mpo_initPolicy load event. The policy list mutex is held, so sleep operations cannot be performed, and calls out to other kernel subsystems must be made with caution. If potentially sleeping memory allocations are required during policy initialization, they should be made using a separate module SYSINIT().
mpo_destroyPolicy load event. The policy list mutex is held, so caution should be applied.
mpo_syscall| Parameter | Description | Locking |
|---|---|---|
| td | Calling thread | |
| call | Policy-specific syscall number | |
| arg | Pointer to syscall arguments |
This entry point provides a policy-multiplexed system call so that policies may provide additional services to user processes without registering specific system calls. The policy name provided during registration is used to demux calls from userland, and the arguments will be forwarded to this entry point. When implementing new services, security modules should be sure to invoke appropriate access control checks from the MAC framework as needed. For example, if a policy implements an augmented signal functionality, it should call the necessary signal access control checks to invoke the MAC framework and other registered policies.
Note: Modules must currently perform the
copyin()of the syscall data on their own.
mpo_thread_userretThis entry point permits policy modules to perform MAC-related events when a thread returns to user space, via a system call return, trap return, or otherwise. This is required for policies that have floating process labels, as it is not always possible to acquire the process lock at arbitrary points in the stack during system call processing; process labels might represent traditional authentication data, process history information, or other data. To employ this mechanism, intended changes to the process credential label may be stored in the p_label protected by a per-policy spin lock, and then set the per-thread TDF_ASTPENDING flag and per-process PS_MACPENDM flag to schedule a call to the userret entry point. From this entry point, the policy may create a replacement credential with less concern about the locking context. Policy writers are cautioned that event ordering relating to scheduling an AST and the AST being performed may be complex and interlaced in multithreaded applications.
mpo_init_bpfdesc_labelInitialize the label on a newly instantiated bpfdesc (BPF descriptor). Sleeping is permitted.
mpo_init_cred_labelInitialize the label for a newly instantiated user credential. Sleeping is permitted.
mpo_init_devfsdirent_labelInitialize the label on a newly instantiated devfs entry. Sleeping is permitted.
mpo_init_ifnet_labelInitialize the label on a newly instantiated network interface. Sleeping is permitted.
mpo_init_ipq_label| Parameter | Description | Locking |
|---|---|---|
| label | New label to apply | |
| flag | Sleeping/non-sleeping malloc(9); see below |
Initialize the label on a newly instantiated IP fragment reassembly queue. The flag field may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a sleeping malloc(9) during this initialization call. IP fragment reassembly queue allocation frequently occurs in performance sensitive environments, and the implementation should be careful to avoid sleeping or long-lived operations. This entry point is permitted to fail resulting in the failure to allocate the IP fragment reassembly queue.
mpo_init_mbuf_label| Parameter | Description | Locking |
|---|---|---|
| flag | Sleeping/non-sleeping malloc(9); see below | |
| label | Policy label to initialize |
Initialize the label on a newly instantiated mbuf packet header (mbuf). The flag field may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a sleeping malloc(9) during this initialization call. Mbuf allocation frequently occurs in performance sensitive environments, and the implementation should be careful to avoid sleeping or long-lived operations. This entry point is permitted to fail resulting in the failure to allocate the mbuf header.
mpo_init_mount_label| Parameter | Description | Locking |
|---|---|---|
| mntlabel | Policy label to be initialized for the mount itself | |
| fslabel | Policy label to be initialized for the file system |
Initialize the labels on a newly instantiated mount point. Sleeping is permitted.
mpo_init_mount_fs_labelInitialize the label on a newly mounted file system. Sleeping is permitted
mpo_init_pipe_labelInitialize a label for a newly instantiated pipe. Sleeping is permitted.
mpo_init_socket_label| Parameter | Description | Locking |
|---|---|---|
| label | New label to initialize | |
| flag | malloc(9) flags |
Initialize a label for a newly instantiated socket. The flag field may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a sleeping malloc(9) during this initialization call.
mpo_init_socket_peer_label| Parameter | Description | Locking |
|---|---|---|
| label | New label to initialize | |
| flag | malloc(9) flags |
Initialize the peer label for a newly instantiated socket. The flag field may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a sleeping malloc(9) during this initialization call.
mpo_init_proc_labelInitialize the label for a newly instantiated process. Sleeping is permitted.
mpo_init_vnode_labelInitialize the label on a newly instantiated vnode. Sleeping is permitted.
