PERFORCE change 40448 for review
Robert Watson
rwatson at FreeBSD.org
Sat Oct 25 03:12:09 GMT 2003
http://perforce.freebsd.org/chv.cgi?CH=40448
Change 40448 by rwatson at rwatson_tislabs on 2003/10/24 20:11:25
Integrate trustedbsd_sebsd up to trustedbsd_mac HEAD. This
brings in the removal of much object-specific logic from
kern_mac.c, now found in sys/security/mac/mac*.[ch].
Affected files ...
.. //depot/projects/trustedbsd/sebsd/sys/conf/files#6 edit
.. //depot/projects/trustedbsd/sebsd/sys/kern/kern_mac.c#14 edit
Differences ...
==== //depot/projects/trustedbsd/sebsd/sys/conf/files#6 (text+ko) ====
@@ -1589,6 +1589,15 @@
posix4/p1003_1b.c standard
posix4/posix4_mib.c standard
kern/uipc_sem.c optional p1003_1b_semaphores
+security/mac/mac_net.c optional mac
+security/mac/mac_pipe.c optional mac
+security/mac/mac_posix_sem.c optional mac
+security/mac/mac_process.c optional mac
+security/mac/mac_system.c optional mac
+security/mac/mac_sysv_msg.c optional mac
+security/mac/mac_sysv_sem.c optional mac
+security/mac/mac_sysv_shm.c optional mac
+security/mac/mac_vfs.c optional mac
security/mac_biba/mac_biba.c optional mac_biba
security/mac_bsdextended/mac_bsdextended.c optional mac_bsdextended
security/mac_ifoff/mac_ifoff.c optional mac_ifoff
==== //depot/projects/trustedbsd/sebsd/sys/kern/kern_mac.c#14 (text+ko) ====
@@ -44,7 +44,6 @@
#include "opt_mac.h"
#include "opt_devfs.h"
-#include "opt_posix.h"
#include <sys/param.h>
#include <sys/condvar.h>
@@ -69,12 +68,6 @@
#include <sys/pipe.h>
#include <sys/socketvar.h>
#include <sys/sysctl.h>
-#include <sys/msg.h>
-#include <sys/msg_msg.h>
-#include <sys/sem.h>
-#include <sys/shm.h>
-
-#include <posix4/ksem.h>
#include <vm/vm.h>
#include <vm/pmap.h>
@@ -92,6 +85,8 @@
#include <netinet/in.h>
#include <netinet/ip_var.h>
+#include <security/mac/mac_internal.h>
+
#ifdef MAC
/*
@@ -101,8 +96,6 @@
*/
MODULE_VERSION(kernel_mac_support, 1);
-SYSCTL_DECL(_security);
-
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
@@ -120,13 +113,7 @@
* access to this variable is serialized during the boot process. Following
* the end of serialization, we don't update this flag; no locking.
*/
-static int mac_late = 0;
-
-/*
- * Warn about EA transactions only the first time they happen.
- * Weak coherency, no locking.
- */
-static int ea_warn_once = 0;
+int mac_late = 0;
/*
* Flag to indicate whether or not we should allocate label storage for
@@ -140,152 +127,23 @@
* be a problem. Note: currently no locking. Will this be a problem?
