From owner-trustedbsd-cvs@FreeBSD.ORG Sat Jul 8 13:01:13 2006 Return-Path: X-Original-To: trustedbsd-cvs@freebsd.org Delivered-To: trustedbsd-cvs@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 45E5B16A4DD for ; Sat, 8 Jul 2006 13:01:13 +0000 (UTC) (envelope-from owner-perforce@freebsd.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1880943D68 for ; Sat, 8 Jul 2006 13:00:59 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by cyrus.watson.org (Postfix) with ESMTP id AEB4F46D33 for ; Sat, 8 Jul 2006 09:00:58 -0400 (EDT) Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id 828C55698E; Sat, 8 Jul 2006 13:00:43 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: by hub.freebsd.org (Postfix, from userid 32767) id 7BC7616A4E5; Sat, 8 Jul 2006 13:00:43 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3CF2016A4E1 for ; Sat, 8 Jul 2006 13:00:43 +0000 (UTC) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id B27A343D46 for ; Sat, 8 Jul 2006 13:00:42 +0000 (GMT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k68D0guW003070 for ; Sat, 8 Jul 2006 13:00:42 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k68D0g84003061 for perforce@freebsd.org; Sat, 8 Jul 2006 13:00:42 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Date: Sat, 8 Jul 2006 13:00:42 GMT Message-Id: <200607081300.k68D0g84003061@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson To: Perforce Change Reviews Cc: Subject: PERFORCE change 100989 for review X-BeenThere: trustedbsd-cvs@FreeBSD.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: TrustedBSD CVS and Perforce commit message list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Jul 2006 13:01:13 -0000 http://perforce.freebsd.org/chv.cgi?CH=100989 Change 100989 by rwatson@rwatson_zoo on 2006/07/08 13:00:04 Rename. Affected files ... .. //depot/projects/trustedbsd/mac2/sys/security/mac_mls/mac_mls.c#2 edit Differences ... ==== //depot/projects/trustedbsd/mac2/sys/security/mac_mls/mac_mls.c#2 (text+ko) ==== @@ -1,6 +1,7 @@ /*- * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001-2005 McAfee, Inc. + * Copyright (c) 2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. @@ -10,6 +11,9 @@ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * + * This software was enhanced by SPARTA ISSO under SPAWAR contract + * N66001-04-C-6019 ("SEFOS"). + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -461,7 +465,7 @@ * Policy module operations. */ static void -mac_mls_init(struct mac_policy_conf *conf) +mac_mls_policy_init(struct mac_policy_conf *conf) { zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL, @@ -747,7 +751,7 @@ * a lot like file system objects. */ static void -mac_mls_create_devfs_device(struct ucred *cred, struct mount *mp, +mac_mls_devfs_create_device(struct ucred *cred, struct mount *mp, struct cdev *dev, struct devfs_dirent *devfs_dirent, struct label *label) { struct mac_mls *mac_mls; @@ -772,7 +776,7 @@ } static void -mac_mls_create_devfs_directory(struct mount *mp, char *dirname, +mac_mls_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label) { struct mac_mls *mac_mls; @@ -782,7 +786,7 @@ } static void -mac_mls_create_devfs_symlink(struct ucred *cred, struct mount *mp, +mac_mls_devfs_create_symlink(struct ucred *cred, struct mount *mp, struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, struct label *delabel) { @@ -795,20 +799,18 @@ } static void -mac_mls_create_mount(struct ucred *cred, struct mount *mp, - struct label *mntlabel, struct label *fslabel) +mac_mls_mount_create(struct ucred *cred, struct mount *mp, + struct label *mntlabel) { struct mac_mls *source, *dest; source = SLOT(cred->cr_label); dest = SLOT(mntlabel); mac_mls_copy_effective(source, dest); - dest = SLOT(fslabel); - mac_mls_copy_effective(source, dest); } static void -mac_mls_relabel_vnode(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *label) { struct mac_mls *source, *dest; @@ -820,7 +822,7 @@ } static void -mac_mls_update_devfsdirent(struct mount *mp, +mac_mls_devfs_update(struct mount *mp, struct devfs_dirent *devfs_dirent, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) { @@ -833,7 +835,7 @@ } static void -mac_mls_associate_vnode_devfs(struct mount *mp, struct label *fslabel, +mac_mls_devfs_vnode_associate(struct mount *mp, struct label *mntlabel, struct devfs_dirent *de, struct label *delabel, struct vnode *vp, struct label *vlabel) { @@ -846,13 +848,13 @@ } static int -mac_mls_associate_vnode_extattr(struct mount *mp, struct label *fslabel, +mac_mls_vnode_associate_extattr(struct mount *mp, struct label *mntlabel, struct vnode *vp, struct label *vlabel) { struct mac_mls temp, *source, *dest; int buflen, error; - source = SLOT(fslabel); + source = SLOT(mntlabel); dest = SLOT(vlabel); buflen = sizeof(temp); @@ -861,19 +863,19 @@ error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread); if (error == ENOATTR || error == EOPNOTSUPP) { - /* Fall back to the fslabel. */ + /* Fall back to the mntlabel. */ mac_mls_copy_effective(source, dest); return (0); } else if (error) return (error); if (buflen != sizeof(temp)) { - printf("mac_mls_associate_vnode_extattr: bad size %d\n", + printf("mac_mls_vnode_associate_extattr: bad size %d\n", buflen); return (EPERM); } if (mac_mls_valid(&temp) != 0) { - printf("mac_mls_associate_vnode_extattr: invalid\n"); + printf("mac_mls_vnode_associate_extattr: invalid\n"); return (EPERM); } if ((temp.mm_flags & MAC_MLS_FLAGS_BOTH) != MAC_MLS_FLAG_EFFECTIVE) { @@ -886,20 +888,20 @@ } static void -mac_mls_associate_vnode_singlelabel(struct mount *mp, - struct label *fslabel, struct vnode *vp, struct label *vlabel) +mac_mls_vnode_associate_singlelabel(struct mount *mp, + struct label *mntlabel, struct vnode *vp, struct label *vlabel) { struct mac_mls *source, *dest; - source = SLOT(fslabel); + source = SLOT(mntlabel); dest = SLOT(vlabel); mac_mls_copy_effective(source, dest); } static int -mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp, - struct label *fslabel, struct vnode *dvp, struct label *dlabel, +mac_mls_vnode_create_extattr(struct ucred *cred, struct mount *mp, + struct label *mntlabel, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *vlabel, struct componentname *cnp) { struct mac_mls *source, *dest, temp; @@ -921,7 +923,7 @@ } static int -mac_mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, struct label *vlabel, struct label *intlabel) { struct mac_mls *source, temp; @@ -946,7 +948,7 @@ * Labeling event operations: IPC object. */ static void -mac_mls_create_inpcb_from_socket(struct socket *so, struct label *solabel, +mac_mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, struct label *inplabel) { struct mac_mls *source, *dest; @@ -958,7 +960,7 @@ } static void -mac_mls_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, +mac_mls_socket_create_mbuf(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_mls *source, *dest; @@ -970,7 +972,7 @@ } static void -mac_mls_create_socket(struct ucred *cred, struct socket *socket, +mac_mls_socket_create(struct ucred *cred, struct socket *socket, struct label *socketlabel) { struct mac_mls *source, *dest; @@ -982,7 +984,7 @@ } static void -mac_mls_create_pipe(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_create(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_mls *source, *dest; @@ -994,7 +996,7 @@ } static void -mac_mls_create_posix_sem(struct ucred *cred, struct ksem *ksemptr, +mac_mls_posix_sem_create(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { struct mac_mls *source, *dest; @@ -1006,7 +1008,7 @@ } static void -mac_mls_create_socket_from_socket(struct socket *oldsocket, +mac_mls_socket_accept(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketlabel) { @@ -1019,7 +1021,7 @@ } static void -mac_mls_relabel_socket(struct ucred *cred, struct socket *socket, +mac_mls_socket_relabel(struct ucred *cred, struct socket *socket, struct label *socketlabel, struct label *newlabel) { struct mac_mls *source, *dest; @@ -1031,7 +1033,7 @@ } static void -mac_mls_relabel_pipe(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_relabel(struct ucred *cred, struct pipepair *pp, struct label *pipelabel, struct label *newlabel) { struct mac_mls *source, *dest; @@ -1043,7 +1045,7 @@ } static void -mac_mls_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, +mac_mls_socket_peer_set_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, struct socket *socket, struct label *socketpeerlabel) { struct mac_mls *source, *dest; @@ -1059,7 +1061,7 @@ */ static void -mac_mls_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqlabel, struct msg *msgptr, struct label *msglabel) { struct mac_mls *source, *dest; @@ -1072,7 +1074,7 @@ } static void -mac_mls_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqlabel) { struct mac_mls *source, *dest; @@ -1084,7 +1086,7 @@ } static void -mac_mls_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr, +mac_mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, struct label *semalabel) { struct mac_mls *source, *dest; @@ -1096,7 +1098,7 @@ } static void -mac_mls_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr, +mac_mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, struct label *shmlabel) { struct mac_mls *source, *dest; @@ -1111,7 +1113,7 @@ * Labeling event operations: network objects. */ static void -mac_mls_set_socket_peer_from_socket(struct socket *oldsocket, +mac_mls_socket_peer_set_from_socket(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketpeerlabel) { @@ -1124,7 +1126,7 @@ } static void -mac_mls_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, +mac_mls_bpfdesc_create(struct ucred *cred, struct bpf_d *bpf_d, struct label *bpflabel) { struct mac_mls *source, *dest; @@ -1136,7 +1138,7 @@ } static void -mac_mls_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) +mac_mls_ifnet_create(struct ifnet *ifnet, struct label *ifnetlabel) { struct mac_mls *dest; int type; @@ -1153,7 +1155,7 @@ } static void -mac_mls_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, +mac_mls_ipq_create(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { struct mac_mls *source, *dest; @@ -1165,7 +1167,7 @@ } static void -mac_mls_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, +mac_mls_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel) { struct mac_mls *source, *dest; @@ -1178,7 +1180,7 @@ } static void -mac_mls_create_fragment(struct mbuf *datagram, struct label *datagramlabel, +mac_mls_netinet_fragment(struct mbuf *datagram, struct label *datagramlabel, struct mbuf *fragment, struct label *fragmentlabel) { struct mac_mls *source, *dest; @@ -1190,7 +1192,7 @@ } static void -mac_mls_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel, +mac_mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel) { struct mac_mls *source, *dest; @@ -1202,7 +1204,7 @@ } static void -mac_mls_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, +mac_mls_mbuf_create_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel) { struct mac_mls *dest; @@ -1213,7 +1215,7 @@ } static void -mac_mls_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, +mac_mls_bpfdesc_create_mbuf(struct bpf_d *bpf_d, struct label *bpflabel, struct mbuf *mbuf, struct label *mbuflabel) { struct mac_mls *source, *dest; @@ -1225,7 +1227,7 @@ } static void -mac_mls_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, +mac_mls_ifnet_create_mbuf(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_mls *source, *dest; @@ -1237,7 +1239,7 @@ } static void -mac_mls_create_mbuf_multicast_encap(struct mbuf *oldmbuf, +mac_mls_mbuf_create_multicast_encap(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *newmbuf, struct label *newmbuflabel) { @@ -1250,7 +1252,7 @@ } static void -mac_mls_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel, +mac_mls_mbuf_create_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel) { struct mac_mls *source, *dest; @@ -1262,7 +1264,7 @@ } static int -mac_mls_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, +mac_mls_ipq_match(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { struct mac_mls *a, *b; @@ -1274,7 +1276,7 @@ } static void -mac_mls_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, +mac_mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel) { struct