mpo_destroy_bpfdesc_labelDestroy the label on a BPF descriptor. In this entry point a policy should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_cred_labelDestroy the label on a credential. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_devfsdirent_labelDestroy the label on a devfs entry. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_ifnet_labelDestroy the label on a removed interface. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_ipq_labelDestroy the label on an IP fragment queue. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_mbuf_labelDestroy the label on an mbuf header. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_mount_labelDestroy the labels on a mount point. In this entry point, a policy module should free the internal storage associated with mntlabel so that they may be destroyed.
mpo_destroy_mount_label| Parameter | Description | Locking |
|---|---|---|
| mntlabel | Mount point label being destroyed | |
| fslabel | File system label being destroyed> |
Destroy the labels on a mount point. In this entry point, a policy module should free the internal storage associated with mntlabel and fslabel so that they may be destroyed.
mpo_destroy_socket_labelDestroy the label on a socket. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_socket_peer_labelDestroy the peer label on a socket. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_pipe_labelDestroy the label on a pipe. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_proc_labelDestroy the label on a process. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_destroy_vnode_labelDestroy the label on a vnode. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.
mpo_copy_mbuf_labelCopy the label information in src into dest.
mpo_copy_pipe_labelCopy the label information in src into dest.
mpo_copy_vnode_labelCopy the label information in src into dest.
mpo_externalize_cred_labelint mpo_externalize_cred_label(struct label *label,
char *element_name, struct sbuf *sb, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be externalized | |
| element_name | Name of the policy whose label should be externalized | |
| sb | String buffer to be filled with a text representation of label | |
| claimed | Should be incremented when element_data can be filled in. |
Produce an externalized label based on the label structure passed. An externalized
label consists of a text representation of the label contents that can be used with
userland applications and read by the user. Currently, all policies' externalize entry points will be called, so the implementation
should check the contents of element_name before attempting
to fill in sb. If element_name
does not match the name of your policy, simply return 0.
Only return nonzero if an error occurs while externalizing the label data. Once the
policy fills in element_data, *claimed should be incremented.
mpo_externalize_ifnet_labelint mpo_externalize_ifnet_label(struct label
*label, char *element_name, struct sbuf *sb, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be externalized | |
| element_name | Name of the policy whose label should be externalized | |
| sb | String buffer to be filled with a text representation of label | |
| claimed | Should be incremented when element_data can be filled in. |
Produce an externalized label based on the label structure passed. An externalized
label consists of a text representation of the label contents that can be used with
userland applications and read by the user. Currently, all policies' externalize entry points will be called, so the implementation
should check the contents of element_name before attempting
to fill in sb. If element_name
does not match the name of your policy, simply return 0.
Only return nonzero if an error occurs while externalizing the label data. Once the
policy fills in element_data, *claimed should be incremented.
mpo_externalize_pipe_labelint mpo_externalize_pipe_label(struct label *label,
char *element_name, struct sbuf *sb, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be externalized | |
| element_name | Name of the policy whose label should be externalized | |
| sb | String buffer to be filled with a text representation of label | |
| claimed | Should be incremented when element_data can be filled in. |
Produce an externalized label based on the label structure passed. An externalized
label consists of a text representation of the label contents that can be used with
userland applications and read by the user. Currently, all policies' externalize entry points will be called, so the implementation
should check the contents of element_name before attempting
to fill in sb. If element_name
does not match the name of your policy, simply return 0.
Only return nonzero if an error occurs while externalizing the label data. Once the
policy fills in element_data, *claimed should be incremented.
mpo_externalize_socket_labelint mpo_externalize_socket_label(struct label
*label, char *element_name, struct sbuf *sb, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be externalized | |
| element_name | Name of the policy whose label should be externalized | |
| sb | String buffer to be filled with a text representation of label | |
| claimed | Should be incremented when element_data can be filled in. |
Produce an externalized label based on the label structure passed. An externalized
label consists of a text representation of the label contents that can be used with
userland applications and read by the user. Currently, all policies' externalize entry points will be called, so the implementation
should check the contents of element_name before attempting
to fill in sb. If element_name
does not match the name of your policy, simply return 0.
Only return nonzero if an error occurs while externalizing the label data. Once the
policy fills in element_data, *claimed should be incremented.
mpo_externalize_socket_peer_labelint mpo_externalize_socket_peer_label(struct label
*label, char *element_name, struct sbuf *sb, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be externalized | |
| element_name | Name of the policy whose label should be externalized | |
| sb | String buffer to be filled with a text representation of label | |
| claimed | Should be incremented when element_data can be filled in. |
Produce an externalized label based on the label structure passed. An externalized
label consists of a text representation of the label contents that can be used with
userland applications and read by the user. Currently, all policies' externalize entry points will be called, so the implementation
should check the contents of element_name before attempting
to fill in sb. If element_name
does not match the name of your policy, simply return 0.
