security/mac_vfs.c

   1 /*
   2  * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*-
  29  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
  30  * Copyright (c) 2001 Ilmar S. Habibulin
  31  * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
  32  * Copyright (c) 2005 SPARTA, Inc.
  33  *
  34  * This software was developed by Robert Watson and Ilmar Habibulin for the
  35  * TrustedBSD Project.
  36  *
  37  * This software was developed for the FreeBSD Project in part by Network
  38  * Associates Laboratories, the Security Research Division of Network
  39  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  40  * as part of the DARPA CHATS research program.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  52  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  53  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  54  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  55  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  56  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  57  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  58  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  59  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  60  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  61  * SUCH DAMAGE.
  62  *
  63  */
  64
  65 #include <kern/kalloc.h>
  66 #include <libkern/OSAtomic.h>
  67
  68 #include <sys/param.h>
  69 #include <sys/systm.h>
  70 #include <sys/kernel.h>
  71 #include <sys/proc.h>
  72 #include <sys/kauth.h>
  73
  74 #include <sys/file_internal.h>
  75 #include <sys/imgact.h>
  76 #include <sys/namei.h>
  77 #include <sys/mount_internal.h>
  78 #include <sys/pipe.h>
  79 #include <sys/posix_sem.h>
  80 #include <sys/posix_shm.h>
  81 #include <sys/reason.h>
  82 #include <sys/uio_internal.h>
  83 #include <sys/vnode_internal.h>
  84 #include <sys/kdebug.h>
  85
  86
  87 #include <miscfs/devfs/devfsdefs.h>
  88 #include <miscfs/devfs/fdesc.h>
  89
  90 #include <security/mac_internal.h>
  91
  92 /* convert {R,W,X}_OK values to V{READ,WRITE,EXEC} */
  93 #define ACCESS_MODE_TO_VNODE_MASK(m)    (m << 6)
  94
  95
  96 /*
  97  * Optional tracing of policy operations. Define VFS_TRACE_POLICY_OPS to trace the operations.
  98  *
  99  * Along with DBG_FSYSTEM and DBG_VFS, dcode in the macros below is used to construct
 100  * KDBG_EVENTID(DBG_FSYSTEM, DBG_VFS, dcode) global event id, see bsd/sys/kdebug.h.
 101  * Note that dcode is multiplied by 4 and ORed as part of the construction. See bsd/kern/trace_codes
 102  * for list of system-wide {global event id, name} pairs. Currently DBG_VFS event ids are in range
 103  * [0x3130000, 0x313016C].
 104  */
 105
 106 //#define VFS_TRACE_POLICY_OPS
 107
 108 #ifdef VFS_TRACE_POLICY_OPS
 109 #define DBG_VFS_CODE(dcode)                     FSDBG_CODE(DBG_VFS, dcode)
 110 #define VFS_KERNEL_DEBUG_START0(dcode)          KERNEL_DEBUG_CONSTANT(DBG_VFS_CODE(dcode) | DBG_FUNC_START, 0, 0, 0, 0, 0)
 111 #define VFS_KERNEL_DEBUG_END0(dcode)            KERNEL_DEBUG_CONSTANT(DBG_VFS_CODE(dcode) | DBG_FUNC_END, 0, 0, 0, 0, 0)
 112 #define VFS_KERNEL_DEBUG_START1(dcode, darg)    KERNEL_DEBUG_CONSTANT(DBG_VFS_CODE(dcode) | DBG_FUNC_START, darg, 0, 0, 0, 0)
 113 #define VFS_KERNEL_DEBUG_END1(dcode, darg)      KERNEL_DEBUG_CONSTANT(DBG_VFS_CODE(dcode) | DBG_FUNC_END, darg, 0, 0, 0, 0)
 114 #else
 115 #define VFS_KERNEL_DEBUG_START0(dcode)          do {} while (0)
 116 #define VFS_KERNEL_DEBUG_END0(dcode)            do {} while (0)
 117 #define VFS_KERNEL_DEBUG_START1(dcode, darg)    do {} while (0)
 118 #define VFS_KERNEL_DEBUG_END1(dcode, darg)      do {} while (0)
 119 #endif
 120
 121 static struct label *
 122 mac_devfsdirent_label_alloc(void)
 123 {
 124         struct label *label;
