT(bpflabel);
1589 b = SLOT(ifnetlabel);
1590
1591 if (mac_lomac_equal_single(a, b))
1592 return (0);
1593 return (EACCES);
1594 }
1595
1596 static int
1597 mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
1598 {
1599 struct mac_lomac *subj, *new;
1600 int error;
1601
1602 subj = SLOT(cred->cr_label);
1603 new = SLOT(newlabel);
1604
1605 /*
1606 * If there is a LOMAC label update for the credential, it may
1607 * be an update of the single, range, or both.
1608 */
1609 error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
1610 if (error)
1611 return (error);
1612
1613 /*
1614 * If the LOMAC label is to be changed, authorize as appropriate.
1615 */
1616 if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
1617 /*
1618 * Fill in the missing parts from the previous label.
1619 */
1620 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
1621 mac_lomac_copy_single(subj, new);
1622 if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
1623 mac_lomac_copy_range(subj, new);
1624
1625 /*
1626 * To change the LOMAC range on a credential, the new
1627 * range label must be in the current range.
1628 */
1629 if (!mac_lomac_range_in_range(new, subj))
1630 return (EPERM);
1631
1632 /*
1633 * To change the LOMAC single label on a credential, the
1634 * new single label must be in the new range. Implicitly
1635 * from the previous check, the new single is in the old
1636 * range.
1637 */
1638 if (!mac_lomac_single_in_range(new, new))
1639 return (EPERM);
1640
1641 /*
1642 * To have EQUAL in any component of the new credential
1643 * LOMAC label, the subject must already have EQUAL in
1644 * their label.
1645 */
1646 if (mac_lomac_contains_equal(new)) {
1647 error = mac_lomac_subject_privileged(subj);
1648 if (error)
1649 return (error);
1650 }
1651
1652 /*
1653 * XXXMAC: Additional consistency tests regarding the
1654 * single and range of the new label might be performed
1655 * here.
1656 */
1657 }
1658
1659 return (0);
1660 }
1661
1662 static int
1663 mac_lomac_check_cred_visible(struct ucred *u1, struct ucred *u2)
1664 {
1665 struct mac_lomac *subj, *obj;
1666
1667 if (!mac_lomac_enabled)
1668 return (0);
1669
1670 subj = SLOT(u1->cr_label);
1671 obj = SLOT(u2->cr_label);
1672
1673 /* XXX: range */
1674 if (!mac_lomac_dominate_single(obj, subj))
1675 return (ESRCH);
1676
1677 return (0);
1678 }
1679
1680 static int
1681 mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
1682 struct label *ifnetlabel, struct label *newlabel)
1683 {
1684 struct mac_lomac *subj, *new;
1685 int error;
1686
1687 subj = SLOT(cred->cr_label);
1688 new = SLOT(newlabel);
1689
1690 /*
1691 * If there is a LOMAC label update for the interface, it may
1692 * be an update of the single, range, or both.
1693 */
1694 error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
1695 if (error)
1696 return (error);
1697
1698 /*
1699 * Relabling network interfaces requires LOMAC privilege.
1700 */
1701 error = mac_lomac_subject_privileged(subj);
1702 if (error)
1703 return (error);
1704
1705 /*
1706 * If the LOMAC label is to be changed, authorize as appropriate.
1707 */
1708 if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
1709 /*
1710 * Fill in the missing parts from the previous label.
1711 */
1712 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
1713 mac_lomac_copy_single(subj, new);
1714 if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
1715 mac_lomac_copy_range(subj, new);
1716
1717 /*
1718 * Rely on the traditional superuser status for the LOMAC
1719 * interface relabel requirements. XXXMAC: This will go
1720 * away.
1721 */
1722 error = suser_cred(cred, 0);
1723 if (error)
1724 return (EPERM);
1725
1726 /*
1727 * XXXMAC: Additional consistency tests regarding the single
1728 * and the range of the new label might be performed here.