*/
#ifndef MAC_ALWAYS_LABEL_MBUF
-static int mac_labelmbufs = 0;
+int mac_labelmbufs = 0;
#endif
-static int mac_enforce_fs = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
- &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
-TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
-
-static int mac_enforce_file = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_file, CTLFLAG_RW,
- &mac_enforce_file, 0, "Enforce MAC policy on file descriptors");
-TUNABLE_INT("security.mac.enforce_file", &mac_enforce_file);
-
-static int mac_enforce_kld = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_kld, CTLFLAG_RW,
- &mac_enforce_kld, 0, "Enforce MAC policy on kld operations");
-TUNABLE_INT("security.mac.enforce_kld", &mac_enforce_kld);
-
-static int mac_enforce_network = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
- &mac_enforce_network, 0, "Enforce MAC policy on network packets");
-TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
-
-static int mac_enforce_pipe = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
- &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
-TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe);
-
-static int mac_enforce_posix_sem = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_posix_sem, CTLFLAG_RW,
- &mac_enforce_posix_sem, 0, "Enforce MAC policy on global POSIX semaphores");
-TUNABLE_INT("security.mac.enforce_posix_sem", &mac_enforce_posix_sem);
-
-static int mac_enforce_process = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
- &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
-TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
-
-static int mac_enforce_socket = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
- &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
-TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
-
-static int mac_enforce_system = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_system, CTLFLAG_RW,
- &mac_enforce_system, 0, "Enforce MAC policy on system operations");
-TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system);
-
-static int mac_enforce_sysv = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_sysv, CTLFLAG_RW,
- &mac_enforce_sysv, 0, "Enforce MAC policy on System V IPC objects");
-TUNABLE_INT("security.mac.enforce_sysv", &mac_enforce_sysv);
-
-static int mac_enforce_vm = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
- &mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
-TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm);
-
-static int mac_mmap_revocation = 0;
-SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
- &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
- "relabel");
-
-static int mac_mmap_revocation_via_cow = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
- &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
- "copy-on-write semantics, or by removing all write access");
-
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
-
-static int mac_debug_label_fallback = 0;
-SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
- &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
- "when label is corrupted.");
-TUNABLE_INT("security.mac.debug_label_fallback",
- &mac_debug_label_fallback);
-
SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0,
"TrustedBSD MAC object counters");
-static unsigned int nmacmbufs, nmaccreds, nmacfiles, nmacifnets, nmacbpfdescs,
- nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
- nmacipqs, nmacpipes, nmacprocs, nmacipcmsgs, nmacipcmsqs,
- nmacipcsemas, nmacipcshms, nmacposixksems;
-
-#define MAC_DEBUG_COUNTER_INC(x) atomic_add_int(x, 1);
-#define MAC_DEBUG_COUNTER_DEC(x) atomic_subtract_int(x, 1);
-
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD,
- &nmacmbufs, 0, "number of mbufs in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD,
- &nmaccreds, 0, "number of ucreds in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, files, CTLFLAG_RD,
- &nmacfiles, 0, "number of files in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD,
- &nmacifnets, 0, "number of ifnets in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD,
- &nmacipqs, 0, "number of ipqs in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD,
- &nmacbpfdescs, 0, "number of bpfdescs in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
- &nmacsockets, 0, "number of sockets in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD,
- &nmacpipes, 0, "number of pipes in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD,
- &nmacprocs, 0, "number of procs in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD,
- &nmacmounts, 0, "number of mounts in use");
+static unsigned int nmactemp;
SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD,
&nmactemp, 0, "number of temporary labels in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD,
- &nmacvnodes, 0, "number of vnodes in use");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD,
- &nmacdevfsdirents, 0, "number of devfs dirents inuse");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msgs, CTLFLAG_RD,
- &nmacipcmsgs, 0, "number of sysv ipc messages inuse");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msqs, CTLFLAG_RD,
- &nmacipcmsqs, 0, "number of sysv ipc message queue identifiers inuse");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_semas, CTLFLAG_RD,
- &nmacipcsemas, 0, "number of sysv ipc semaphore identifiers inuse");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_shms, CTLFLAG_RD,
- &nmacipcshms, 0, "number of sysv ipc shm identifiers inuse");
-SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, posix_ksems, CTLFLAG_RD,
- &nmacposixksems, 0, "number of posix global semaphores inuse");
-#else
-#define MAC_DEBUG_COUNTER_INC(x)
-#define MAC_DEBUG_COUNTER_DEC(x)
#endif
-static int error_select(int error1, int error2);
static int mac_policy_register(struct mac_policy_conf *mpc);
static int mac_policy_unregister(struct mac_policy_conf *mpc);
-static void mac_check_vnode_mmap_downgrade(struct ucred *cred,
- struct vnode *vp, int *prot);
-static void mac_cred_mmapped_drop_perms_recurse(struct thread *td,
- struct ucred *cred, struct vm_map *map);
-
-static void mac_destroy_socket_label(struct label *label);
-
-static int mac_setlabel_vnode_extattr(struct ucred *cred,
- struct vnode *vp, struct label *intlabel);
-
-MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage");
/*
@@ -311,8 +169,8 @@
static struct cv mac_policy_cv;
static int mac_policy_count;
#endif
-static LIST_HEAD(, mac_policy_conf) mac_policy_list;
-static LIST_HEAD(, mac_policy_conf) mac_static_policy_list;
+struct mac_policy_list_head mac_policy_list;
+struct mac_policy_list_head mac_static_policy_list;
/*
* We manually invoke WITNESS_WARN() to allow Witness to generate
@@ -323,7 +181,7 @@
* framework to become quiescent so that a policy list change may
* be made.