Only return nonzero if an error occurs while externalizing the label data. Once the
policy fills in element_data, *claimed should be incremented.
mpo_externalize_vnode_labelint mpo_externalize_vnode_label(struct label
*label, char *element_name, struct sbuf *sb, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be externalized | |
| element_name | Name of the policy whose label should be externalized | |
| sb | String buffer to be filled with a text representation of label | |
| claimed | Should be incremented when element_data can be filled in. |
Produce an externalized label based on the label structure passed. An externalized
label consists of a text representation of the label contents that can be used with
userland applications and read by the user. Currently, all policies' externalize entry points will be called, so the implementation
should check the contents of element_name before attempting
to fill in sb. If element_name
does not match the name of your policy, simply return 0.
Only return nonzero if an error occurs while externalizing the label data. Once the
policy fills in element_data, *claimed should be incremented.
mpo_internalize_cred_labelint mpo_internalize_cred_label(struct label *label,
char *element_name, char *element_data, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be filled in | |
| element_name | Name of the policy whose label should be internalized | |
| element_data | Text data to be internalized | |
| claimed | Should be incremented when data can be successfully internalized. |
Produce an internal label structure based on externalized label data in text format.
Currently, all policies' internalize entry points are
called when internalization is requested, so the implementation should compare the
contents of element_name to its own name in order to be sure
it should be internalizing the data in element_data. Just as
in the externalize entry points, the entry point should
return 0 if element_name
does not match its own name, or when data can successfully be internalized, in which case
*claimed should be incremented.
mpo_internalize_ifnet_labelint mpo_internalize_ifnet_label(struct label
*label, char *element_name, char *element_data, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be filled in | |
| element_name | Name of the policy whose label should be internalized | |
| element_data | Text data to be internalized | |
| claimed | Should be incremented when data can be successfully internalized. |
Produce an internal label structure based on externalized label data in text format.
Currently, all policies' internalize entry points are
called when internalization is requested, so the implementation should compare the
contents of element_name to its own name in order to be sure
it should be internalizing the data in element_data. Just as
in the externalize entry points, the entry point should
return 0 if element_name
does not match its own name, or when data can successfully be internalized, in which case
*claimed should be incremented.
mpo_internalize_pipe_labelint mpo_internalize_pipe_label(struct label *label,
char *element_name, char *element_data, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be filled in | |
| element_name | Name of the policy whose label should be internalized | |
| element_data | Text data to be internalized | |
| claimed | Should be incremented when data can be successfully internalized. |
Produce an internal label structure based on externalized label data in text format.
Currently, all policies' internalize entry points are
called when internalization is requested, so the implementation should compare the
contents of element_name to its own name in order to be sure
it should be internalizing the data in element_data. Just as
in the externalize entry points, the entry point should
return 0 if element_name
does not match its own name, or when data can successfully be internalized, in which case
*claimed should be incremented.
mpo_internalize_socket_labelint mpo_internalize_socket_label(struct label
*label, char *element_name, char *element_data, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be filled in | |
| element_name | Name of the policy whose label should be internalized | |
| element_data | Text data to be internalized | |
| claimed | Should be incremented when data can be successfully internalized. |
Produce an internal label structure based on externalized label data in text format.
Currently, all policies' internalize entry points are
called when internalization is requested, so the implementation should compare the
contents of element_name to its own name in order to be sure
it should be internalizing the data in element_data. Just as
in the externalize entry points, the entry point should
return 0 if element_name
does not match its own name, or when data can successfully be internalized, in which case
*claimed should be incremented.
mpo_internalize_vnode_labelint mpo_internalize_vnode_label(struct label
*label, char *element_name, char *element_data, int *claimed);
| Parameter | Description | Locking |
|---|---|---|
| label | Label to be filled in | |
| element_name | Name of the policy whose label should be internalized | |
| element_data | Text data to be internalized | |
| claimed | Should be incremented when data can be successfully internalized. |
Produce an internal label structure based on externalized label data in text format.