1729 */
1730 }
1731
1732 return (0);
1733 }
1734
1735 static int
1736 mac_lomac_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
1737 struct mbuf *m, struct label *mbuflabel)
1738 {
1739 struct mac_lomac *p, *i;
1740
1741 if (!mac_lomac_enabled)
1742 return (0);
1743
1744 p = SLOT(mbuflabel);
1745 i = SLOT(ifnetlabel);
1746
1747 return (mac_lomac_single_in_range(p, i) ? 0 : EACCES);
1748 }
1749
1750 static int
1751 mac_lomac_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
1752 struct mbuf *m, struct label *mlabel)
1753 {
1754 struct mac_lomac *p, *i;
1755
1756 if (!mac_lomac_enabled)
1757 return (0);
1758
1759 p = SLOT(mlabel);
1760 i = SLOT(inplabel);
1761
1762 return (mac_lomac_equal_single(p, i) ? 0 : EACCES);
1763 }
1764
1765 static int
1766 mac_lomac_check_kld_load(struct ucred *cred, struct vnode *vp,
1767 struct label *label)
1768 {
1769 struct mac_lomac *subj, *obj;
1770
1771 if (!mac_lomac_enabled)
1772 return (0);
1773
1774 subj = SLOT(cred->cr_label);
1775 obj = SLOT(label);
1776
1777 if (mac_lomac_subject_privileged(subj))
1778 return (EPERM);
1779
1780 if (!mac_lomac_high_single(obj))
1781 return (EACCES);
1782
1783 return (0);
1784 }
1785
1786 static int
1787 mac_lomac_check_kld_unload(struct ucred *cred)
1788 {
1789 struct mac_lomac *subj;
1790
1791 if (!mac_lomac_enabled)
1792 return (0);
1793
1794 subj = SLOT(cred->cr_label);
1795
1796 if (mac_lomac_subject_privileged(subj))
1797 return (EPERM);
1798
1799 return (0);
1800 }
1801
1802 static int
1803 mac_lomac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
1804 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data)
1805 {
1806
1807 if(!mac_lomac_enabled)
1808 return (0);
1809
1810 /* XXX: This will be implemented soon... */
1811
1812 return (0);
1813 }
1814
1815 static int
1816 mac_lomac_check_pipe_read(struct ucred *cred, struct pipepair *pp,
1817 struct label *pipelabel)
1818 {
1819 struct mac_lomac *subj, *obj;
1820
1821 if (!mac_lomac_enabled)
1822 return (0);
1823
1824 subj = SLOT(cred->cr_label);
1825 obj = SLOT((pipelabel));
1826
1827 if (!mac_lomac_dominate_single(obj, subj))
1828 return (maybe_demote(subj, obj, "reading", "pipe", NULL));
1829
1830 return (0);
1831 }
1832
1833 static int
1834 mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1835 struct label *pipelabel, struct label *newlabel)
1836 {
1837 struct mac_lomac *subj, *obj, *new;
1838 int error;
1839
1840 new = SLOT(newlabel);
1841 subj = SLOT(cred->cr_label);
1842 obj = SLOT(pipelabel);
1843
1844 /*
1845 * If there is a LOMAC label update for a pipe, it must be a
1846 * single update.
1847 */
1848 error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
1849 if (error)
1850 return (error);
1851
1852 /*
1853 * To perform a relabel of a pipe (LOMAC label or not), LOMAC must
1854 * authorize the relabel.
1855 */
1856 if (!mac_lomac_single_in_range(obj, subj))
1857 return (EPERM);
1858
1859 /*
1860 * If the LOMAC label is to be changed, authorize as appropriate.
1861 */
1862 if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
1863 /*
1864 * To change the LOMAC label on a pipe, the new pipe label
1865 * must be in the subject range.
1866 */
1867 if (!mac_lomac_single_in_range(new, subj))
1868 return (EPERM);
1869
1870 /*
1871 * To change the LOMAC label on a pipe to be EQUAL, the
1872 * subject must have appropriate privilege.
1873 */
1874 if (mac_lomac_contains_equal(new)) {
1875 error = mac_lomac_subject_privileged(subj);
1876 if (error)
1877 return (error);
1878 }
1879 }
1880
1881 return (0);
1882 }
1883
1884 static int
1885 mac_lomac_check_pipe_write(struct ucred *cred, struct pipepair *pp,
1886 struct label *pipelabel)
1887 {
1888 struct mac_lomac *subj, *obj;
1889
1890 if (!mac_lomac_enabled)
1891 return (0);
1892
1893 subj = SLOT(cred->cr_label);
1894 obj = SLOT((pipelabel));
1895
1896 if (!mac_lomac_subject_dominate(subj, obj))
1897 return (EACCES);
1898
1899 return (0);
1900 }
1901
1902 static int
1903 mac_lomac_check_proc_debug(struct ucred *cred, struct proc *proc)
1904 {
1905 struct mac_lomac *subj, *obj;
1906
1907 if (!mac_lomac_enabled)
1908 return (0);
1909
1910 subj = SLOT(cred->cr_label);
1911 obj = SLOT(proc->p_ucred->cr_label);
1912
1913 /* XXX: range checks */
1914 if (!mac_lomac_dominate_single(obj, subj))
1915 return (ESRCH);
1916 if (!mac_lomac_subject_dominate(subj, obj))
1917 return (EACCES);
1918
1919 return (0);
1920 }
1921
1922 static int
1923 mac_lomac_check_proc_sched(struct ucred *cred, struct proc *proc)
1924 {
1925 struct mac_lomac *subj, *obj;
1926
1927 if (!mac_lomac_enabled)
1928 return (0);
1929
1930 subj = SLOT(cred->cr_label);
1931 obj = SLOT(proc->p_ucred->cr_label);
1932
1933 /* XXX: range checks */
1934 if (!mac_lomac_dominate_single(obj, subj))
1935 return (ESRCH);
1936 if (!mac_lomac_subject_dominate(subj, obj))
1937 return (EACCES);
1938
1939 return (0);
1940 }
1941
1942 static int
1943 mac_lomac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
1944 {
1945 struct mac_lomac *subj, *obj;
1946
1947 if (!mac_lomac_enabled)
1948 return (0);
1949
1950 subj = SLOT(cred->cr_label);
1951 obj = SLOT(proc->p_ucred->cr_label);
1952
1953 /* XXX: range checks */
1954 if (!mac_lomac_dominate_single(obj, subj))
1955 return (ESRCH);
1956 if (!mac_lomac_subject_dominate(subj, obj))
1957 return (EACCES);
1958
1959 return (0);
1960 }
1961
1962 static int
1963 mac_lomac_check_socket_deliver(struct socket *so, struct label *socketlabel,
1964 struct mbuf *m, struct label *mbuflabel)
1965 {
1966 struct mac_lomac *p, *s;
1967
1968 if (!mac_lomac_enabled)
1969 return (0);
1970
1971 p = SLOT(mbuflabel);
1972 s = SLOT(socketlabel);
1973
1974 return (mac_lomac_equal_single(p, s) ? 0 : EACCES);
1975 }
1976
1977 static int
1978 mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *socket,
1979 struct label *socketlabel, struct label *newlabel)
1980 {
1981 struct mac_lomac *subj, *obj, *new;
1982 int error;
1983
1984 new = SLOT(newlabel);
1985 subj = SLOT(cred->cr_label);
1986 obj = SLOT(socketlabel);
1987
1988 /*
1989 * If there is a LOMAC label update for the socket, it may be
1990 * an update of single.
