Date: Fri, 24 Oct 2003 20:12:09 -0700 (PDT) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 40448 for review Message-ID: <200310250312.h9P3C9Jv049556@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=40448 Change 40448 by rwatson@rwatson_tislabs on 2003/10/24 20:11:25 Integrate trustedbsd_sebsd up to trustedbsd_mac HEAD. This brings in the removal of much object-specific logic from kern_mac.c, now found in sys/security/mac/mac*.[ch]. Affected files ... .. //depot/projects/trustedbsd/sebsd/sys/conf/files#6 edit .. //depot/projects/trustedbsd/sebsd/sys/kern/kern_mac.c#14 edit Differences ... ==== //depot/projects/trustedbsd/sebsd/sys/conf/files#6 (text+ko) ==== @@ -1589,6 +1589,15 @@ posix4/p1003_1b.c standard posix4/posix4_mib.c standard kern/uipc_sem.c optional p1003_1b_semaphores +security/mac/mac_net.c optional mac +security/mac/mac_pipe.c optional mac +security/mac/mac_posix_sem.c optional mac +security/mac/mac_process.c optional mac +security/mac/mac_system.c optional mac +security/mac/mac_sysv_msg.c optional mac +security/mac/mac_sysv_sem.c optional mac +security/mac/mac_sysv_shm.c optional mac +security/mac/mac_vfs.c optional mac security/mac_biba/mac_biba.c optional mac_biba security/mac_bsdextended/mac_bsdextended.c optional mac_bsdextended security/mac_ifoff/mac_ifoff.c optional mac_ifoff ==== //depot/projects/trustedbsd/sebsd/sys/kern/kern_mac.c#14 (text+ko) ==== @@ -44,7 +44,6 @@ #include "opt_mac.h" #include "opt_devfs.h" -#include "opt_posix.h" #include <sys/param.h> #include <sys/condvar.h> @@ -69,12 +68,6 @@ #include <sys/pipe.h> #include <sys/socketvar.h> #include <sys/sysctl.h> -#include <sys/msg.h> -#include <sys/msg_msg.h> -#include <sys/sem.h> -#include <sys/shm.h> - -#include <posix4/ksem.h> #include <vm/vm.h> #include <vm/pmap.h> @@ -92,6 +85,8 @@ #include <netinet/in.h> #include <netinet/ip_var.h> +#include <security/mac/mac_internal.h> + #ifdef MAC /* @@ -101,8 +96,6 @@ */ MODULE_VERSION(kernel_mac_support, 1); -SYSCTL_DECL(_security); - SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); @@ -120,13 +113,7 @@ * access to this variable is serialized during the boot process. Following * the end of serialization, we don't update this flag; no locking. */ -static int mac_late = 0; - -/* - * Warn about EA transactions only the first time they happen. - * Weak coherency, no locking. - */ -static int ea_warn_once = 0; +int mac_late = 0; /* * Flag to indicate whether or not we should allocate label storage for @@ -140,152 +127,23 @@ * be a problem. Note: currently no locking. Will this be a problem? */ #ifndef MAC_ALWAYS_LABEL_MBUF -static int mac_labelmbufs = 0; +int mac_labelmbufs = 0; #endif -static int mac_enforce_fs = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, - &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); -TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); - -static int mac_enforce_file = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_file, CTLFLAG_RW, - &mac_enforce_file, 0, "Enforce MAC policy on file descriptors"); -TUNABLE_INT("security.mac.enforce_file", &mac_enforce_file); - -static int mac_enforce_kld = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_kld, CTLFLAG_RW, - &mac_enforce_kld, 0, "Enforce MAC policy on kld operations"); -TUNABLE_INT("security.mac.enforce_kld", &mac_enforce_kld); - -static int mac_enforce_network = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, - &mac_enforce_network, 0, "Enforce MAC policy on network packets"); -TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); - -static int mac_enforce_pipe = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, - &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); -TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); - -static int mac_enforce_posix_sem = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_posix_sem, CTLFLAG_RW, - &mac_enforce_posix_sem, 0, "Enforce MAC policy on global POSIX semaphores"); -TUNABLE_INT("security.mac.enforce_posix_sem", &mac_enforce_posix_sem); - -static