The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/sys/mac.h

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1999-2002 Robert N. M. Watson
    3  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
    4  * All rights reserved.
    5  *
    6  * This software was developed by Robert Watson for the TrustedBSD Project.
    7  *
    8  * This software was developed for the FreeBSD Project in part by Network
    9  * Associates Laboratories, the Security Research Division of Network
   10  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
   11  * as part of the DARPA CHATS research program.
   12  *
   13  * Redistribution and use in source and binary forms, with or without
   14  * modification, are permitted provided that the following conditions
   15  * are met:
   16  * 1. Redistributions of source code must retain the above copyright
   17  *    notice, this list of conditions and the following disclaimer.
   18  * 2. Redistributions in binary form must reproduce the above copyright
   19  *    notice, this list of conditions and the following disclaimer in the
   20  *    documentation and/or other materials provided with the distribution.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  *
   34  * $FreeBSD$
   35  */
   36 /*
   37  * Userland/kernel interface for Mandatory Access Control.
   38  *
   39  * The POSIX.1e implementation page may be reached at:
   40  * http://www.trustedbsd.org/
   41  */
   42 #ifndef _SYS_MAC_H_
   43 #define _SYS_MAC_H_
   44 
   45 #include <sys/_label.h>
   46 
   47 #ifndef _POSIX_MAC
   48 #define _POSIX_MAC
   49 #endif
   50 
   51 /*
   52  * MAC framework-related constants and limits.
   53  */
   54 #define MAC_MAX_POLICY_NAME             32
   55 #define MAC_MAX_LABEL_ELEMENT_NAME      32
   56 #define MAC_MAX_LABEL_ELEMENT_DATA      4096
   57 #define MAC_MAX_LABEL_BUF_LEN           8192
   58 
   59 struct mac {
   60         size_t           m_buflen;
   61         char            *m_string;
   62 };
   63 
   64 typedef struct mac      *mac_t;
   65 
   66 #ifndef _KERNEL
   67 
   68 /*
   69  * Location of the userland MAC framework configuration file.  mac.conf
   70  * binds policy names to shared libraries that understand those policies,
   71  * as well as setting defaults for MAC-aware applications.
   72  */
   73 #define MAC_CONFFILE    "/etc/mac.conf"
   74 
   75 /*
   76  * Extended non-POSIX.1e interfaces that offer additional services
   77  * available from the userland and kernel MAC frameworks.
   78  */
   79 __BEGIN_DECLS
   80 int      mac_execve(char *fname, char **argv, char **envv, mac_t _label);
   81 int      mac_free(mac_t _label);
   82 int      mac_from_text(mac_t *_label, const char *_text);
   83 int      mac_get_fd(int _fd, mac_t _label);
   84 int      mac_get_file(const char *_path, mac_t _label);
   85 int      mac_get_link(const char *_path, mac_t _label);
   86 int      mac_get_peer(int _fd, mac_t _label);
   87 int      mac_get_pid(pid_t _pid, mac_t _label);
   88 int      mac_get_proc(mac_t _label);
   89 int      mac_is_present(const char *_policyname);
   90 int      mac_prepare(mac_t *_label, const char *_elements);
   91 int      mac_prepare_file_label(mac_t *_label);
   92 int      mac_prepare_ifnet_label(mac_t *_label);
   93 int      mac_prepare_process_label(mac_t *_label);
   94 int      mac_prepare_type(mac_t *_label, const char *_type);
   95 int      mac_set_fd(int _fildes, const mac_t _label);
   96 int      mac_set_file(const char *_path, mac_t _label);
   97 int      mac_set_link(const char *_path, mac_t _label);
   98 int      mac_set_proc(const mac_t _label);
   99 int      mac_syscall(const char *_policyname, int _call, void *_arg);
  100 int      mac_to_text(mac_t mac, char **_text);
  101 __END_DECLS
  102 
  103 #else /* _KERNEL */
  104 
  105 /*
  106  * Kernel functions to manage and evaluate labels.