1991 */
1992 error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
1993 if (error)
1994 return (error);
1995
1996 /*
1997 * To relabel a socket, the old socket single must be in the subject
1998 * range.
1999 */
2000 if (!mac_lomac_single_in_range(obj, subj))
2001 return (EPERM);
2002
2003 /*
2004 * If the LOMAC label is to be changed, authorize as appropriate.
2005 */
2006 if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
2007 /*
2008 * To relabel a socket, the new socket single must be in
2009 * the subject range.
2010 */
2011 if (!mac_lomac_single_in_range(new, subj))
2012 return (EPERM);
2013
2014 /*
2015 * To change the LOMAC label on the socket to contain EQUAL,
2016 * the subject must have appropriate privilege.
2017 */
2018 if (mac_lomac_contains_equal(new)) {
2019 error = mac_lomac_subject_privileged(subj);
2020 if (error)
2021 return (error);
2022 }
2023 }
2024
2025 return (0);
2026 }
2027
2028 static int
2029 mac_lomac_check_socket_visible(struct ucred *cred, struct socket *socket,
2030 struct label *socketlabel)
2031 {
2032 struct mac_lomac *subj, *obj;
2033
2034 if (!mac_lomac_enabled)
2035 return (0);
2036
2037 subj = SLOT(cred->cr_label);
2038 obj = SLOT(socketlabel);
2039
2040 if (!mac_lomac_dominate_single(obj, subj))
2041 return (ENOENT);
2042
2043 return (0);
2044 }
2045
2046 static int
2047 mac_lomac_check_system_swapon(struct ucred *cred, struct vnode *vp,
2048 struct label *label)
2049 {
2050 struct mac_lomac *subj, *obj;
2051
2052 if (!mac_lomac_enabled)
2053 return (0);
2054
2055 subj = SLOT(cred->cr_label);
2056 obj = SLOT(label);
2057
2058 if (mac_lomac_subject_privileged(subj))
2059 return (EPERM);
2060
2061 if (!mac_lomac_high_single(obj))
2062 return (EACCES);
2063
2064 return (0);
2065 }
2066
2067 static int
2068 mac_lomac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
2069 void *arg1, int arg2, struct sysctl_req *req)
2070 {
2071 struct mac_lomac *subj;
2072
2073 if (!mac_lomac_enabled)
2074 return (0);
2075
2076 subj = SLOT(cred->cr_label);
2077
2078 /*
2079 * Treat sysctl variables without CTLFLAG_ANYBODY flag as
2080 * lomac/high, but also require privilege to change them.