*/
-static __inline void
+void
mac_policy_grab_exclusive(void)
{
@@ -336,7 +194,7 @@
#endif
}
-static __inline void
+void
mac_policy_assert_exclusive(void)
{
@@ -347,7 +205,7 @@
#endif
}
-static __inline void
+void
mac_policy_release_exclusive(void)
{
@@ -359,7 +217,7 @@
#endif
}
-static __inline void
+void
mac_policy_list_busy(void)
{
@@ -370,7 +228,7 @@
#endif
}
-static __inline int
+int
mac_policy_list_conditional_busy(void)
{
#ifndef MAC_STATIC
@@ -389,7 +247,7 @@
#endif
}
-static __inline void
+void
mac_policy_list_unbusy(void)
{
@@ -404,152 +262,6 @@
}
/*
- * MAC_CHECK performs the designated check by walking the policy
- * module list and checking with each as to how it feels about the
- * request. Note that it returns its value via 'error' in the scope
- * of the caller.
- */
-#define MAC_CHECK(check, args...) do { \
- struct mac_policy_conf *mpc; \
- int entrycount; \
- \
- error = 0; \
- LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \
- if (mpc->mpc_ops->mpo_ ## check != NULL) \
- error = error_select( \
- mpc->mpc_ops->mpo_ ## check (args), \
- error); \
- } \
- if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \
- LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \
- if (mpc->mpc_ops->mpo_ ## check != NULL) \
- error = error_select( \
- mpc->mpc_ops->mpo_ ## check (args), \
- error); \
- } \
- mac_policy_list_unbusy(); \
- } \
-} while (0)
-
-/*
- * MAC_BOOLEAN performs the designated boolean composition by walking
- * the module list, invoking each instance of the operation, and
- * combining the results using the passed C operator. Note that it
- * returns its value via 'result' in the scope of the caller, which
- * should be initialized by the caller in a meaningful way to get
- * a meaningful result.
- */
-#define MAC_BOOLEAN(operation, composition, args...) do { \
- struct mac_policy_conf *mpc; \
- int entrycount; \
- \
- LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \
- if (mpc->mpc_ops->mpo_ ## operation != NULL) \
- result = result composition \
- mpc->mpc_ops->mpo_ ## operation (args); \
- } \
- if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \
- LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \
- if (mpc->mpc_ops->mpo_ ## operation != NULL) \
- result = result composition \
- mpc->mpc_ops->mpo_ ## operation \
- (args); \
- } \
- mac_policy_list_unbusy(); \
- } \
-} while (0)
-
-#define MAC_EXTERNALIZE(type, label, elementlist, outbuf, \
- outbuflen) do { \
- int claimed, first, ignorenotfound, savedlen; \
- char *element_name, *element_temp; \
- struct sbuf sb; \
- \
- error = 0; \
- first = 1; \
- sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN); \
- element_temp = elementlist; \
- while ((element_name = strsep(&element_temp, ",")) != NULL) { \
- if (element_name[0] == '?') { \
- element_name++; \
- ignorenotfound = 1; \