mac_mls *source, *dest; @@ -1286,7 +1288,7 @@ } static void -mac_mls_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, +mac_mls_ipq_update(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { @@ -1309,7 +1311,7 @@ * Labeling event operations: processes. */ static void -mac_mls_create_proc0(struct ucred *cred) +mac_mls_proc_create_swapper(struct ucred *cred) { struct mac_mls *dest; @@ -1321,7 +1323,7 @@ } static void -mac_mls_create_proc1(struct ucred *cred) +mac_mls_proc_create_init(struct ucred *cred) { struct mac_mls *dest; @@ -1333,7 +1335,7 @@ } static void -mac_mls_relabel_cred(struct ucred *cred, struct label *newlabel) +mac_mls_cred_relabel(struct ucred *cred, struct label *newlabel) { struct mac_mls *source, *dest; @@ -1347,28 +1349,28 @@ * Label cleanup/flush operations. */ static void -mac_mls_cleanup_sysv_msgmsg(struct label *msglabel) +mac_mls_sysvmsg_cleanup(struct label *msglabel) { bzero(SLOT(msglabel), sizeof(struct mac_mls)); } static void -mac_mls_cleanup_sysv_msgqueue(struct label *msqlabel) +mac_mls_sysvmsq_cleanup(struct label *msqlabel) { bzero(SLOT(msqlabel), sizeof(struct mac_mls)); } static void -mac_mls_cleanup_sysv_sem(struct label *semalabel) +mac_mls_sysvsem_cleanup(struct label *semalabel) { bzero(SLOT(semalabel), sizeof(struct mac_mls)); } static void -mac_mls_cleanup_sysv_shm(struct label *shmlabel) +mac_mls_sysvshm_cleanup(struct label *shmlabel) { bzero(SLOT(shmlabel), sizeof(struct mac_mls)); @@ -1378,7 +1380,7 @@ * Access control checks. */ static int -mac_mls_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, +mac_mls_bpfdesc_check_receive(struct bpf_d *bpf_d, struct label *bpflabel, struct ifnet *ifnet, struct label *ifnetlabel) { struct mac_mls *a, *b; @@ -1395,7 +1397,7 @@ } static int -mac_mls_check_cred_relabel(struct ucred *cred, struct label *newlabel) +mac_mls_cred_check_relabel(struct ucred *cred, struct label *newlabel) { struct mac_mls *subj, *new; int error; @@ -1457,7 +1459,7 @@ } static int -mac_mls_check_cred_visible(struct ucred *u1, struct ucred *u2) +mac_mls_cred_check_visible(struct ucred *u1, struct ucred *u2) { struct mac_mls *subj, *obj; @@ -1475,7 +1477,7 @@ } static int -mac_mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, +mac_mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel) { struct mac_mls *subj, *new; @@ -1501,7 +1503,7 @@ } static int -mac_mls_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, +mac_mls_ifnet_check_transmit(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_mls *p, *i; @@ -1516,7 +1518,7 @@ } static int -mac_mls_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel, +mac_mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel) { struct mac_mls *p, *i; @@ -1531,7 +1533,7 @@ } static int -mac_mls_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr, +mac_mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, struct label *msglabel) { struct mac_mls *subj, *obj; @@ -1549,7 +1551,7 @@ } static int -mac_mls_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr, +mac_mls_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, struct label *msglabel) { struct mac_mls *subj, *obj; @@ -1567,7 +1569,7 @@ } static int -mac_mls_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_mls_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqklabel) { struct mac_mls *subj, *obj; @@ -1585,7 +1587,7 @@ } static int -mac_mls_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_mls_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqklabel) { struct mac_mls *subj, *obj; @@ -1603,7 +1605,7 @@ } static int -mac_mls_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_mls_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqklabel) { struct mac_mls *subj, *obj; @@ -1621,7 +1623,7 @@ } static int -mac_mls_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_mls_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd) { struct mac_mls *subj, *obj; @@ -1652,7 +1654,7 @@ } static int -mac_mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr, +mac_mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, struct