2081 */
2082 if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
2083 #ifdef notdef
2084 if (!mac_lomac_subject_dominate_high(subj))
2085 return (EACCES);
2086 #endif
2087
2088 if (mac_lomac_subject_privileged(subj))
2089 return (EPERM);
2090 }
2091
2092 return (0);
2093 }
2094
2095 static int
2096 mac_lomac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
2097 struct label *dlabel, struct componentname *cnp, struct vattr *vap)
2098 {
2099 struct mac_lomac *subj, *obj;
2100
2101 if (!mac_lomac_enabled)
2102 return (0);
2103
2104 subj = SLOT(cred->cr_label);
2105 obj = SLOT(dlabel);
2106
2107 if (!mac_lomac_subject_dominate(subj, obj))
2108 return (EACCES);
2109 if (obj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2110 !mac_lomac_dominate_element(&subj->ml_single, &obj->ml_auxsingle))
2111 return (EACCES);
2112
2113 return (0);
2114 }
2115
2116 static int
2117 mac_lomac_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
2118 struct label *dlabel, struct vnode *vp, struct label *label,
2119 struct componentname *cnp)
2120 {
2121 struct mac_lomac *subj, *obj;
2122
2123 if (!mac_lomac_enabled)
2124 return (0);
2125
2126 subj = SLOT(cred->cr_label);
2127 obj = SLOT(dlabel);
2128
2129 if (!mac_lomac_subject_dominate(subj, obj))
2130 return (EACCES);
2131
2132 obj = SLOT(label);
2133
2134 if (!mac_lomac_subject_dominate(subj, obj))
2135 return (EACCES);
2136
2137 return (0);
2138 }
2139
2140 static int
2141 mac_lomac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
2142 struct label *label, acl_type_t type)
2143 {
2144 struct mac_lomac *subj, *obj;
2145
2146 if (!mac_lomac_enabled)
2147 return (0);
2148
2149 subj = SLOT(cred->cr_label);
2150 obj = SLOT(label);
2151
2152 if (!mac_lomac_subject_dominate(subj, obj))
2153 return (EACCES);
2154
2155 return (0);
2156 }
2157
2158 static int
2159 mac_lomac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
2160 struct label *dlabel, struct vnode *vp, struct label *label,
2161 struct componentname *cnp)
2162 {
2163 struct mac_lomac *subj, *obj;
2164
2165 if (!mac_lomac_enabled)
2166 return (0);
2167
2168 subj = SLOT(cred->cr_label);
2169 obj = SLOT(dlabel);
2170
2171 if (!mac_lomac_subject_dominate(subj, obj))
2172 return (EACCES);
2173
2174 obj = SLOT(label);
2175
2176 if (!mac_lomac_subject_dominate(subj, obj))
2177 return (EACCES);
2178
2179 return (0);
2180 }
2181
2182 static int
2183 mac_lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
2184 struct label *label, int prot)
2185 {
2186 struct mac_lomac *subj, *obj;
2187
2188 /*
2189 * Rely on the use of open()-time protections to handle
2190 * non-revocation cases.
2191 */
2192 if (!mac_lomac_enabled)
2193 return (0);
2194
2195 subj = SLOT(cred->cr_label);
2196 obj = SLOT(label);
2197
2198 if (prot & VM_PROT_WRITE) {
2199 if (!mac_lomac_subject_dominate(subj, obj))
2200 return (EACCES);
2201 }
2202 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2203 if (!mac_lomac_dominate_single(obj, subj))
2204 return (maybe_demote(subj, obj, "mapping", "file", vp));
2205 }
2206
2207 return (0);
2208 }
2209
2210 static void
2211 mac_lomac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
2212 struct label *label, /* XXX vm_prot_t */ int *prot)
2213 {
2214 struct mac_lomac *subj, *obj;
2215
2216 /*
2217 * Rely on the use of open()-time protections to handle
2218 * non-revocation cases.
2219 */
2220 if (!mac_lomac_enabled || !revocation_enabled)
2221 return;
2222
2223 subj = SLOT(cred->cr_label);
2224 obj = SLOT(label);
2225
2226 if (!mac_lomac_subject_dominate(subj, obj))
2227 *prot &= ~VM_PROT_WRITE;
2228 }
2229
2230 static int
2231 mac_lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
2232 struct label *vnodelabel, int acc_mode)
2233 {
2234 struct mac_lomac *subj, *obj;
2235
2236 if (!mac_lomac_enabled)
2237 return (0);
2238
2239 subj = SLOT(cred->cr_label);
2240 obj = SLOT(vnodelabel);
2241
2242 /* XXX privilege override for admin? */
2243 if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
2244 if (!mac_lomac_subject_dominate(subj, obj))
2245 return (EACCES);
2246 }
2247
2248 return (0);
2249 }
2250
2251 static int
2252 mac_lomac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
2253 struct vnode *vp, struct label *label)
2254 {
2255 struct mac_lomac *subj, *obj;
2256
2257 if (!mac_lomac_enabled || !revocation_enabled)
2258 return (0);
2259
2260 subj = SLOT(active_cred->cr_label);
2261 obj = SLOT(label);
2262
2263 if (!mac_lomac_dominate_single(obj, subj))
2264 return (maybe_demote(subj, obj, "reading", "file", vp));
2265
2266 return (0);
2267 }
2268
2269 static int
2270 mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
2271 struct label *vnodelabel, struct label *newlabel)
2272 {
2273 struct mac_lomac *old, *new, *subj;
2274 int error;
2275
2276 old = SLOT(vnodelabel);
2277 new = SLOT(newlabel);
2278 subj = SLOT(cred->cr_label);
2279
2280 /*
2281 * If there is a LOMAC label update for the vnode, it must be a
2282 * single label, with an optional explicit auxiliary single.
2283 */
2284 error = lomac_atmostflags(new,
2285 MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_AUX);
2286 if (error)
2287 return (error);
2288
2289 /*
2290 * To perform a relabel of the vnode (LOMAC label or not), LOMAC must
2291 * authorize the relabel.