Currently, all policies' internalize entry points are
called when internalization is requested, so the implementation should compare the
contents of element_name to its own name in order to be sure
it should be internalizing the data in element_data. Just as
in the externalize entry points, the entry point should
return 0 if element_name
does not match its own name, or when data can successfully be internalized, in which case
*claimed should be incremented.
This class of entry points is used by the MAC framework to permit policies to maintain label information on kernel objects. For each labeled kernel object of interest to a MAC policy, entry points may be registered for relevant life cycle events. All objects implement initialization, creation, and destruction hooks. Some objects will also implement relabeling, allowing user processes to change the labels on objects. Some objects will also implement object-specific events, such as label events associated with IP reassembly. A typical labeled object will have the following life cycle of entry points:
Label initialization o
(object-specific wait) \
Label creation o
\
Relabel events, o--<--.
Various object-specific, | |
Access control events ~-->--o
\
Label destruction o
Label initialization permits policies to allocate memory and set initial values for labels without context for the use of the object. The label slot allocated to a policy will be zeroed by default, so some policies may not need to perform initialization.
Label creation occurs when the kernel structure is associated with an actual kernel object. For example, Mbufs may be allocated and remain unused in a pool until they are required. mbuf allocation causes label initialization on the mbuf to take place, but mbuf creation occurs when the mbuf is associated with a datagram. Typically, context will be provided for a creation event, including the circumstances of the creation, and labels of other relevant objects in the creation process. For example, when an mbuf is created from a socket, the socket and its label will be presented to registered policies in addition to the new mbuf and its label. Memory allocation in creation events is discouraged, as it may occur in performance sensitive ports of the kernel; in addition, creation calls are not permitted to fail so a failure to allocate memory cannot be reported.
Object specific events do not generally fall into the other broad classes of label events, but will generally provide an opportunity to modify or update the label on an object based on additional context. For example, the label on an IP fragment reassembly queue may be updated during the MAC_UPDATE_IPQ entry point as a result of the acceptance of an additional mbuf to that queue.
Access control events are discussed in detail in the following section.
Label destruction permits policies to release storage or state associated with a label during its association with an object so that the kernel data structures supporting the object may be reused or released.
In addition to labels associated with specific kernel objects, an additional class of labels exists: temporary labels. These labels are used to store update information submitted by user processes. These labels are initialized and destroyed as with other label types, but the creation event is MAC_INTERNALIZE, which accepts a user label to be converted to an in-kernel representation.
mpo_associate_vnode_devfsvoid mpo_associate_vnode_devfs(struct mount *mp,
struct label *fslabel, struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
struct label *vlabel);
| Parameter | Description | Locking |
|---|---|---|
| mp | Devfs mount point | |
| fslabel | Devfs file system label (mp->mnt_fslabel) | |
| de | Devfs directory entry | |
| delabel | Policy label associated with de | |
| vp | vnode associated with de | |
| vlabel | Policy label associated with vp |
Fill in the label (vlabel) for a newly created devfs vnode based on the devfs directory entry passed in de and its label.
mpo_associate_vnode_extattrint mpo_associate_vnode_extattr(struct mount *mp,
struct label *fslabel, struct vnode *vp, struct label *vlabel);
| Parameter | Description | Locking |
|---|---|---|
| mp | File system mount point | |
| fslabel | File system label | |
| vp | Vnode to label | |
| vlabel | Policy label associated with vp |
Attempt to retrieve the label for vp from the file system extended attributes. Upon success, the value 0 is returned. Should extended attribute retrieval not be supported, an accepted fallback is to copy fslabel into vlabel. In the event of an error, an appropriate value for errno should be returned.
mpo_associate_vnode_singlelabelvoid mpo_associate_vnode_singlelabel(struct mount
*mp, struct label *fslabel, struct vnode *vp, struct label *vlabel);
| Parameter | Description | Locking |
|---|---|---|
| mp | File system mount point | |
| fslabel | File system label | |
| vp | Vnode to label | |
| vlabel | Policy label associated with vp |
On non-multilabel file systems, this entry point is called to set the policy label for vp based on the file system label, fslabel.
mpo_create_devfs_device| Parameter | Description | Locking |
|---|---|---|
| dev | Device corresponding with devfs_dirent | |
| devfs_dirent | Devfs directory entry to be labeled. | |
| label | Label for devfs_dirent to be filled in. |
Fill out the label on a devfs_dirent being created for the passed device. This call will be made when the device file system is mounted, regenerated, or a new device is made available.