  107  */
  108 struct bpf_d;
  109 struct cdev;
  110 struct componentname;
  111 struct devfs_dirent;
  112 struct ifnet;
  113 struct ifreq;
  114 struct inpcb;
  115 struct image_params;
  116 struct inpcb;
  117 struct ipq;
  118 struct m_tag;
  119 struct mbuf;
  120 struct mount;
  121 struct proc;
  122 struct sockaddr;
  123 struct socket;
  124 struct sysctl_oid;
  125 struct sysctl_req;
  126 struct pipepair;
  127 struct thread;
  128 struct timespec;
  129 struct ucred;
  130 struct uio;
  131 struct vattr;
  132 struct vnode;
  133 
  134 #include <sys/acl.h>                    /* XXX acl_type_t */
  135 
  136 struct vop_setlabel_args;
  137 
  138 /*
  139  * Label operations.
  140  */
  141 void    mac_init_bpfdesc(struct bpf_d *);
  142 void    mac_init_cred(struct ucred *);
  143 void    mac_init_devfsdirent(struct devfs_dirent *);
  144 void    mac_init_ifnet(struct ifnet *);
  145 int     mac_init_inpcb(struct inpcb *, int flag);
  146 int     mac_init_ipq(struct ipq *, int flag);
  147 int     mac_init_socket(struct socket *, int flag);
  148 void    mac_init_pipe(struct pipepair *);
  149 int     mac_init_mbuf(struct mbuf *mbuf, int flag);
  150 int     mac_init_mbuf_tag(struct m_tag *, int flag);
  151 void    mac_init_mount(struct mount *);
  152 void    mac_init_proc(struct proc *);
  153 void    mac_init_vnode(struct vnode *);
  154 void    mac_copy_mbuf_tag(struct m_tag *, struct m_tag *);
  155 void    mac_copy_vnode_label(struct label *, struct label *label);
  156 void    mac_destroy_bpfdesc(struct bpf_d *);
  157 void    mac_destroy_cred(struct ucred *);
  158 void    mac_destroy_devfsdirent(struct devfs_dirent *);
  159 void    mac_destroy_ifnet(struct ifnet *);
  160 void    mac_destroy_inpcb(struct inpcb *);
  161 void    mac_destroy_ipq(struct ipq *);
  162 void    mac_destroy_socket(struct socket *);
  163 void    mac_destroy_pipe(struct pipepair *);
  164 void    mac_destroy_proc(struct proc *);
  165 void    mac_destroy_mbuf_tag(struct m_tag *);
  166 void    mac_destroy_mount(struct mount *);
  167 void    mac_destroy_vnode(struct vnode *);
  168 
  169 struct label    *mac_cred_label_alloc(void);
  170 void             mac_cred_label_free(struct label *label);
  171 struct label    *mac_vnode_label_alloc(void);
  172 void             mac_vnode_label_free(struct label *label);
  173 
  174 /*
  175  * Labeling event operations: file system objects, and things that
  176  * look a lot like file system objects.
  177  */
  178 void    mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
  179             struct vnode *vp);
  180 int     mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp);
  181 void    mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp);
  182 void    mac_create_devfs_device(struct mount *mp, struct cdev *dev,
  183             struct devfs_dirent *de);
  184 void    mac_create_devfs_directory(struct mount *mp, char *dirname,
  185             int dirnamelen, struct devfs_dirent *de);
  186 void    mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
  187             struct devfs_dirent *dd, struct devfs_dirent *de);
  188 int     mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
  189             struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
  190 void    mac_create_mount(struct ucred *cred, struct mount *mp);
  191 void    mac_create_root_mount(struct ucred *cred, struct mount *mp);
  192 void    mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
  193             struct label *newlabel);
  194 void    mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
  195             struct vnode *vp);
  196 
  197 /*
  198  * Labeling event operations: IPC objects.