 125
 126         label = mac_labelzone_alloc(MAC_WAITOK);
 127         if (label == NULL) {
 128                 return NULL;
 129         }
 130         VFS_KERNEL_DEBUG_START0(0);
 131         MAC_PERFORM(devfs_label_init, label);
 132         VFS_KERNEL_DEBUG_END0(0);
 133         return label;
 134 }
 135
 136 void
 137 mac_devfs_label_init(struct devnode *de)
 138 {
 139         de->dn_label = mac_devfsdirent_label_alloc();
 140 }
 141
 142 static struct label *
 143 mac_mount_label_alloc(void)
 144 {
 145         struct label *label;
 146
 147         label = mac_labelzone_alloc(MAC_WAITOK);
 148         if (label == NULL) {
 149                 return NULL;
 150         }
 151         VFS_KERNEL_DEBUG_START0(1);
 152         MAC_PERFORM(mount_label_init, label);
 153         VFS_KERNEL_DEBUG_END0(1);
 154         return label;
 155 }
 156
 157 void
 158 mac_mount_label_init(struct mount *mp)
 159 {
 160         mp->mnt_mntlabel = mac_mount_label_alloc();
 161 }
 162
 163 struct label *
 164 mac_vnode_label_alloc(void)
 165 {
 166         struct label *label;
 167
 168         label = mac_labelzone_alloc(MAC_WAITOK);
 169         if (label == NULL) {
 170                 return NULL;
 171         }
 172         VFS_KERNEL_DEBUG_START0(2);
 173         MAC_PERFORM(vnode_label_init, label);
 174         VFS_KERNEL_DEBUG_END0(2);
 175         OSIncrementAtomic(&mac_vnode_label_count);
 176         return label;
 177 }
 178
 179 void
 180 mac_vnode_label_init(vnode_t vp)
 181 {
 182         vp->v_label = mac_vnode_label_alloc();
 183 }
 184
 185 int
 186 mac_vnode_label_init_needed(vnode_t vp)
 187 {
 188 #if CONFIG_MACF_LAZY_VNODE_LABELS
 189         (void)vp;
 190         return false;
 191 #else
 192         return mac_label_vnodes != 0 && vp->v_label == NULL;
 193 #endif
 194 }
 195
 196 struct label *
 197 mac_vnode_label_allocate(vnode_t vp)
 198 {
 199         if (mac_vnode_label_init_needed(vp)) {
 200                 vp->v_label = mac_vnode_label_alloc();
 201         }
 202         return vp->v_label;
 203 }
 204
 205 /*
 206  * vnode labels are allocated at the same time as vnodes, but vnodes are never
 207  * freed.  Instead, we want to remove any sensitive information before putting
 208  * them on the free list for reuse.
 209  */
 210 void
 211 mac_vnode_label_recycle(vnode_t vp)
 212 {
 213         MAC_PERFORM(vnode_label_recycle, vp->v_label);
 214 #if CONFIG_MACF_LAZY_VNODE_LABELS
 215         if (vp->v_label) {
 216                 mac_vnode_label_destroy(vp);
 217                 vp->v_label = NULL;
 218                 vp->v_lflag &= ~VL_LABELED;
 219         }
 220 #endif
 221 }
 222
 223 static void
 224 mac_devfs_label_free(struct label *label)
 225 {
 226         VFS_KERNEL_DEBUG_START1(3, label);
 227         MAC_PERFORM(devfs_label_destroy, label);
 228         VFS_KERNEL_DEBUG_END1(3, label);
 229         mac_labelzone_free(label);
 230 }
 231
 232 void
 233 mac_devfs_label_destroy(struct devnode *de)
 234 {
 235         if (de->dn_label != NULL) {
 236                 mac_devfs_label_free(de->dn_label);
 237                 de->dn_label = NULL;
 238         }
 239 }
 240
 241 static void
 242 mac_mount_label_free(struct label *label)
 243 {
 244         VFS_KERNEL_DEBUG_START1(4, label);
 245         MAC_PERFORM(mount_label_destroy, label);
 246         VFS_KERNEL_DEBUG_END1(4, label);
 247         mac_labelzone_free(label);
 248 }
 249
 250 void
 251 mac_mount_label_destroy(struct mount *mp)
 252 {
 253         if (mp->mnt_mntlabel != NULL) {
 254                 mac_mount_label_free(mp->mnt_mntlabel);
 255                 mp->mnt_mntlabel = NULL;
 256         }
 257 }
 258
 259 void
 260 mac_vnode_label_free(struct label *label)
 261 {