mpo_create_devfs_directoryvoid mpo_create_devfs_directory(char *dirname, int
dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label);
| Parameter | Description | Locking |
|---|---|---|
| dirname | Name of directory being created | |
| namelen | Length of string dirname | |
| devfs_dirent | Devfs directory entry for directory being created. |
Fill out the label on a devfs_dirent being created for the passed directory. This call will be made when the device file system is mounted, regenerated, or a new device requiring a specific directory hierarchy is made available.
mpo_create_devfs_symlinkvoid mpo_create_devfs_symlink(struct ucred *cred,
struct mount *mp, struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent
*de, struct label *delabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| mp | Devfs mount point | |
| dd | Link destination | |
| ddlabel | Label associated with dd | |
| de | Symlink entry | |
| delabel | Label associated with de |
Fill in the label (delabel) for a newly created devfs(5) symbolic link entry.
mpo_create_vnode_extattrint mpo_create_vnode_extattr(struct ucred *cred,
struct mount *mp, struct label *fslabel, struct vnode *dvp, struct label *dlabel, struct
vnode *vp, struct label *vlabel, struct componentname *cnp);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| mount | File system mount point | |
| label | File system label | |
| dvp | Parent directory vnode | |
| dlabel | Label associated with dvp | |
| vp | Newly created vnode | |
| vlabel | Policy label associated with vp | |
| cnp | Component name for vp |
Write out the label for vp to the appropriate extended attribute. If the write succeeds, fill in vlabel with the label, and return 0. Otherwise, return an appropriate error.
mpo_create_mountvoid mpo_create_mount(struct ucred *cred, struct
mount *mp, struct label *mnt, struct label *fslabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| mp | Object; file system being mounted | |
| mntlabel | Policy label to be filled in for mp | |
| fslabel | Policy label for the file system mp mounts. |
Fill out the labels on the mount point being created by the passed subject credential. This call will be made when a new file system is mounted.
mpo_create_root_mountvoid mpo_create_root_mount(struct ucred *cred,
struct mount *mp, struct label *mntlabel, struct label *fslabel);
| Parameter | Description | Locking |
|---|---|---|
| See Section 6.7.3.1.8. | ||
Fill out the labels on the mount point being created by the passed subject credential. This call will be made when the root file system is mounted, after mpo_create_mount;.
mpo_relabel_vnodevoid mpo_relabel_vnode(struct ucred *cred, struct
vnode *vp, struct label *vnodelabel, struct label *newlabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| vp | vnode to relabel | |
| vnodelabel | Existing policy label for vp | |
| newlabel | New, possibly partial label to replace vnodelabel |
Update the label on the passed vnode given the passed update vnode label and the passed subject credential.
mpo_setlabel_vnode_extattrint mpo_setlabel_vnode_extattr(struct ucred *cred,
struct vnode *vp, struct label *vlabel, struct label *intlabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| vp | Vnode for which the label is being written | |
| vlabel | Policy label associated with vp | |
| intlabel | Label to write out |
Write out the policy from intlabel to an extended
attribute. This is called from vop_stdcreatevnode_ea.
mpo_update_devfsdirentvoid mpo_update_devfsdirent(struct devfs_dirent
*devfs_dirent, struct label *direntlabel, struct vnode *vp, struct label
*vnodelabel);
| Parameter | Description | Locking |
|---|---|---|
| devfs_dirent | Object; devfs directory entry | |
| direntlabel | Policy label for devfs_dirent to be updated. | |
| vp | Parent vnode | Locked |
| vnodelabel | Policy label for vp |
Update the devfs_dirent label from the passed devfs vnode
label. This call will be made when a devfs vnode has been successfully relabeled to
commit the label change such that it lasts even if the vnode is recycled. It will also be
made when when a symlink is created in devfs, following a call to mac_vnode_create_from_vnode to initialize the vnode label.
mpo_create_mbuf_from_socketvoid mpo_create_mbuf_from_socket(struct socket *so,
struct label *socketlabel, struct mbuf *m, struct label *mbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| socket | Socket | Socket locking WIP |
| socketlabel | Policy label for socket | |
| m | Object; mbuf | |
| mbuflabel | Policy label to fill in for m |
Set the label on a newly created mbuf header from the passed socket label. This call is made when a new datagram or message is generated by the socket and stored in the passed mbuf.
mpo_create_pipe| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| pipe | Pipe | |
| pipelabel | Policy label associated with pipe |
Set the label on a newly created pipe from the passed subject credential. This call is made when a new pipe is created.