  199  */
  200 void    mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m);
  201 void    mac_create_socket(struct ucred *cred, struct socket *socket);
  202 void    mac_create_socket_from_socket(struct socket *oldsocket,
  203             struct socket *newsocket);
  204 void    mac_set_socket_peer_from_mbuf(struct mbuf *mbuf,
  205             struct socket *socket);
  206 void    mac_set_socket_peer_from_socket(struct socket *oldsocket,
  207             struct socket *newsocket);
  208 void    mac_create_pipe(struct ucred *cred, struct pipepair *pp);
  209 
  210 /*
  211  * Labeling event operations: network objects.
  212  */
  213 void    mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d);
  214 void    mac_create_ifnet(struct ifnet *ifp);
  215 void    mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp);
  216 void    mac_create_ipq(struct mbuf *fragment, struct ipq *ipq);
  217 void    mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram);
  218 void    mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment);
  219 void    mac_create_mbuf_from_inpcb(struct inpcb *inp, struct mbuf *m);
  220 void    mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf);
  221 void    mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *m);
  222 void    mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m);
  223 void    mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *m);
  224 void    mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf,
  225             struct ifnet *ifnet, struct mbuf *newmbuf);
  226 void    mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf);
  227 int     mac_fragment_match(struct mbuf *fragment, struct ipq *ipq);
  228 void    mac_reflect_mbuf_icmp(struct mbuf *m);
  229 void    mac_reflect_mbuf_tcp(struct mbuf *m);
  230 void    mac_update_ipq(struct mbuf *fragment, struct ipq *ipq);
  231 void    mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
  232 
  233 /*
  234  * Labeling event operations: processes.
  235  */
  236 void    mac_copy_cred(struct ucred *cr1, struct ucred *cr2);
  237 int     mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
  238 void    mac_execve_exit(struct image_params *imgp);
  239 void    mac_execve_transition(struct ucred *old, struct ucred *new,
  240             struct vnode *vp, struct label *interpvnodelabel,
  241             struct image_params *imgp);
  242 int     mac_execve_will_transition(struct ucred *old, struct vnode *vp,
  243             struct label *interpvnodelabel, struct image_params *imgp);
  244 void    mac_create_proc0(struct ucred *cred);
  245 void    mac_create_proc1(struct ucred *cred);
  246 void    mac_thread_userret(struct thread *td);
  247 
  248 /* Access control checks. */
  249 int     mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
  250 int     mac_check_cred_visible(struct ucred *u1, struct ucred *u2);
  251 int     mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m);
  252 int     mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m);
  253 int     mac_check_kenv_dump(struct ucred *cred);
  254 int     mac_check_kenv_get(struct ucred *cred, char *name);
  255 int     mac_check_kenv_set(struct ucred *cred, char *name, char *value);
  256 int     mac_check_kenv_unset(struct ucred *cred, char *name);
  257 int     mac_check_kld_load(struct ucred *cred, struct vnode *vp);
  258 int     mac_check_kld_stat(struct ucred *cred);
  259 int     mac_check_kld_unload(struct ucred *cred);
  260 int     mac_check_mount_stat(struct ucred *cred, struct mount *mp);
  261 int     mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
  262             unsigned long cmd, void *data);
  263 int     mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp);
  264 int     mac_check_pipe_read(struct ucred *cred, struct pipepair *pp);
  265 int     mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp);
  266 int     mac_check_pipe_write(struct ucred *cred, struct pipepair *pp);
  267 int     mac_check_proc_debug(struct ucred *cred, struct proc *proc);
  268 int     mac_check_proc_sched(struct ucred *cred, struct proc *proc);
  269 int     mac_check_proc_signal(struct ucred *cred, struct proc *proc,
  270             int signum);
  271 int     mac_check_socket_bind(struct ucred *cred, struct socket *so,
  272             struct sockaddr *sockaddr);
  273 int     mac_check_socket_connect(struct ucred *cred, struct socket *so,
  274             struct sockaddr *sockaddr);
  275 int     mac_check_socket_deliver(struct socket *so, struct mbuf *m);
  276 int     mac_check_socket_listen(struct ucred *cred, struct socket *so);
  277 int     mac_check_socket_receive(struct ucred *cred, struct socket *so);
  278 int     mac_check_socket_send(struct ucred *cred, struct socket *so);
  279 int     mac_check_socket_visible(struct ucred *cred, struct socket *so);
  280 int     mac_check_sysarch_ioperm(struct ucred *cred);
  281 int     mac_check_system_acct(struct ucred *cred, struct vnode *vp);
  282 int     mac_check_system_nfsd(struct ucred *cred);