 262         if (label != NULL) {
 263                 VFS_KERNEL_DEBUG_START1(5, label);
 264                 MAC_PERFORM(vnode_label_destroy, label);
 265                 VFS_KERNEL_DEBUG_END1(5, label);
 266                 mac_labelzone_free(label);
 267                 OSDecrementAtomic(&mac_vnode_label_count);
 268         }
 269 }
 270
 271 void
 272 mac_vnode_label_destroy(struct vnode *vp)
 273 {
 274         if (vp->v_label != NULL) {
 275                 mac_vnode_label_free(vp->v_label);
 276                 vp->v_label = NULL;
 277         }
 278 }
 279
 280 void
 281 mac_vnode_label_copy(struct label *src, struct label *dest)
 282 {
 283         VFS_KERNEL_DEBUG_START1(6, src);
 284         if (src == NULL) {
 285                 MAC_PERFORM(vnode_label_init, dest);
 286         } else {
 287                 MAC_PERFORM(vnode_label_copy, src, dest);
 288         }
 289         VFS_KERNEL_DEBUG_END1(6, src);
 290 }
 291
 292 int
 293 mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac)
 294 {
 295         int error;
 296
 297         /* It is assumed that any necessary vnode locking is done on entry */
 298         error = MAC_EXTERNALIZE_AUDIT(vnode, vp->v_label,
 299             mac->m_string, mac->m_buflen);
 300
 301         return error;
 302 }
 303
 304 int
 305 mac_vnode_label_externalize(struct label *label, char *elements,
 306     char *outbuf, size_t outbuflen, int flags __unused)
 307 {
 308         int error;
 309
 310         error = MAC_EXTERNALIZE(vnode, label, elements, outbuf, outbuflen);
 311
 312         return error;
 313 }
 314
 315 int
 316 mac_vnode_label_internalize(struct label *label, char *string)
 317 {
 318         int error;
 319
 320         error = MAC_INTERNALIZE(vnode, label, string);
 321
 322         return error;
 323 }
 324
 325 int
 326 mac_mount_label_internalize(struct label *label, char *string)
 327 {
 328         int error;
 329
 330         error = MAC_INTERNALIZE(mount, label, string);
 331
 332         return error;
 333 }
 334
 335 int
 336 mac_mount_label_externalize(struct label *label, char *elements,
 337     char *outbuf, size_t outbuflen)
 338 {
 339         int error;
 340
 341         error = MAC_EXTERNALIZE(mount, label, elements, outbuf, outbuflen);
 342
 343         return error;
 344 }
 345
 346 void
 347 mac_devfs_label_copy(struct label *src, struct label *dest)
 348 {
 349 #if SECURITY_MAC_CHECK_ENFORCE
 350         /* 21167099 - only check if we allow write */
 351         if (!mac_device_enforce) {
 352                 return;
 353         }
 354 #endif
 355
 356         VFS_KERNEL_DEBUG_START1(7, src);
 357         MAC_PERFORM(devfs_label_copy, src, dest);
 358         VFS_KERNEL_DEBUG_END1(7, src);
 359 }
 360
 361 void
 362 mac_devfs_label_update(struct mount *mp, struct devnode *de,
 363     struct vnode *vp)
 364 {
 365 #if SECURITY_MAC_CHECK_ENFORCE
 366         /* 21167099 - only check if we allow write */
 367         if (!mac_device_enforce) {
 368                 return;
 369         }
 370 #endif
 371
 372         VFS_KERNEL_DEBUG_START1(8, vp);
 373         MAC_PERFORM(devfs_label_update, mp, de, de->dn_label, vp,
 374             vp->v_label);
 375         VFS_KERNEL_DEBUG_END1(8, vp);
 376 }
 377
 378 int
 379 mac_vnode_label_associate(struct mount *mp, struct vnode *vp, vfs_context_t ctx)
 380 {
 381         struct devnode *dnp;
 382         struct fdescnode *fnp;
 383         int error = 0;
 384
 385 #if SECURITY_MAC_CHECK_ENFORCE
 386         /* 21167099 - only check if we allow write */
 387         if (!mac_vnode_enforce) {
 388                 return error;
 389         }
 390 #endif
 391
 392         /* XXX: should not inspect v_tag in kernel! */
 393         switch (vp->v_tag) {
 394         case VT_DEVFS:
 395                 dnp = VTODN(vp);
 396                 mac_vnode_label_associate_devfs(mp, dnp, vp);
 397                 break;
 398         case VT_FDESC:
 399                 fnp = VTOFDESC(vp);
 400                 error = mac_vnode_label_associate_fdesc(mp, fnp, vp, ctx);
 401                 break;
 402         default:
 403                 error = mac_vnode_label_associate_extattr(mp, vp);
 404                 break;
 405         }
 406
 407         return error;
 408 }
 409
 410 void
 411 mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de,
 412     struct vnode *vp)
 413 {
 414 #if SECURITY_MAC_CHECK_ENFORCE
 415         /* 21167099 - only check if we allow write */
 416         if (!mac_device_enforce) {
 417                 return;
 418         }
 419 #endif
 420
 421         VFS_KERNEL_DEBUG_START1(9, vp);
 422         MAC_PERFORM(vnode_label_associate_devfs,
 423             mp, mp ? mp->mnt_mntlabel : NULL,
 424             de, de->dn_label,
 425             vp, vp->v_label);
 426         VFS_KERNEL_DEBUG_END1(9, vp);
 427 }
 428
 429 int
 430 mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp)
 431 {
 432         int error;
 433
 434         VFS_KERNEL_DEBUG_START1(10, vp);
 435         MAC_CHECK(vnode_label_associate_extattr, mp, mp->mnt_mntlabel, vp,
 436             vp->v_label);
 437         VFS_KERNEL_DEBUG_END1(10, vp);
 438
 439         return error;
 440 }
 441
 442 void
 443 mac_vnode_label_associate_singlelabel(struct mount *mp, struct vnode *vp)
 444 {
 445 #if SECURITY_MAC_CHECK_ENFORCE
 446         /* 21167099 - only check if we allow write */
 447         if (!mac_vnode_enforce) {
 448                 return;
 449         }
 450 #endif
 451         if (!mac_label_vnodes) {
 452                 return;
 453         }
 454
 455         VFS_KERNEL_DEBUG_START1(11, vp);
 456         MAC_PERFORM(vnode_label_associate_singlelabel, mp,
 457             mp ? mp->mnt_mntlabel : NULL, vp, vp->v_label);
 458         VFS_KERNEL_DEBUG_END1(11, vp);
 459 }
 460
 461 int
 462 mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
 463     struct vnode *dvp, struct vnode *vp, struct componentname *cnp)
 464 {
 465         kauth_cred_t cred;
 466         int error;
 467
 468 #if SECURITY_MAC_CHECK_ENFORCE
 469         /* 21167099 - only check if we allow write */
 470         if (!mac_vnode_enforce) {
 471                 return 0;
 472         }
 473 #endif
 474         cred = vfs_context_ucred(ctx);
 475         if (!mac_cred_check_enforce(cred)) {
 476                 return 0;
 477         }
 478         VFS_KERNEL_DEBUG_START1(12, vp);
 479         MAC_CHECK(vnode_notify_create, cred, mp, mp->mnt_mntlabel,
 480             dvp, dvp->v_label, vp, vp->v_label, cnp);
 481         VFS_KERNEL_DEBUG_END1(12, vp);
 482
 483         return error;
 484 }
 485
 486 void
 487 mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
 488     struct vnode *dvp, struct componentname *cnp)
 489 {
 490         kauth_cred_t cred;
 491
 492 #if SECURITY_MAC_CHECK_ENFORCE
 493         /* 21167099 - only check if we allow write */
 494         if (!mac_vnode_enforce) {
 495                 return;
 496         }
 497 #endif
 498         cred = vfs_context_ucred(ctx);
 499         if (!mac_cred_check_enforce(cred)) {
 500                 return;
 501         }
 502         VFS_KERNEL_DEBUG_START1(13, vp);
 503         MAC_PERFORM(vnode_notify_rename, cred, vp, vp->v_label,
 504             dvp, dvp->v_label, cnp);
 505         VFS_KERNEL_DEBUG_END1(13, vp);
 506 }
 507
 508 void
 509 mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags)
 510 {
 511         kauth_cred_t cred;
 512
 513 #if SECURITY_MAC_CHECK_ENFORCE
 514         /* 21167099 - only check if we allow write */