int mac_enforce_process = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, - &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); -TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); - -static int mac_enforce_socket = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, - &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); -TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); - -static int mac_enforce_system = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_system, CTLFLAG_RW, - &mac_enforce_system, 0, "Enforce MAC policy on system operations"); -TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system); - -static int mac_enforce_sysv = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_sysv, CTLFLAG_RW, - &mac_enforce_sysv, 0, "Enforce MAC policy on System V IPC objects"); -TUNABLE_INT("security.mac.enforce_sysv", &mac_enforce_sysv); - -static int mac_enforce_vm = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, - &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); -TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); - -static int mac_mmap_revocation = 0; -SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, - &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " - "relabel"); - -static int mac_mmap_revocation_via_cow = 1; -SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, - &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " - "copy-on-write semantics, or by removing all write access"); - #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); - -static int mac_debug_label_fallback = 0; -SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, - &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" - "when label is corrupted."); -TUNABLE_INT("security.mac.debug_label_fallback", - &mac_debug_label_fallback); - SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); -static unsigned int nmacmbufs, nmaccreds, nmacfiles, nmacifnets, nmacbpfdescs, - nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, - nmacipqs, nmacpipes, nmacprocs, nmacipcmsgs, nmacipcmsqs, - nmacipcsemas, nmacipcshms, nmacposixksems; - -#define MAC_DEBUG_COUNTER_INC(x) atomic_add_int(x, 1); -#define MAC_DEBUG_COUNTER_DEC(x) atomic_subtract_int(x, 1); - -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, - &nmacmbufs, 0, "number of mbufs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, - &nmaccreds, 0, "number of ucreds in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, files, CTLFLAG_RD, - &nmacfiles, 0, "number of files in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, - &nmacifnets, 0, "number of ifnets in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, - &nmacipqs, 0, "number of ipqs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, - &nmacbpfdescs, 0, "number of bpfdescs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, - &nmacsockets, 0, "number of sockets in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, - &nmacpipes, 0, "number of pipes in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD, - &nmacprocs, 0, "number of procs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, - &nmacmounts, 0, "number of mounts in use"); +static unsigned int nmactemp; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, - &nmacvnodes, 0, "number of vnodes in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, - &nmacdevfsdirents, 0, "number of devfs dirents inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msgs, CTLFLAG_RD, - &nmacipcmsgs, 0, "number of sysv ipc messages inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msqs, CTLFLAG_RD, - &nmacipcmsqs, 0, "number of sysv ipc message queue identifiers inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_semas, CTLFLAG_RD, - &nmacipcsemas, 0, "number of sysv ipc semaphore identifiers inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_shms, CTLFLAG_RD, - &nmacipcshms, 0, "number of sysv ipc shm identifiers inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, posix_ksems, CTLFLAG_RD, - &nmacposixksems, 