2292 */
2293 if (!mac_lomac_single_in_range(old, subj))
2294 return (EPERM);
2295
2296 /*
2297 * If the LOMAC label is to be changed, authorize as appropriate.
2298 */
2299 if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
2300 /*
2301 * To change the LOMAC label on a vnode, the new vnode label
2302 * must be in the subject range.
2303 */
2304 if (!mac_lomac_single_in_range(new, subj))
2305 return (EPERM);
2306
2307 /*
2308 * To change the LOMAC label on the vnode to be EQUAL,
2309 * the subject must have appropriate privilege.
2310 */
2311 if (mac_lomac_contains_equal(new)) {
2312 error = mac_lomac_subject_privileged(subj);
2313 if (error)
2314 return (error);
2315 }
2316 }
2317 if (new->ml_flags & MAC_LOMAC_FLAG_AUX) {
2318 /*
2319 * Fill in the missing parts from the previous label.
2320 */
2321 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
2322 mac_lomac_copy_single(subj, new);
2323
2324 /*
2325 * To change the auxiliary LOMAC label on a vnode, the new
2326 * vnode label must be in the subject range.
2327 */
2328 if (!mac_lomac_auxsingle_in_range(new, subj))
2329 return (EPERM);
2330
2331 /*
2332 * To change the auxiliary LOMAC label on the vnode to be
2333 * EQUAL, the subject must have appropriate privilege.
2334 */
2335 if (mac_lomac_contains_equal(new)) {
2336 error = mac_lomac_subject_privileged(subj);
2337 if (error)
2338 return (error);
2339 }
2340 }
2341
2342 return (0);
2343 }
2344
2345 static int
2346 mac_lomac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
2347 struct label *dlabel, struct vnode *vp, struct label *label,
2348 struct componentname *cnp)
2349 {
2350 struct mac_lomac *subj, *obj;
2351
2352 if (!mac_lomac_enabled)
2353 return (0);
2354
2355 subj = SLOT(cred->cr_label);
2356 obj = SLOT(dlabel);
2357
2358 if (!mac_lomac_subject_dominate(subj, obj))
2359 return (EACCES);
2360
2361 obj = SLOT(label);
2362
2363 if (!mac_lomac_subject_dominate(subj, obj))
2364 return (EACCES);
2365
2366 return (0);
2367 }
2368
2369 static int
2370 mac_lomac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
2371 struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
2372 struct componentname *cnp)
2373 {
2374 struct mac_lomac *subj, *obj;
2375
2376 if (!mac_lomac_enabled)
2377 return (0);
2378
2379 subj = SLOT(cred->cr_label);
2380 obj = SLOT(dlabel);
2381
2382 if (!mac_lomac_subject_dominate(subj, obj))
2383 return (EACCES);
2384
2385 if (vp != NULL) {
2386 obj = SLOT(label);
2387
2388 if (!mac_lomac_subject_dominate(subj, obj))
2389 return (EACCES);
2390 }
2391
2392 return (0);
2393 }
2394
2395 static int
2396 mac_lomac_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
2397 struct label *label)
2398 {
2399 struct mac_lomac *subj, *obj;
2400
2401 if (!mac_lomac_enabled)
2402 return (0);
2403
2404 subj = SLOT(cred->cr_label);
2405 obj = SLOT(label);
2406
2407 if (!mac_lomac_subject_dominate(subj, obj))
2408 return (EACCES);
2409
2410 return (0);
2411 }
2412
2413 static int
2414 mac_lomac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
2415 struct label *label, acl_type_t type, struct acl *acl)
2416 {
2417 struct mac_lomac *subj, *obj;
2418
2419 if (!mac_lomac_enabled)
2420 return (0);
2421
2422 subj = SLOT(cred->cr_label);
2423 obj = SLOT(label);
2424
2425 if (!mac_lomac_subject_dominate(subj, obj))
2426 return (EACCES);
2427
2428 return (0);
2429 }
2430
2431 static int
2432 mac_lomac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
2433 struct label *vnodelabel, int attrnamespace, const char *name,
2434 struct uio *uio)
2435 {
2436 struct mac_lomac *subj, *obj;
2437
2438 if (!mac_lomac_enabled)
2439 return (0);
2440
2441 subj = SLOT(cred->cr_label);
2442 obj = SLOT(vnodelabel);
2443
2444 if (!mac_lomac_subject_dominate(subj, obj))
2445 return (EACCES);
2446
2447 /* XXX: protect the MAC EA in a special way? */