mpo_create_socket| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | Immutable |
| so | Object; socket to label | |
| socketlabel | Label to fill in for so |
Set the label on a newly created socket from the passed subject credential. This call is made when a socket is created.
mpo_create_socket_from_socketvoid mpo_create_socket_from_socket(struct socket
*oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label
*newsocketlabel);
| Parameter | Description | Locking |
|---|---|---|
| oldsocket | Listening socket | |
| oldsocketlabel | Policy label associated with oldsocket | |
| newsocket | New socket | |
| newsocketlabel | Policy label associated with newsocketlabel |
Label a socket, newsocket, newly accept(2)ed, based on the listen(2) socket, oldsocket.
mpo_relabel_pipevoid mpo_relabel_pipe(struct ucred *cred, struct
pipe *pipe, struct label *oldlabel, struct label *newlabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| pipe | Pipe | |
| oldlabel | Current policy label associated with pipe | |
| newlabel | Policy label update to apply to pipe |
Apply a new label, newlabel, to pipe.
mpo_relabel_socketvoid mpo_relabel_socket(struct ucred *cred, struct
socket *so, struct label *oldlabel, struct label *newlabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | Immutable |
| so | Object; socket | |
| oldlabel | Current label for so | |
| newlabel | Label update for so |
Update the label on a socket from the passed socket label update.
mpo_set_socket_peer_from_mbufvoid mpo_set_socket_peer_from_mbuf(struct mbuf
*mbuf, struct label *mbuflabel, struct label *oldlabel, struct label
*newlabel);
| Parameter | Description | Locking |
|---|---|---|
| mbuf | First datagram received over socket | |
| mbuflabel | Label for mbuf | |
| oldlabel | Current label for the socket | |
| newlabel | Policy label to be filled out for the socket |
Set the peer label on a stream socket from the passed mbuf label. This call will be made when the first datagram is received by the stream socket, with the exception of Unix domain sockets.
mpo_set_socket_peer_from_socketvoid mpo_set_socket_peer_from_socket(struct socket
*oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label
*newsocketpeerlabel);
| Parameter | Description | Locking |
|---|---|---|
| oldsocket | Local socket | |
| oldsocketlabel | Policy label for oldsocket | |
| newsocket | Peer socket | |
| newsocketpeerlabel | Policy label to fill in for newsocket |
Set the peer label on a stream UNIX domain socket from the passed remote socket endpoint. This call will be made when the socket pair is connected, and will be made for both endpoints.
mpo_create_bpfdesc| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | Immutable |
| bpf_d | Object; bpf descriptor | |
| bpf | Policy label to be filled in for bpf_d |
Set the label on a newly created BPF descriptor from the passed subject credential. This call will be made when a BPF device node is opened by a process with the passed subject credential.
mpo_create_ifnetSet the label on a newly created interface. This call may be made when a new physical interface becomes available to the system, or when a pseudo-interface is instantiated during the boot or as a result of a user action.
mpo_create_ipqvoid mpo_create_ipq(struct mbuf *fragment, struct
label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel);
| Parameter | Description | Locking |
|---|---|---|
| fragment | First received IP fragment | |
| fragmentlabel | Policy label for fragment | |
| ipq | IP reassembly queue to be labeled | |
| ipqlabel | Policy label to be filled in for ipq |
Set the label on a newly created IP fragment reassembly queue from the mbuf header of the first received fragment.
mpo_create_datagram_from_ipqvoid mpo_create_create_datagram_from_ipq(struct ipq
*ipq, struct label *ipqlabel, struct mbuf *datagram, struct label
*datagramlabel);
| Parameter | Description | Locking |
|---|---|---|
| ipq | IP reassembly queue | |
| ipqlabel | Policy label for ipq | |
| datagram | Datagram to be labeled | |
| datagramlabel | Policy label to be filled in for datagramlabel |
Set the label on a newly reassembled IP datagram from the IP fragment reassembly queue from which it was generated.
mpo_create_fragmentvoid mpo_create_fragment(struct mbuf *datagram,
struct label *datagramlabel, struct mbuf *fragment, struct label
*fragmentlabel);
| Parameter | Description | Locking |
|---|---|---|
| datagram | Datagram | |
| datagramlabel | Policy label for datagram | |
| fragment | Fragment to be labeled | |
| fragmentlabel | Policy label to be filled in for datagram |
Set the label on the mbuf header of a newly created IP fragment from the label on the mbuf header of the datagram it was generate from.