0, "number of posix global semaphores inuse"); -#else -#define MAC_DEBUG_COUNTER_INC(x) -#define MAC_DEBUG_COUNTER_DEC(x) #endif -static int error_select(int error1, int error2); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); -static void mac_check_vnode_mmap_downgrade(struct ucred *cred, - struct vnode *vp, int *prot); -static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, - struct ucred *cred, struct vm_map *map); - -static void mac_destroy_socket_label(struct label *label); - -static int mac_setlabel_vnode_extattr(struct ucred *cred, - struct vnode *vp, struct label *intlabel); - -MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage"); /* @@ -311,8 +169,8 @@ static struct cv mac_policy_cv; static int mac_policy_count; #endif -static LIST_HEAD(, mac_policy_conf) mac_policy_list; -static LIST_HEAD(, mac_policy_conf) mac_static_policy_list; +struct mac_policy_list_head mac_policy_list; +struct mac_policy_list_head mac_static_policy_list; /* * We manually invoke WITNESS_WARN() to allow Witness to generate @@ -323,7 +181,7 @@ * framework to become quiescent so that a policy list change may * be made. */ -static __inline void +void mac_policy_grab_exclusive(void) { @@ -336,7 +194,7 @@ #endif } -static __inline void +void mac_policy_assert_exclusive(void) { @@ -347,7 +205,7 @@ #endif } -static __inline void +void mac_policy_release_exclusive(void) { @@ -359,7 +217,7 @@ #endif } -static __inline void +void mac_policy_list_busy(void) { @@ -370,7 +228,7 @@ #endif } -static __inline int +int mac_policy_list_conditional_busy(void) { #ifndef MAC_STATIC @@ -389,7 +247,7 @@ #endif } -static __inline void +void mac_policy_list_unbusy(void) { @@ -404,152 +262,6 @@ } /* - * MAC_CHECK performs the designated check by walking the policy - * module list and checking with each as to how it feels about the - * request. Note that it returns its value via 'error' in the scope - * of the caller. - */ -#define MAC_CHECK(check, args...) do { \ - struct mac_policy_conf *mpc; \ - int entrycount; \ - \ - error = 0; \ - LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## check != NULL) \ - error = error_select( \ - mpc->mpc_ops->mpo_ ## check (args), \ - error); \ - } \ - if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \ - LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## check != NULL) \ - error = error_select( \ - mpc->mpc_ops->mpo_ ## check (args), \ - error); \ - } \ - mac_policy_list_unbusy(); \ - } \ -} while (0) - -/* - * MAC_BOOLEAN performs the designated boolean composition by walking - * the module list, invoking each instance of the operation, and - * combining the results using the passed C operator. Note that it - * returns its value via 'result' in the scope of the caller, which - * should be initialized by the caller in a meaningful way to get - * a meaningful result. - */ -#define MAC_BOOLEAN(operation, composition, args...) do { \ - struct mac_policy_conf *mpc; \ - int entrycount; \ - \ - LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - result = result composition \ - mpc->mpc_ops->mpo_ ## operation (args); \ - } \ - if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \ - LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - result = result composition \ - mpc->mpc_ops->mpo_ ## operation \ - (args); \ - } \ - mac_policy_list_unbusy(); \ - } \ -} while (0) - -#define MAC_EXTERNALIZE(type, label, elementlist, outbuf, \ - outbuflen) do { \ - int claimed, first, ignorenotfound, savedlen; \ - char *element_name, *element_temp; \ - struct sbuf sb; \ - \ - error = 0; \ - first = 1; \ - sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN); \ - element_temp = elementlist; \ - while ((element_name = strsep(&element_temp, ",")) != NULL) { \ - if (element_name[0] == '?') { \ - element_name++; \ - ignorenotfound = 1; \ - } else \ - ignorenotfound = 0; \ - savedlen = sbuf_len(&sb); \ - if (first == 1) \ - error = sbuf_printf(&sb, "%s/", element_name); \ - else \ - error = sbuf_printf(&sb, ",%s/", element_name); \ - if (error == -1) { \ - error = EINVAL; /* XXX: E2BIG? */ \ - break; \ - } \ - claimed = 0; \ - MAC_CHECK(externalize_ ## type, label, element_name, \ - &sb, &claimed); \ - if (error) \ - break; \ - if (claimed == 0 && ignorenotfound) { \ - /* Revert last label name. */ \ - sbuf_setpos(&sb, savedlen); \ - } else if (claimed != 1) { \ - error = EINVAL; /* XXX: ENOLABEL? */ \ - break; \ - } else { \ - first = 0; \ - } \ - } \ - sbuf_finish(&sb); \ -} while (0) - -#define MAC_INTERNALIZE(type, label, instring) do { \ - char *element, *element_name, *element_data; \ - int claimed; \ - \ - error = 0; \ - element = instring; \ - while ((element_name = strsep(&element, ",")) != NULL) { \ - element_data = element_name; \ - element_name = strsep(&element_data, "/"); \ - if (element_data == NULL) { \ - error = EINVAL; \ - break; \ - } \ - claimed = 0; \ - MAC_CHECK(internalize_ ## type, label, element_name, \ - element_data, &claimed); \ - if (error) \ - break; \ - if (claimed != 1) { \ - /* XXXMAC: Another error here? */ \ - error = EINVAL; \ - break; \ - } \ - } \ -} while (0) - -/* - * MAC_PERFORM performs the designated operation by walking the policy - * module list and invoking that operation for each policy. - */ -#define MAC_PERFORM(operation, args...) do { \ - struct mac_policy_conf *mpc; \ - int entrycount; \ - \ - LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - mpc->mpc_ops->mpo_ ## operation (args); \ - } \ - if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \ - LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - mpc->mpc_ops->mpo_ ## operation (args); \ - } \ - mac_policy_list_unbusy(); \ - } \ -} while (0) - -/* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void @@ -775,8 +487,8 @@ * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ -static int -error_select(int error1, int error2) +int +mac_error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ @@ -808,19 +520,7 @@ return (error2); } -static struct label * -mbuf_to_label(struct mbuf *mbuf) -{ - struct m_tag *tag; - struct label *label; - - tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL); - label = (struct label *)(tag+1); - - return (label); -} - -static void +void mac_init_label(struct label *label) { @@ -828,7 +528,7 @@ label->l_flags = MAC_FLAG_INITIALIZED; } -static void +void mac_destroy_label(struct label *label) { @@ -839,536 +539,7 @@ /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } -void -mac_init_bpfdesc(struct bpf_d *bpf_d) -{ - - mac_init_label(&bpf_d->bd_label); - MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); - MAC_DEBUG_COUNTER_INC(&nmacbpfdescs); -} - -static void -mac_init_cred_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_cred_label, label); - MAC_DEBUG_COUNTER_INC(&nmaccreds); -} - -void -mac_init_cred(struct ucred *cred) -{ - - mac_init_cred_label(&cred->cr_label); -} - -void -mac_init_devfsdirent(struct devfs_dirent *de) -{ - - mac_init_label(&de->de_label); - MAC_PERFORM(init_devfsdirent_label, &de->de_label); - MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents); -} - -void -mac_init_file(struct file *fp) -{ - - mac_init_label(&fp->f_label); - MAC_PERFORM(init_file_label, &fp->f_label); - MAC_DEBUG_COUNTER_INC(&nmacfiles); -} - -static void -mac_init_ifnet_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_ifnet_label, label); - MAC_DEBUG_COUNTER_INC(&nmacifnets); -} - -void -mac_init_ifnet(struct ifnet *ifp) -{ - - mac_init_ifnet_label(&ifp->if_label); -} - -void -mac_init_ipc_msgmsg(struct msg *msgptr) -{ - - mac_init_label(&msgptr->label); - MAC_PERFORM(init_ipc_msgmsg_label, &msgptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcmsgs); -} - -void -mac_init_ipc_msgqueue(struct msqid_kernel *msqkptr) -{ - - mac_init_label(&msqkptr->label); - MAC_PERFORM(init_ipc_msgqueue_label, &msqkptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcmsqs); -} - -void -mac_init_ipc_sema(struct semid_kernel *semakptr) -{ - - mac_init_label(&semakptr->label); - MAC_PERFORM(init_ipc_sema_label, &semakptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcsemas); -} - -void -mac_init_ipc_shm(struct shmid_kernel *shmsegptr) -{ - - mac_init_label(&shmsegptr->label); - MAC_PERFORM(init_ipc_shm_label, &shmsegptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcshms); -} - -int -mac_init_ipq(struct ipq *ipq, int flag) -{ - int error; - - mac_init_label(&ipq->ipq_label); - - MAC_CHECK(init_ipq_label, &ipq->ipq_label, flag); - if (error) { - MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); - mac_destroy_label(&ipq->ipq_label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacipqs); - } - return (error); -} - int -mac_init_mbuf_tag(struct m_tag *tag, int flag) -{ - struct label *label; - int error; - - label = (struct label *) (tag + 1); - mac_init_label(label); - - MAC_CHECK(init_mbuf_label, label, flag); - if (error) { - MAC_PERFORM(destroy_mbuf_label, label); - mac_destroy_label(label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacmbufs); - } - return (error); -} - -int -mac_init_mbuf(struct mbuf *m, int flag) -{ - struct m_tag *tag; - int error; - - M_ASSERTPKTHDR(m); - -#ifndef MAC_ALWAYS_LABEL_MBUF - /* - * If conditionally allocating mbuf labels, don't allocate unless - * they are required. - */ - if (!mac_labelmbufs) - return (0); -#endif - tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label), - flag); - if (tag == NULL) - return (ENOMEM); - error = mac_init_mbuf_tag(tag, flag); - if (error) { - m_tag_free(tag); - return (error); - } - m_tag_prepend(m, tag); - return (0); -} - -void -mac_init_mount(struct mount *mp) -{ - - mac_init_label(&mp->mnt_mntlabel); - mac_init_label(&mp->mnt_fslabel); - MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); - MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); - MAC_DEBUG_COUNTER_INC(&nmacmounts); -} - -static void -mac_init_pipe_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_pipe_label, label); - MAC_DEBUG_COUNTER_INC(&nmacpipes); -} - -void -mac_init_pipe(struct pipe *pipe) -{ - struct label *label; - - label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); - pipe->pipe_label = label; - pipe->pipe_peer->pipe_label = label; - mac_init_pipe_label(label); -} - -void -mac_init_posix_ksem(struct ksem *ksemptr) -{ - - mac_init_label(&ksemptr->ks_label); - MAC_PERFORM(init_posix_ksem_label, &ksemptr->ks_label); - MAC_DEBUG_COUNTER_INC(&nmacposixksems); -} - -void -mac_init_proc(struct proc *p) -{ - - mac_init_label(&p->p_label); - MAC_PERFORM(init_proc_label, &p->p_label); - MAC_DEBUG_COUNTER_INC(&nmacprocs); -} - -static int -mac_init_socket_label(struct label *label, int flag) -{ - int error; - - mac_init_label(label); - - MAC_CHECK(init_socket_label, label, flag); - if (error) { - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacsockets); - } - - return (error); -} - -static int -mac_init_socket_peer_label(struct label *label, int flag) -{ - int error; - - mac_init_label(label); - - MAC_CHECK(init_socket_peer_label, label, flag); - if (error) { - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - } - - return (error); -} - -int -mac_init_socket(struct socket *socket, int flag) -{ - int error; - - error = mac_init_socket_label(&socket->so_label, flag); - if (error) - return (error); - - error = mac_init_socket_peer_label(&socket->so_peerlabel, flag); - if (error) - mac_destroy_socket_label(&socket->so_label); - - return (error); -} - -void -mac_init_vnode_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_vnode_label, label); - MAC_DEBUG_COUNTER_INC(&nmacvnodes); -} - -void -mac_init_mount_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_mount_label, label); -} - -void -mac_init_vnode(struct vnode *vp) -{ - - mac_init_vnode_label(&vp->v_label); -} - -void -mac_destroy_bpfdesc(struct bpf_d *bpf_d) -{ - - MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); - mac_destroy_label(&bpf_d->bd_label); - MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs); -} - -static void -mac_destroy_cred_label(struct label *label) -{ - - MAC_PERFORM(destroy_cred_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmaccreds); -} - -void -mac_destroy_cred(struct ucred *cred) -{ - - mac_destroy_cred_label(&cred->cr_label); -} - -void -mac_destroy_devfsdirent(struct devfs_dirent *de) -{ - - MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); - mac_destroy_label(&de->de_label); - MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents); -} - -void -mac_destroy_file(struct file *fp) -{ - - MAC_PERFORM(destroy_file_label, &fp->f_label); - mac_destroy_label(&fp->f_label); - MAC_DEBUG_COUNTER_DEC(&nmacfiles); -} - -static void -mac_destroy_ifnet_label(struct label *label) -{ - - MAC_PERFORM(destroy_ifnet_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacifnets); -} - -void -mac_destroy_ifnet(struct ifnet *ifp) -{ - - mac_destroy_ifnet_label(&ifp->if_label); -} - -void -mac_destroy_ipc_msgmsg(struct msg *msgptr) -{ - - MAC_PERFORM(destroy_ipc_msgmsg_label, &msgptr->label); - mac_destroy_label(&msgptr->label); - MAC_DEBUG_COUNTER_DEC(&nmacipcmsgs); -} - -void -mac_destroy_ipc_msgqueue(struct msqid_kernel *msqkptr) -{ - - MAC_PERFORM(destroy_ipc_msgqueue_label, &msqkptr->label); - mac_destroy_label(&msqkptr->label); - MAC_DEBUG_COUNTER_DEC(&nmacipcmsqs); -} - -void -mac_destroy_ipc_sema(struct semid_kernel *semakptr) -{ - - MAC_PERFORM(destroy_ipc_sema_label, &semakptr->label); - mac_destroy_label(&semakptr->label); - MAC_DEBUG_COUNTER_DEC(&nmacipcsemas); -} - -void -mac_destroy_ipc_shm(struct shmid_kernel *shmsegptr) -{ - - MAC_PERFORM(destroy_ipc_shm_label, &shmsegptr->label); - mac_destroy_label(&shmsegptr->label); - MAC_DEBUG_COUNTER_DEC(&nmacipcshms); -} - -void -mac_destroy_ipq(struct ipq *ipq) -{ - - MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); - mac_destroy_label(&ipq->ipq_label); - MAC_DEBUG_COUNTER_DEC(&nmacipqs); -} - -void -mac_destroy_mbuf_tag(struct m_tag *tag) -{ - struct label *label; - - label = (struct label *)(tag+1); - - MAC_PERFORM(destroy_mbuf_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacmbufs); -} - -void -mac_destroy_mount(struct mount *mp) -{ - - MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); - MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); - mac_destroy_label(&mp->mnt_fslabel); - mac_destroy_label(&mp->mnt_mntlabel); - MAC_DEBUG_COUNTER_DEC(&nmacmounts); -} - -static void -mac_destroy_pipe_label(struct label *label) -{ - - MAC_PERFORM(destroy_pipe_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacpipes); -} - -void -mac_destroy_pipe(struct pipe *pipe) -{ - - mac_destroy_pipe_label(pipe->pipe_label); - free(pipe->pipe_label, M_MACPIPELABEL); -} - -void -mac_destroy_posix_ksem(struct ksem *ksemptr) -{ - - MAC_PERFORM(destroy_posix_ksem_label, &ksemptr->ks_label); - mac_destroy_label(&ksemptr->ks_label); - MAC_DEBUG_COUNTER_DEC(&nmacposixksems); -} - -void -mac_destroy_proc(struct proc *p) -{ - - MAC_PERFORM(destroy_proc_label, &p->p_label); - mac_destroy_label(&p->p_label); - MAC_DEBUG_COUNTER_DEC(&nmacprocs); -} - -static void -mac_destroy_socket_label(struct label *label) -{ - - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacsockets); -} - -static void -mac_destroy_socket_peer_label(struct label *label) -{ - - MAC_PERFORM(destroy_socket_peer_label, label); - mac_destroy_label(label); -} - -void -mac_destroy_socket(struct socket *socket) -{ - - mac_destroy_socket_label(&socket->so_label); - mac_destroy_socket_peer_label(&socket->so_peerlabel); -} - -void -mac_destroy_vnode_label(struct label *label) -{ - - MAC_PERFORM(destroy_vnode_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacvnodes); -} - -void -mac_destroy_vnode(struct vnode *vp) -{ - - mac_destroy_vnode_label(&vp->v_label); -} - -void -mac_destroy_mount_label(struct label *label) -{ - - MAC_PERFORM(destroy_mount_label, label); - mac_destroy_label(label); -} - >>> TRUNCATED FOR MAIL (1000 lines) <<<
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200310250312.h9P3C9Jv049556>