- } else \
- ignorenotfound = 0; \
- savedlen = sbuf_len(&sb); \
- if (first == 1) \
- error = sbuf_printf(&sb, "%s/", element_name); \
- else \
- error = sbuf_printf(&sb, ",%s/", element_name); \
- if (error == -1) { \
- error = EINVAL; /* XXX: E2BIG? */ \
- break; \
- } \
- claimed = 0; \
- MAC_CHECK(externalize_ ## type, label, element_name, \
- &sb, &claimed); \
- if (error) \
- break; \
- if (claimed == 0 && ignorenotfound) { \
- /* Revert last label name. */ \
- sbuf_setpos(&sb, savedlen); \
- } else if (claimed != 1) { \
- error = EINVAL; /* XXX: ENOLABEL? */ \
- break; \
- } else { \
- first = 0; \
- } \
- } \
- sbuf_finish(&sb); \
-} while (0)
-
-#define MAC_INTERNALIZE(type, label, instring) do { \
- char *element, *element_name, *element_data; \
- int claimed; \
- \
- error = 0; \
- element = instring; \
- while ((element_name = strsep(&element, ",")) != NULL) { \
- element_data = element_name; \
- element_name = strsep(&element_data, "/"); \
- if (element_data == NULL) { \
- error = EINVAL; \
- break; \
- } \
- claimed = 0; \
- MAC_CHECK(internalize_ ## type, label, element_name, \
- element_data, &claimed); \
- if (error) \
- break; \
- if (claimed != 1) { \
- /* XXXMAC: Another error here? */ \
- error = EINVAL; \
- break; \
- } \
- } \
-} while (0)
-
-/*
- * MAC_PERFORM performs the designated operation by walking the policy
- * module list and invoking that operation for each policy.
- */
-#define MAC_PERFORM(operation, args...) do { \
- struct mac_policy_conf *mpc; \
- int entrycount; \
- \
- LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \
- if (mpc->mpc_ops->mpo_ ## operation != NULL) \
- mpc->mpc_ops->mpo_ ## operation (args); \
- } \
- if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \
- LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \
- if (mpc->mpc_ops->mpo_ ## operation != NULL) \
- mpc->mpc_ops->mpo_ ## operation (args); \
- } \
- mac_policy_list_unbusy(); \
- } \
-} while (0)
-
-/*
* Initialize the MAC subsystem, including appropriate SMP locks.
*/
static void
@@ -775,8 +487,8 @@
* Define an error value precedence, and given two arguments, selects the
* value with the higher precedence.
*/
-static int
-error_select(int error1, int error2)
+int
+mac_error_select(int error1, int error2)
{
/* Certain decision-making errors take top priority. */
@@ -808,19 +520,7 @@
return (error2);
}
-static struct label *
-mbuf_to_label(struct mbuf *mbuf)
-{
- struct m_tag *tag;
- struct label *label;
-
- tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL);
- label = (struct label *)(tag+1);
-
- return (label);
-}
-
-static void
+void
mac_init_label(struct label *label)
{
@@ -828,7 +528,7 @@
label->l_flags = MAC_FLAG_INITIALIZED;
}
-static void
+void
mac_destroy_label(struct label *label)
{
@@ -839,536 +539,7 @@