  283 int     mac_check_system_reboot(struct ucred *cred, int howto);
  284 int     mac_check_system_settime(struct ucred *cred);
  285 int     mac_check_system_swapon(struct ucred *cred, struct vnode *vp);
  286 int     mac_check_system_swapoff(struct ucred *cred, struct vnode *vp);
  287 int     mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
  288             void *arg1, int arg2, struct sysctl_req *req);
  289 int     mac_check_vnode_access(struct ucred *cred, struct vnode *vp,
  290             int acc_mode);
  291 int     mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp);
  292 int     mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp);
  293 int     mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
  294             struct componentname *cnp, struct vattr *vap);
  295 int     mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
  296             struct vnode *vp, struct componentname *cnp);
  297 int     mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
  298             acl_type_t type);
  299 int     mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
  300             int attrnamespace, const char *name);
  301 int     mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
  302             struct image_params *imgp);
  303 int     mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
  304             acl_type_t type);
  305 int     mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
  306             int attrnamespace, const char *name, struct uio *uio);
  307 int     mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
  308             struct vnode *vp, struct componentname *cnp);
  309 int     mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
  310             int attrnamespace);
  311 int     mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
  312             struct componentname *cnp);
  313 int     mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
  314             int prot, int flags);
  315 int     mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp,
  316             int prot);
  317 int     mac_check_vnode_open(struct ucred *cred, struct vnode *vp,
  318             int acc_mode);
  319 int     mac_check_vnode_poll(struct ucred *active_cred,
  320             struct ucred *file_cred, struct vnode *vp);
  321 int     mac_check_vnode_read(struct ucred *active_cred,
  322             struct ucred *file_cred, struct vnode *vp);
  323 int     mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp);
  324 int     mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp);
  325 int     mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
  326             struct vnode *vp, struct componentname *cnp);
  327 int     mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
  328             struct vnode *vp, int samedir, struct componentname *cnp);
  329 int     mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp);
  330 int     mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
  331             acl_type_t type, struct acl *acl);
  332 int     mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
  333             int attrnamespace, const char *name, struct uio *uio);
  334 int     mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
  335             u_long flags);
  336 int     mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
  337             mode_t mode);
  338 int     mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
  339             uid_t uid, gid_t gid);
  340 int     mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
  341             struct timespec atime, struct timespec mtime);
  342 int     mac_check_vnode_stat(struct ucred *active_cred,
  343             struct ucred *file_cred, struct vnode *vp);
  344 int     mac_check_vnode_write(struct ucred *active_cred,
  345             struct ucred *file_cred, struct vnode *vp);
  346 int     mac_getsockopt_label(struct ucred *cred, struct socket *so,
  347             struct mac *extmac);
  348 int     mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
  349             struct mac *extmac);
  350 int     mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
  351             struct ifnet *ifnet);
  352 int     mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
  353             struct ifnet *ifnet);
  354 int     mac_setsockopt_label(struct ucred *cred, struct socket *so,
  355             struct mac *extmac);
  356 int     mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
  357             struct label *label);
  358 void    mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred);
  359 
  360 /*
  361  * Calls to help various file systems implement labeling functionality
  362  * using their existing EA implementation.
  363  */
  364 int     vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
  365 
  366 #endif /* !_KERNEL */
  367 
  368 #endif /* !_SYS_MAC_H_ */

Cache object: ab06e0b50b1ccb6b7637e7f871bf6d29


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.