2448
2449 return (0);
2450 }
2451
2452 static int
2453 mac_lomac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
2454 struct label *vnodelabel, u_long flags)
2455 {
2456 struct mac_lomac *subj, *obj;
2457
2458 if (!mac_lomac_enabled)
2459 return (0);
2460
2461 subj = SLOT(cred->cr_label);
2462 obj = SLOT(vnodelabel);
2463
2464 if (!mac_lomac_subject_dominate(subj, obj))
2465 return (EACCES);
2466
2467 return (0);
2468 }
2469
2470 static int
2471 mac_lomac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
2472 struct label *vnodelabel, mode_t mode)
2473 {
2474 struct mac_lomac *subj, *obj;
2475
2476 if (!mac_lomac_enabled)
2477 return (0);
2478
2479 subj = SLOT(cred->cr_label);
2480 obj = SLOT(vnodelabel);
2481
2482 if (!mac_lomac_subject_dominate(subj, obj))
2483 return (EACCES);
2484
2485 return (0);
2486 }
2487
2488 static int
2489 mac_lomac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
2490 struct label *vnodelabel, uid_t uid, gid_t gid)
2491 {
2492 struct mac_lomac *subj, *obj;
2493
2494 if (!mac_lomac_enabled)
2495 return (0);
2496
2497 subj = SLOT(cred->cr_label);
2498 obj = SLOT(vnodelabel);
2499
2500 if (!mac_lomac_subject_dominate(subj, obj))
2501 return (EACCES);
2502
2503 return (0);
2504 }
2505
2506 static int
2507 mac_lomac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
2508 struct label *vnodelabel, struct timespec atime, struct timespec mtime)
2509 {
2510 struct mac_lomac *subj, *obj;
2511
2512 if (!mac_lomac_enabled)
2513 return (0);
2514
2515 subj = SLOT(cred->cr_label);
2516 obj = SLOT(vnodelabel);
2517
2518 if (!mac_lomac_subject_dominate(subj, obj))
2519 return (EACCES);
2520
2521 return (0);
2522 }
2523
2524 static int
2525 mac_lomac_check_vnode_write(struct ucred *active_cred,
2526 struct ucred *file_cred, struct vnode *vp, struct label *label)
2527 {
2528 struct mac_lomac *subj, *obj;
2529
2530 if (!mac_lomac_enabled || !revocation_enabled)
2531 return (0);
2532
2533 subj = SLOT(active_cred->cr_label);
2534 obj = SLOT(label);
2535
2536 if (!mac_lomac_subject_dominate(subj, obj))
2537 return (EACCES);
2538
2539 return (0);
2540 }
2541
2542 static void
2543 mac_lomac_thread_userret(struct thread *td)
2544 {
2545 struct proc *p = td->td_proc;
2546 struct mac_lomac_proc *subj = PSLOT(p->p_label);
2547 struct ucred *newcred, *oldcred;
2548 int dodrop;
2549
2550 mtx_lock(&subj->mtx);
2551 if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
2552 dodrop = 0;
2553 mtx_unlock(&subj->mtx);
2554 newcred = crget();
2555 /*
2556 * Prevent a lock order reversal in
2557 * mac_cred_mmapped_drop_perms; ideally, the other
2558 * user of subj->mtx wouldn't be holding Giant.
2559 */
2560 mtx_lock(&Giant);
2561 PROC_LOCK(p);
2562 mtx_lock(&subj->mtx);
2563 /*
2564 * Check if we lost the race while allocating the cred.
2565 */
2566 if ((subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) == 0) {
2567 crfree(newcred);
2568 goto out;
2569 }
2570 oldcred = p->p_ucred;
2571 crcopy(newcred, oldcred);
2572 crhold(newcred);
2573 mac_lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
2574 p->p_ucred = newcred;
2575 crfree(oldcred);
2576 dodrop = 1;
2577 out:
2578 mtx_unlock(&subj->mtx);
2579 PROC_UNLOCK(p);
2580 if (dodrop)
2581 mac_cred_mmapped_drop_perms(curthread, newcred);
2582 mtx_unlock(&Giant);
2583 } else {
2584 mtx_unlock(&subj->mtx);
2585 }
2586 }
2587
2588 static struct mac_policy_ops mac_lomac_ops =
2589 {
2590 .mpo_init = mac_lomac_init,
2591 .mpo_init_bpfdesc_label = mac_lomac_init_label,
2592 .mpo_init_cred_label = mac_lomac_init_label,
2593 .mpo_init_devfsdirent_label = mac_lomac_init_label,
2594 .mpo_init_ifnet_label = mac_lomac_init_label,
2595 .mpo_init_inpcb_label = mac_lomac_init_label_waitcheck,
2596 .mpo_init_ipq_label = mac_lomac_init_label_waitcheck,