mpo_create_mbuf_from_mbufvoid mpo_create_mbuf_from_mbuf(struct mbuf
*oldmbuf, struct label *oldmbuflabel, struct mbuf *newmbuf, struct label
*newmbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| oldmbuf | Existing (source) mbuf | |
| oldmbuflabel | Policy label for oldmbuf | |
| newmbuf | New mbuf to be labeled | |
| newmbuflabel | Policy label to be filled in for newmbuf |
Set the label on the mbuf header of a newly created datagram from the mbuf header of an existing datagram. This call may be made in a number of situations, including when an mbuf is re-allocated for alignment purposes.
mpo_create_mbuf_linklayervoid mpo_create_mbuf_linklayer(struct ifnet *ifnet,
struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| ifnet | Network interface | |
| ifnetlabel | Policy label for ifnet | |
| mbuf | mbuf header for new datagram | |
| mbuflabel | Policy label to be filled in for mbuf |
Set the label on the mbuf header of a newly created datagram generated for the purposes of a link layer response for the passed interface. This call may be made in a number of situations, including for ARP or ND6 responses in the IPv4 and IPv6 stacks.
mpo_create_mbuf_from_bpfdescvoid mpo_create_mbuf_from_bpfdesc(struct bpf_d
*bpf_d, struct label *bpflabel, struct mbuf *mbuf, struct label *mbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| bpf_d | BPF descriptor | |
| bpflabel | Policy label for bpflabel | |
| mbuf | New mbuf to be labeled | |
| mbuflabel | Policy label to fill in for mbuf |
Set the label on the mbuf header of a newly created datagram generated using the passed BPF descriptor. This call is made when a write is performed to the BPF device associated with the passed BPF descriptor.
mpo_create_mbuf_from_ifnetvoid mpo_create_mbuf_from_ifnet(struct ifnet
*ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| ifnet | Network interface | |
| ifnetlabel | Policy label for ifnetlabel | |
| mbuf | mbuf header for new datagram | |
| mbuflabel | Policy label to be filled in for mbuf |
Set the label on the mbuf header of a newly created datagram generated from the passed network interface.
mpo_create_mbuf_multicast_encapvoid mpo_create_mbuf_multicast_encap(struct mbuf
*oldmbuf, struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel,
struct mbuf *newmbuf, struct label *newmbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| oldmbuf | mbuf header for existing datagram | |
| oldmbuflabel | Policy label for oldmbuf | |
| ifnet | Network interface | |
| ifnetlabel | Policy label for ifnet | |
| newmbuf | mbuf header to be labeled for new datagram | |
| newmbuflabel | Policy label to be filled in for newmbuf |
Set the label on the mbuf header of a newly created datagram generated from the existing passed datagram when it is processed by the passed multicast encapsulation interface. This call is made when an mbuf is to be delivered using the virtual interface.
mpo_create_mbuf_netlayervoid mpo_create_mbuf_netlayer(struct mbuf *oldmbuf,
struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel);
| Parameter | Description | Locking |
|---|---|---|
| oldmbuf | Received datagram | |
| oldmbuflabel | Policy label for oldmbuf | |
| newmbuf | Newly created datagram | |
| newmbuflabel | Policy label for newmbuf |
Set the label on the mbuf header of a newly created datagram generated by the IP stack in response to an existing received datagram (oldmbuf). This call may be made in a number of situations, including when responding to ICMP request datagrams.
mpo_fragment_matchint mpo_fragment_match(struct mbuf *fragment,
struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel);
| Parameter | Description | Locking |
|---|---|---|
| fragment | IP datagram fragment | |
| fragmentlabel | Policy label for fragment | |
| ipq | IP fragment reassembly queue | |
| ipqlabel | Policy label for ipq |
Determine whether an mbuf header containing an IP datagram (fragment) fragment matches the label of the passed IP fragment reassembly queue (ipq). Return (1) for a successful match, or (0) for no match. This call is made when the IP stack attempts to find an existing fragment reassembly queue for a newly received fragment; if this fails, a new fragment reassembly queue may be instantiated for the fragment. Policies may use this entry point to prevent the reassembly of otherwise matching IP fragments if policy does not permit them to be reassembled based on the label or other information.
mpo_relabel_ifnetvoid mpo_relabel_ifnet(struct ucred *cred, struct
ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel);
| Parameter | Description | Locking |
|---|---|---|
| cred | Subject credential | |
| ifnet | Object; Network interface | |
| ifnetlabel | Policy label for ifnet | |
| newlabel | Label update to apply to ifnet |
Update the label of network interface, ifnet, based on the passed update label, newlabel, and the passed subject credential, cred.