/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
}
-void
-mac_init_bpfdesc(struct bpf_d *bpf_d)
-{
-
- mac_init_label(&bpf_d->bd_label);
- MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label);
- MAC_DEBUG_COUNTER_INC(&nmacbpfdescs);
-}
-
-static void
-mac_init_cred_label(struct label *label)
-{
-
- mac_init_label(label);
- MAC_PERFORM(init_cred_label, label);
- MAC_DEBUG_COUNTER_INC(&nmaccreds);
-}
-
-void
-mac_init_cred(struct ucred *cred)
-{
-
- mac_init_cred_label(&cred->cr_label);
-}
-
-void
-mac_init_devfsdirent(struct devfs_dirent *de)
-{
-
- mac_init_label(&de->de_label);
- MAC_PERFORM(init_devfsdirent_label, &de->de_label);
- MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents);
-}
-
-void
-mac_init_file(struct file *fp)
-{
-
- mac_init_label(&fp->f_label);
- MAC_PERFORM(init_file_label, &fp->f_label);
- MAC_DEBUG_COUNTER_INC(&nmacfiles);
-}
-
-static void
-mac_init_ifnet_label(struct label *label)
-{
-
- mac_init_label(label);
- MAC_PERFORM(init_ifnet_label, label);
- MAC_DEBUG_COUNTER_INC(&nmacifnets);
-}
-
-void
-mac_init_ifnet(struct ifnet *ifp)
-{
-
- mac_init_ifnet_label(&ifp->if_label);
-}
-
-void
-mac_init_ipc_msgmsg(struct msg *msgptr)
-{
-
- mac_init_label(&msgptr->label);
- MAC_PERFORM(init_ipc_msgmsg_label, &msgptr->label);
- MAC_DEBUG_COUNTER_INC(&nmacipcmsgs);
-}
-
-void
-mac_init_ipc_msgqueue(struct msqid_kernel *msqkptr)
-{
-
- mac_init_label(&msqkptr->label);
- MAC_PERFORM(init_ipc_msgqueue_label, &msqkptr->label);
- MAC_DEBUG_COUNTER_INC(&nmacipcmsqs);
-}
-
-void
-mac_init_ipc_sema(struct semid_kernel *semakptr)
-{
-
- mac_init_label(&semakptr->label);
- MAC_PERFORM(init_ipc_sema_label, &semakptr->label);
- MAC_DEBUG_COUNTER_INC(&nmacipcsemas);
-}
-
-void
-mac_init_ipc_shm(struct shmid_kernel *shmsegptr)
-{
-
- mac_init_label(&shmsegptr->label);
- MAC_PERFORM(init_ipc_shm_label, &shmsegptr->label);
- MAC_DEBUG_COUNTER_INC(&nmacipcshms);
-}
-
-int
-mac_init_ipq(struct ipq *ipq, int flag)
-{
- int error;
-
- mac_init_label(&ipq->ipq_label);
-
- MAC_CHECK(init_ipq_label, &ipq->ipq_label, flag);
- if (error) {
- MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
- mac_destroy_label(&ipq->ipq_label);
- } else {
- MAC_DEBUG_COUNTER_INC(&nmacipqs);
- }
- return (error);
-}
-
int
-mac_init_mbuf_tag(struct m_tag *tag, int flag)
-{
- struct label *label;
- int error;
-
- label = (struct label *) (tag + 1);
- mac_init_label(label);
-
- MAC_CHECK(init_mbuf_label, label, flag);
- if (error) {
- MAC_PERFORM(destroy_mbuf_label, label);
- mac_destroy_label(label);
- } else {
- MAC_DEBUG_COUNTER_INC(&nmacmbufs);
- }
- return (error);
-}
-
-int
-mac_init_mbuf(struct mbuf *m, int flag)
-{
- struct m_tag *tag;
- int error;
-
- M_ASSERTPKTHDR(m);
-
-#ifndef MAC_ALWAYS_LABEL_MBUF
- /*
- * If conditionally allocating mbuf labels, don't allocate unless
- * they are required.