2597 .mpo_init_mbuf_label = mac_lomac_init_label_waitcheck,
2598 .mpo_init_mount_label = mac_lomac_init_label,
2599 .mpo_init_mount_fs_label = mac_lomac_init_label,
2600 .mpo_init_pipe_label = mac_lomac_init_label,
2601 .mpo_init_proc_label = mac_lomac_init_proc_label,
2602 .mpo_init_socket_label = mac_lomac_init_label_waitcheck,
2603 .mpo_init_socket_peer_label = mac_lomac_init_label_waitcheck,
2604 .mpo_init_vnode_label = mac_lomac_init_label,
2605 .mpo_destroy_bpfdesc_label = mac_lomac_destroy_label,
2606 .mpo_destroy_cred_label = mac_lomac_destroy_label,
2607 .mpo_destroy_devfsdirent_label = mac_lomac_destroy_label,
2608 .mpo_destroy_ifnet_label = mac_lomac_destroy_label,
2609 .mpo_destroy_inpcb_label = mac_lomac_destroy_label,
2610 .mpo_destroy_ipq_label = mac_lomac_destroy_label,
2611 .mpo_destroy_mbuf_label = mac_lomac_destroy_label,
2612 .mpo_destroy_mount_label = mac_lomac_destroy_label,
2613 .mpo_destroy_mount_fs_label = mac_lomac_destroy_label,
2614 .mpo_destroy_pipe_label = mac_lomac_destroy_label,
2615 .mpo_destroy_proc_label = mac_lomac_destroy_proc_label,
2616 .mpo_destroy_socket_label = mac_lomac_destroy_label,
2617 .mpo_destroy_socket_peer_label = mac_lomac_destroy_label,
2618 .mpo_destroy_vnode_label = mac_lomac_destroy_label,
2619 .mpo_copy_cred_label = mac_lomac_copy_label,
2620 .mpo_copy_ifnet_label = mac_lomac_copy_label,
2621 .mpo_copy_mbuf_label = mac_lomac_copy_label,
2622 .mpo_copy_pipe_label = mac_lomac_copy_label,
2623 .mpo_copy_socket_label = mac_lomac_copy_label,
2624 .mpo_copy_vnode_label = mac_lomac_copy_label,
2625 .mpo_externalize_cred_label = mac_lomac_externalize_label,
2626 .mpo_externalize_ifnet_label = mac_lomac_externalize_label,
2627 .mpo_externalize_pipe_label = mac_lomac_externalize_label,
2628 .mpo_externalize_socket_label = mac_lomac_externalize_label,
2629 .mpo_externalize_socket_peer_label = mac_lomac_externalize_label,
2630 .mpo_externalize_vnode_label = mac_lomac_externalize_label,
2631 .mpo_internalize_cred_label = mac_lomac_internalize_label,
2632 .mpo_internalize_ifnet_label = mac_lomac_internalize_label,
2633 .mpo_internalize_pipe_label = mac_lomac_internalize_label,
2634 .mpo_internalize_socket_label = mac_lomac_internalize_label,
2635 .mpo_internalize_vnode_label = mac_lomac_internalize_label,
2636 .mpo_create_devfs_device = mac_lomac_create_devfs_device,
2637 .mpo_create_devfs_directory = mac_lomac_create_devfs_directory,
2638 .mpo_create_devfs_symlink = mac_lomac_create_devfs_symlink,
2639 .mpo_create_mount = mac_lomac_create_mount,
2640 .mpo_create_root_mount = mac_lomac_create_root_mount,
2641 .mpo_relabel_vnode = mac_lomac_relabel_vnode,
2642 .mpo_update_devfsdirent = mac_lomac_update_devfsdirent,
2643 .mpo_associate_vnode_devfs = mac_lomac_associate_vnode_devfs,
2644 .mpo_associate_vnode_extattr = mac_lomac_associate_vnode_extattr,
2645 .mpo_associate_vnode_singlelabel =
2646 mac_lomac_associate_vnode_singlelabel,
2647 .mpo_create_vnode_extattr = mac_lomac_create_vnode_extattr,
2648 .mpo_setlabel_vnode_extattr = mac_lomac_setlabel_vnode_extattr,
2649 .mpo_create_mbuf_from_socket = mac_lomac_create_mbuf_from_socket,
2650 .mpo_create_pipe = mac_lomac_create_pipe,
2651 .mpo_create_socket = mac_lomac_create_socket,
2652 .mpo_create_socket_from_socket = mac_lomac_create_socket_from_socket,
2653 .mpo_relabel_pipe = mac_lomac_relabel_pipe,
2654 .mpo_relabel_socket = mac_lomac_relabel_socket,
2655 .mpo_set_socket_peer_from_mbuf = mac_lomac_set_socket_peer_from_mbuf,
2656 .mpo_set_socket_peer_from_socket =
2657 mac_lomac_set_socket_peer_from_socket,
2658 .mpo_create_bpfdesc = mac_lomac_create_bpfdesc,
2659 .mpo_create_datagram_from_ipq = mac_lomac_create_datagram_from_ipq,
2660 .mpo_create_fragment = mac_lomac_create_fragment,
2661 .mpo_create_ifnet = mac_lomac_create_ifnet,
2662 .mpo_create_inpcb_from_socket = mac_lomac_create_inpcb_from_socket,