mpo_update_ipqvoid mpo_update_ipq(struct mbuf *fragment, struct
label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel);
| Parameter | Description | Locking |
|---|---|---|
| mbuf | IP fragment | |
| mbuflabel | Policy label for mbuf | |
| ipq | IP fragment reassembly queue | |
| ipqlabel | Policy label to be updated for ipq |
Update the label on an IP fragment reassembly queue (ipq) based on the acceptance of the passed IP fragment mbuf header (mbuf).
mpo_create_cred| Parameter | Description | Locking |
|---|---|---|
| parent_cred | Parent subject credential | |
| child_cred | Child subject credential |
Set the label of a newly created subject credential from the passed subject credential. This call will be made when crcopy(9) is invoked on a newly created struct ucred. This call should not be confused with a process forking or creation event.
mpo_execve_transitionvoid mpo_execve_transition(struct ucred *old,
struct ucred *new, struct vnode *vp, struct label *vnodelabel);
| Parameter | Description | Locking |
|---|---|---|
| old | Existing subject credential | Immutable |
| new | New subject credential to be labeled | |
| vp | File to execute | Locked |
| vnodelabel | Policy label for vp |
Update the label of a newly created subject credential (new) from the passed existing subject credential (old) based on a label transition caused by executing the passed
vnode (vp). This call occurs when a process executes the
passed vnode and one of the policies returns a success from the mpo_execve_will_transition entry point. Policies may choose to
implement this call simply by invoking mpo_create_cred and
passing the two subject credentials so as not to implement a transitioning event.
Policies should not leave this entry point unimplemented if they implement mpo_create_cred, even if they do not implement mpo_execve_will_transition.
mpo_execve_will_transition| Parameter | Description | Locking |
|---|---|---|
| old | Subject credential prior to execve(2) | Immutable |
| vp | File to execute | |
| vnodelabel | Policy label for vp |
Determine whether the policy will want to perform a transition event as a result of
the execution of the passed vnode by the passed subject credential. Return 1 if a transition is required, 0 if not. Even if a policy returns 0, it should behave correctly in the presence of an unexpected
invocation of mpo_execve_transition, as that call may
happen as a result of another policy requesting a transition.
mpo_create_proc0Create the subject credential of process 0, the parent of all kernel processes.
mpo_create_proc1Create the subject credential of process 1, the parent of all user processes.
mpo_relabel_credUpdate the label on a subject credential from the passed update label.
Access control entry points permit policy modules to influence access control
decisions made by the kernel. Generally, although not always, arguments to an access
control entry point will include one or more authorizing credentials, information
(possibly including a label) for any other objects involved in the operation. An access
control entry point may return 0 to permit the operation, or an errno(2) error value.
The results of invoking the entry point across various registered policy modules will be
composed as follows: if all modules permit the operation to succeed, success will be
returned. If one or modules returns a failure, a failure will be returned. If more than
one module returns a failure, the errno value to return to the user will be selected
using the following precedence, implemented by the error_select() function in kern_mac.c:
If none of the error values returned by all modules are listed in the precedence chart then an arbitrarily selected value from the set will be returned. In general, the rules provide precedence to errors in the following order: kernel failures, invalid arguments, object not present, access not permitted, other.
mpo_check_bpfdesc_receiveint mpo_check_bpfdesc_receive(struct bpf_d *bpf_d,
struct label *bpflabel, struct ifnet *ifnet, struct label *ifnetlabel);
| Parameter | Description | Locking |
|---|---|---|
| bpf_d | Subject; BPF descriptor | |
| bpflabel | Policy label for bpf_d | |
| ifnet | Object; network interface | |
| ifnetlabel | Policy label for ifnet |
Determine whether the MAC framework should permit datagrams from the passed interface to be delivered to the buffers of the passed BPF descriptor. Return (0) for success, or an errno value for failure Suggested failure: EACCES for label mismatches, EPERM for lack of privilege.
mpo_check_kenv_dumpDetermine whether the subject should be allowed to retrieve the kernel environment (see kenv(2)).
mpo_check_kenv_getDetermine whether the subject should be allowed to retrieve the value of the specified kernel environment variable.
mpo_check_kenv_setDetermine whether the subject should be allowed to set the specified kernel environment variable.
mpo_check_kenv_unsetDetermine whether the subject should be allowed to unset the specified kernel environment variable.