- */
- if (!mac_labelmbufs)
- return (0);
-#endif
- tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
- flag);
- if (tag == NULL)
- return (ENOMEM);
- error = mac_init_mbuf_tag(tag, flag);
- if (error) {
- m_tag_free(tag);
- return (error);
- }
- m_tag_prepend(m, tag);
- return (0);
-}
-
-void
-mac_init_mount(struct mount *mp)
-{
-
- mac_init_label(&mp->mnt_mntlabel);
- mac_init_label(&mp->mnt_fslabel);
- MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel);
- MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel);
- MAC_DEBUG_COUNTER_INC(&nmacmounts);
-}
-
-static void
-mac_init_pipe_label(struct label *label)
-{
-
- mac_init_label(label);
- MAC_PERFORM(init_pipe_label, label);
- MAC_DEBUG_COUNTER_INC(&nmacpipes);
-}
-
-void
-mac_init_pipe(struct pipe *pipe)
-{
- struct label *label;
-
- label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
- pipe->pipe_label = label;
- pipe->pipe_peer->pipe_label = label;
- mac_init_pipe_label(label);
-}
-
-void
-mac_init_posix_ksem(struct ksem *ksemptr)
-{
-
- mac_init_label(&ksemptr->ks_label);
- MAC_PERFORM(init_posix_ksem_label, &ksemptr->ks_label);
- MAC_DEBUG_COUNTER_INC(&nmacposixksems);
-}
-
-void
-mac_init_proc(struct proc *p)
-{
-
- mac_init_label(&p->p_label);
- MAC_PERFORM(init_proc_label, &p->p_label);
- MAC_DEBUG_COUNTER_INC(&nmacprocs);
-}
-
-static int
-mac_init_socket_label(struct label *label, int flag)
-{
- int error;
-
- mac_init_label(label);
-
- MAC_CHECK(init_socket_label, label, flag);
- if (error) {
- MAC_PERFORM(destroy_socket_label, label);
- mac_destroy_label(label);
- } else {
- MAC_DEBUG_COUNTER_INC(&nmacsockets);
- }
-
- return (error);
-}
-
-static int
-mac_init_socket_peer_label(struct label *label, int flag)
-{
- int error;
-
- mac_init_label(label);
-
- MAC_CHECK(init_socket_peer_label, label, flag);
- if (error) {
- MAC_PERFORM(destroy_socket_label, label);
- mac_destroy_label(label);
- }
-
- return (error);
-}
-
-int
-mac_init_socket(struct socket *socket, int flag)
-{
- int error;
-
- error = mac_init_socket_label(&socket->so_label, flag);
- if (error)
- return (error);
-
- error = mac_init_socket_peer_label(&socket->so_peerlabel, flag);
- if (error)
- mac_destroy_socket_label(&socket->so_label);
-
- return (error);
-}
-
-void
-mac_init_vnode_label(struct label *label)
-{
-
- mac_init_label(label);
- MAC_PERFORM(init_vnode_label, label);
- MAC_DEBUG_COUNTER_INC(&nmacvnodes);
-}
-
-void
-mac_init_mount_label(struct label *label)
-{
-
- mac_init_label(label);
- MAC_PERFORM(init_mount_label, label);
-}
-
-void
-mac_init_vnode(struct vnode *vp)
-{
-
- mac_init_vnode_label(&vp->v_label);
-}
-
-void
-mac_destroy_bpfdesc(struct bpf_d *bpf_d)
-{
-
- MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label);
- mac_destroy_label(&bpf_d->bd_label);
- MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs);
-}
-
-static void
-mac_destroy_cred_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_cred_label, label);
- mac_destroy_label(label);
- MAC_DEBUG_COUNTER_DEC(&nmaccreds);
-}
-
-void
-mac_destroy_cred(struct ucred *cred)
-{
-
- mac_destroy_cred_label(&cred->cr_label);
-}
-
-void
-mac_destroy_devfsdirent(struct devfs_dirent *de)
-{
-
- MAC_PERFORM(destroy_devfsdirent_label, &de->de_label);
- mac_destroy_label(&de->de_label);
- MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents);
-}
-
-void
-mac_destroy_file(struct file *fp)
-{
-
- MAC_PERFORM(destroy_file_label, &fp->f_label);
- mac_destroy_label(&fp->f_label);
- MAC_DEBUG_COUNTER_DEC(&nmacfiles);
-}
-