2663 .mpo_create_ipq = mac_lomac_create_ipq,
2664 .mpo_create_mbuf_from_inpcb = mac_lomac_create_mbuf_from_inpcb,
2665 .mpo_create_mbuf_from_mbuf = mac_lomac_create_mbuf_from_mbuf,
2666 .mpo_create_mbuf_linklayer = mac_lomac_create_mbuf_linklayer,
2667 .mpo_create_mbuf_from_bpfdesc = mac_lomac_create_mbuf_from_bpfdesc,
2668 .mpo_create_mbuf_from_ifnet = mac_lomac_create_mbuf_from_ifnet,
2669 .mpo_create_mbuf_multicast_encap =
2670 mac_lomac_create_mbuf_multicast_encap,
2671 .mpo_create_mbuf_netlayer = mac_lomac_create_mbuf_netlayer,
2672 .mpo_fragment_match = mac_lomac_fragment_match,
2673 .mpo_relabel_ifnet = mac_lomac_relabel_ifnet,
2674 .mpo_update_ipq = mac_lomac_update_ipq,
2675 .mpo_inpcb_sosetlabel = mac_lomac_inpcb_sosetlabel,
2676 .mpo_execve_transition = mac_lomac_execve_transition,
2677 .mpo_execve_will_transition = mac_lomac_execve_will_transition,
2678 .mpo_create_proc0 = mac_lomac_create_proc0,
2679 .mpo_create_proc1 = mac_lomac_create_proc1,
2680 .mpo_relabel_cred = mac_lomac_relabel_cred,
2681 .mpo_check_bpfdesc_receive = mac_lomac_check_bpfdesc_receive,
2682 .mpo_check_cred_relabel = mac_lomac_check_cred_relabel,
2683 .mpo_check_cred_visible = mac_lomac_check_cred_visible,
2684 .mpo_check_ifnet_relabel = mac_lomac_check_ifnet_relabel,
2685 .mpo_check_ifnet_transmit = mac_lomac_check_ifnet_transmit,
2686 .mpo_check_inpcb_deliver = mac_lomac_check_inpcb_deliver,
2687 .mpo_check_kld_load = mac_lomac_check_kld_load,
2688 .mpo_check_kld_unload = mac_lomac_check_kld_unload,
2689 .mpo_check_pipe_ioctl = mac_lomac_check_pipe_ioctl,
2690 .mpo_check_pipe_read = mac_lomac_check_pipe_read,
2691 .mpo_check_pipe_relabel = mac_lomac_check_pipe_relabel,
2692 .mpo_check_pipe_write = mac_lomac_check_pipe_write,
2693 .mpo_check_proc_debug = mac_lomac_check_proc_debug,
2694 .mpo_check_proc_sched = mac_lomac_check_proc_sched,
2695 .mpo_check_proc_signal = mac_lomac_check_proc_signal,
2696 .mpo_check_socket_deliver = mac_lomac_check_socket_deliver,
2697 .mpo_check_socket_relabel = mac_lomac_check_socket_relabel,
2698 .mpo_check_socket_visible = mac_lomac_check_socket_visible,
2699 .mpo_check_system_swapon = mac_lomac_check_system_swapon,
2700 .mpo_check_system_sysctl = mac_lomac_check_system_sysctl,
2701 .mpo_check_vnode_access = mac_lomac_check_vnode_open,
2702 .mpo_check_vnode_create = mac_lomac_check_vnode_create,
2703 .mpo_check_vnode_delete = mac_lomac_check_vnode_delete,
2704 .mpo_check_vnode_deleteacl = mac_lomac_check_vnode_deleteacl,
2705 .mpo_check_vnode_link = mac_lomac_check_vnode_link,
2706 .mpo_check_vnode_mmap = mac_lomac_check_vnode_mmap,
2707 .mpo_check_vnode_mmap_downgrade = mac_lomac_check_vnode_mmap_downgrade,
2708 .mpo_check_vnode_open = mac_lomac_check_vnode_open,
2709 .mpo_check_vnode_read = mac_lomac_check_vnode_read,
2710 .mpo_check_vnode_relabel = mac_lomac_check_vnode_relabel,
2711 .mpo_check_vnode_rename_from = mac_lomac_check_vnode_rename_from,
2712 .mpo_check_vnode_rename_to = mac_lomac_check_vnode_rename_to,
2713 .mpo_check_vnode_revoke = mac_lomac_check_vnode_revoke,
2714 .mpo_check_vnode_setacl = mac_lomac_check_vnode_setacl,
2715 .mpo_check_vnode_setextattr = mac_lomac_check_vnode_setextattr,
2716 .mpo_check_vnode_setflags = mac_lomac_check_vnode_setflags,
2717 .mpo_check_vnode_setmode = mac_lomac_check_vnode_setmode,
2718 .mpo_check_vnode_setowner = mac_lomac_check_vnode_setowner,
2719 .mpo_check_vnode_setutimes = mac_lomac_check_vnode_setutimes,
2720 .mpo_check_vnode_write = mac_lomac_check_vnode_write,
2721 .mpo_thread_userret = mac_lomac_thread_userret,
2722 };
2723
2724 MAC_POLICY_SET(&mac_lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC",
2725 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS,
2726 &mac_lomac_slot);
Cache object: 0b4e92eabf542efbf10e2dd080f2bc0c
|