label *semaklabel, int cmd) { struct mac_mls *subj, *obj; @@ -1690,7 +1692,7 @@ } static int -mac_mls_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr, +mac_mls_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr, struct label *semaklabel) { struct mac_mls *subj, *obj; @@ -1708,7 +1710,7 @@ } static int -mac_mls_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr, +mac_mls_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr, struct label *semaklabel, size_t accesstype) { struct mac_mls *subj, *obj; @@ -1731,7 +1733,7 @@ } static int -mac_mls_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, +mac_mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) { struct mac_mls *subj, *obj; @@ -1752,7 +1754,7 @@ } static int -mac_mls_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, +mac_mls_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd) { struct mac_mls *subj, *obj; @@ -1784,7 +1786,7 @@ } static int -mac_mls_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, +mac_mls_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) { struct mac_mls *subj, *obj; @@ -1802,7 +1804,7 @@ } static int -mac_mls_check_mount_stat(struct ucred *cred, struct mount *mp, +mac_mls_mount_check_stat(struct ucred *cred, struct mount *mp, struct label *mntlabel) { struct mac_mls *subj, *obj; @@ -1820,7 +1822,7 @@ } static int -mac_mls_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) { @@ -1833,7 +1835,7 @@ } static int -mac_mls_check_pipe_poll(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_mls *subj, *obj; @@ -1851,7 +1853,7 @@ } static int -mac_mls_check_pipe_read(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_check_read(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_mls *subj, *obj; @@ -1869,7 +1871,7 @@ } static int -mac_mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, struct label *pipelabel, struct label *newlabel) { struct mac_mls *subj, *obj, *new; @@ -1920,7 +1922,7 @@ } static int -mac_mls_check_pipe_stat(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_mls *subj, *obj; @@ -1938,7 +1940,7 @@ } static int -mac_mls_check_pipe_write(struct ucred *cred, struct pipepair *pp, +mac_mls_pipe_check_write(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_mls *subj, *obj; @@ -1956,7 +1958,7 @@ } static int -mac_mls_check_posix_sem_write(struct ucred *cred, struct ksem *ksemptr, +mac_mls_posix_sem_check_write(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { struct mac_mls *subj, *obj; @@ -1974,7 +1976,7 @@ } static int -mac_mls_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ksemptr, +mac_mls_posix_sem_check_rdonly(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { struct mac_mls *subj, *obj; @@ -1992,7 +1994,7 @@ } static int -mac_mls_check_proc_debug(struct ucred *cred, struct proc *proc) +mac_mls_proc_check_debug(struct ucred *cred, struct proc *proc) { struct mac_mls *subj, *obj; @@ -2012,7 +2014,7 @@ } static int -mac_mls_check_proc_sched(struct ucred *cred, struct proc *proc) +mac_mls_proc_check_sched(struct ucred *cred, struct proc *proc) { struct mac_mls *subj, *obj; @@ -2032,7 +2034,7 @@ } static int -mac_mls_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) +mac_mls_proc_check_signal(struct ucred *cred, struct proc *proc, int signum) { struct mac_mls *subj, *obj; @@ -2052,7 +2054,7 @@ } static int -mac_mls_check_socket_deliver(struct socket *so, struct label *socketlabel, +mac_mls_socket_check_deliver(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_mls *p, *s; @@ -2067,7 +2069,7 @@ } static int -mac_mls_check_socket_relabel(struct ucred *cred, struct socket *socket, +mac_mls_socket_check_relabel(struct ucred *cred, struct socket *socket, struct label *socketlabel, struct label *newlabel) { struct mac_mls *subj, *obj, *new; @@ -2118,7 +2120,7 @@ } static int -mac_mls_check_socket_visible(struct ucred *cred, struct socket *socket, +mac_mls_socket_check_visible(struct ucred *cred, struct socket *socket, struct label *socketlabel) { struct mac_mls *subj, *obj; @@ -2136,7 +2138,7 @@ } static int -mac_mls_check_system_swapon(struct ucred *cred, struct vnode *vp, +mac_mls_system_check_swapon(struct ucred *cred, struct vnode *vp, struct label *label) { struct mac_mls *subj, *obj; @@ -2155,7 +2157,7 @@ } static int -mac_mls_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, struct label *dlabel) { struct mac_mls *subj, *obj; @@ -2173,7 +2175,7 @@ } static int -mac_mls_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, struct label *dlabel) { struct mac_mls *subj, *obj; @@ -2191,7 +2193,7 @@ } static int -mac_mls_check_vnode_create(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_create(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp, struct vattr *vap) { struct mac_mls *subj, *obj; @@ -2209,31 +2211,7 @@ } static int -mac_mls_check_vnode_delete(struct ucred *cred, struct vnode *dvp, - struct label *dlabel, struct vnode *vp, struct label *label, - struct componentname *cnp) -{ - struct mac_mls *subj, *obj; - - if (!mac_mls_enabled) - return (0); - - subj = SLOT(cred->cr_label); - obj = SLOT(dlabel); - - if (!mac_mls_dominate_effective(obj, subj)) - return (EACCES); - - obj = SLOT(label); - - if (!mac_mls_dominate_effective(obj, subj)) - return (EACCES); - - return (0); -} - -static int -mac_mls_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type) { struct mac_mls *subj, *obj; @@ -2251,7 +2229,7 @@ } static int -mac_mls_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name) { struct mac_mls *subj, *obj; @@ -2269,7 +2247,7 @@ } static int -mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_exec(struct ucred *cred, struct vnode *vp, struct label *label, struct image_params *imgp, struct label *execlabel) { @@ -2301,7 +2279,7 @@ } static int -mac_mls_check_vnode_getacl(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type) { struct mac_mls *subj, *obj; @@ -2319,7 +2297,7 @@ } static int -mac_mls_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio) { struct mac_mls *subj, *obj; @@ -2337,7 +2315,7 @@ } static int -mac_mls_check_vnode_link(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_link(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp) { @@ -2360,7 +2338,7 @@ } static int -mac_mls_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace) { @@ -2379,7 +2357,7 @@ } static int -mac_mls_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp) { struct mac_mls *subj, *obj; @@ -2397,7 +2375,7 @@ } static int -mac_mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_mmap(struct ucred *cred, struct vnode *vp, struct label *label, int prot, int flags) { struct mac_mls *subj, *obj; @@ -2425,7 +2403,7 @@ } static int -mac_mls_check_vnode_open(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_open(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, int acc_mode) { struct mac_mls *subj, *obj; @@ -2450,7 +2428,7 @@ } static int -mac_mls_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, +mac_mls_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label) { struct mac_mls *subj, *obj; @@ -2468,7 +2446,7 @@ } static int -mac_mls_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, +mac_mls_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label) { struct mac_mls *subj, *obj; @@ -2486,7 +2464,7 @@ } static int -mac_mls_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, struct label *dlabel) { struct mac_mls *subj, *obj; @@ -2504,7 +2482,7 @@ } static int -mac_mls_check_vnode_readlink(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_readlink(struct ucred *cred, struct vnode *vp, struct label *vnodelabel) { struct mac_mls *subj, *obj; @@ -2522,7 +2500,7 @@ } static int -mac_mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp, +mac_mls_vnode_check_relabel(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *newlabel) { struct mac_mls *old, *new, *subj; @@ -2574,7 +2552,7 @@ static int -mac_mls_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, +mac_mls_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp) { @@ -2598,7 +2576,7 @@ } static int -mac_mls_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, >>> TRUNCATED FOR MAIL (1000 lines) <<<