-static void
-mac_destroy_ifnet_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_ifnet_label, label);
- mac_destroy_label(label);
- MAC_DEBUG_COUNTER_DEC(&nmacifnets);
-}
-
-void
-mac_destroy_ifnet(struct ifnet *ifp)
-{
-
- mac_destroy_ifnet_label(&ifp->if_label);
-}
-
-void
-mac_destroy_ipc_msgmsg(struct msg *msgptr)
-{
-
- MAC_PERFORM(destroy_ipc_msgmsg_label, &msgptr->label);
- mac_destroy_label(&msgptr->label);
- MAC_DEBUG_COUNTER_DEC(&nmacipcmsgs);
-}
-
-void
-mac_destroy_ipc_msgqueue(struct msqid_kernel *msqkptr)
-{
-
- MAC_PERFORM(destroy_ipc_msgqueue_label, &msqkptr->label);
- mac_destroy_label(&msqkptr->label);
- MAC_DEBUG_COUNTER_DEC(&nmacipcmsqs);
-}
-
-void
-mac_destroy_ipc_sema(struct semid_kernel *semakptr)
-{
-
- MAC_PERFORM(destroy_ipc_sema_label, &semakptr->label);
- mac_destroy_label(&semakptr->label);
- MAC_DEBUG_COUNTER_DEC(&nmacipcsemas);
-}
-
-void
-mac_destroy_ipc_shm(struct shmid_kernel *shmsegptr)
-{
-
- MAC_PERFORM(destroy_ipc_shm_label, &shmsegptr->label);
- mac_destroy_label(&shmsegptr->label);
- MAC_DEBUG_COUNTER_DEC(&nmacipcshms);
-}
-
-void
-mac_destroy_ipq(struct ipq *ipq)
-{
-
- MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
- mac_destroy_label(&ipq->ipq_label);
- MAC_DEBUG_COUNTER_DEC(&nmacipqs);
-}
-
-void
-mac_destroy_mbuf_tag(struct m_tag *tag)
-{
- struct label *label;
-
- label = (struct label *)(tag+1);
-
- MAC_PERFORM(destroy_mbuf_label, label);
- mac_destroy_label(label);
- MAC_DEBUG_COUNTER_DEC(&nmacmbufs);
-}
-
-void
-mac_destroy_mount(struct mount *mp)
-{
-
- MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel);
- MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel);
- mac_destroy_label(&mp->mnt_fslabel);
- mac_destroy_label(&mp->mnt_mntlabel);
- MAC_DEBUG_COUNTER_DEC(&nmacmounts);
-}
-
-static void
-mac_destroy_pipe_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_pipe_label, label);
- mac_destroy_label(label);
- MAC_DEBUG_COUNTER_DEC(&nmacpipes);
-}
-
-void
-mac_destroy_pipe(struct pipe *pipe)
-{
-
- mac_destroy_pipe_label(pipe->pipe_label);
- free(pipe->pipe_label, M_MACPIPELABEL);
-}
-
-void
-mac_destroy_posix_ksem(struct ksem *ksemptr)
-{
-
- MAC_PERFORM(destroy_posix_ksem_label, &ksemptr->ks_label);
- mac_destroy_label(&ksemptr->ks_label);
- MAC_DEBUG_COUNTER_DEC(&nmacposixksems);
-}
-
-void
-mac_destroy_proc(struct proc *p)
-{
-
- MAC_PERFORM(destroy_proc_label, &p->p_label);
- mac_destroy_label(&p->p_label);
- MAC_DEBUG_COUNTER_DEC(&nmacprocs);
-}
-
-static void
-mac_destroy_socket_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_socket_label, label);
- mac_destroy_label(label);
- MAC_DEBUG_COUNTER_DEC(&nmacsockets);
-}
-
-static void
-mac_destroy_socket_peer_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_socket_peer_label, label);
- mac_destroy_label(label);
-}
-
-void
-mac_destroy_socket(struct socket *socket)
-{
-
- mac_destroy_socket_label(&socket->so_label);
- mac_destroy_socket_peer_label(&socket->so_peerlabel);
-}
-
-void
-mac_destroy_vnode_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_vnode_label, label);
- mac_destroy_label(label);
- MAC_DEBUG_COUNTER_DEC(&nmacvnodes);
-}
-
-void
-mac_destroy_vnode(struct vnode *vp)
-{
-
- mac_destroy_vnode_label(&vp->v_label);
-}
-
-void
-mac_destroy_mount_label(struct label *label)
-{
-
- MAC_PERFORM(destroy_mount_label, label);
- mac_destroy_label(label);
-}
-
>>> TRUNCATED FOR MAIL (1000 lines) <<<
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message
More information about the trustedbsd-cvs
mailing list