 515         if (!mac_vnode_enforce) {
 516                 return;
 517         }
 518 #endif
 519         cred = vfs_context_ucred(ctx);
 520         if (!mac_cred_check_enforce(cred)) {
 521                 return;
 522         }
 523         VFS_KERNEL_DEBUG_START1(14, vp);
 524         MAC_PERFORM(vnode_notify_open, cred, vp, vp->v_label, acc_flags);
 525         VFS_KERNEL_DEBUG_END1(14, vp);
 526 }
 527
 528 void
 529 mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
 530     struct vnode *dvp, struct componentname *cnp)
 531 {
 532         kauth_cred_t cred;
 533
 534 #if SECURITY_MAC_CHECK_ENFORCE
 535         /* 21167099 - only check if we allow write */
 536         if (!mac_vnode_enforce) {
 537                 return;
 538         }
 539 #endif
 540         cred = vfs_context_ucred(ctx);
 541         if (!mac_cred_check_enforce(cred)) {
 542                 return;
 543         }
 544         VFS_KERNEL_DEBUG_START1(15, vp);
 545         MAC_PERFORM(vnode_notify_link, cred, dvp, dvp->v_label, vp, vp->v_label, cnp);
 546         VFS_KERNEL_DEBUG_END1(15, vp);
 547 }
 548
 549 void
 550 mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name)
 551 {
 552         kauth_cred_t cred;
 553
 554 #if SECURITY_MAC_CHECK_ENFORCE
 555         /* 21167099 - only check if we allow write */
 556         if (!mac_vnode_enforce) {
 557                 return;
 558         }
 559 #endif
 560         cred = vfs_context_ucred(ctx);
 561         if (!mac_cred_check_enforce(cred)) {
 562                 return;
 563         }
 564         VFS_KERNEL_DEBUG_START1(16, vp);
 565         MAC_PERFORM(vnode_notify_deleteextattr, cred, vp, vp->v_label, name);
 566         VFS_KERNEL_DEBUG_END1(16, vp);
 567 }
 568
 569 void
 570 mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl)
 571 {
 572         kauth_cred_t cred;
 573
 574 #if SECURITY_MAC_CHECK_ENFORCE
 575         /* 21167099 - only check if we allow write */
 576         if (!mac_vnode_enforce) {
 577                 return;
 578         }
 579 #endif
 580         cred = vfs_context_ucred(ctx);
 581         if (!mac_cred_check_enforce(cred)) {
 582                 return;
 583         }
 584         VFS_KERNEL_DEBUG_START1(17, vp);
 585         MAC_PERFORM(vnode_notify_setacl, cred, vp, vp->v_label, acl);
 586         VFS_KERNEL_DEBUG_END1(17, vp);
 587 }
 588
 589 void
 590 mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist)
 591 {
 592         kauth_cred_t cred;
 593
 594 #if SECURITY_MAC_CHECK_ENFORCE
 595         /* 21167099 - only check if we allow write */
 596         if (!mac_vnode_enforce) {
 597                 return;
 598         }
 599 #endif
 600         cred = vfs_context_ucred(ctx);
 601         if (!mac_cred_check_enforce(cred)) {
 602                 return;
 603         }
 604         VFS_KERNEL_DEBUG_START1(18, vp);
 605         MAC_PERFORM(vnode_notify_setattrlist, cred, vp, vp->v_label, alist);
 606         VFS_KERNEL_DEBUG_END1(18, vp);
 607 }
 608
 609 void
 610 mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio)
 611 {
 612         kauth_cred_t cred;
 613
 614 #if SECURITY_MAC_CHECK_ENFORCE
 615         /* 21167099 - only check if we allow write */
 616         if (!mac_vnode_enforce) {
 617                 return;
 618         }
 619 #endif
 620         cred = vfs_context_ucred(ctx);
 621         if (!mac_cred_check_enforce(cred)) {
 622                 return;
 623         }
 624         VFS_KERNEL_DEBUG_START1(19, vp);
 625         MAC_PERFORM(vnode_notify_setextattr, cred, vp, vp->v_label, name, uio);
 626         VFS_KERNEL_DEBUG_END1(19, vp);
 627 }
 628
 629 void
 630 mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags)
 631 {
 632         kauth_cred_t cred;
 633
 634 #if SECURITY_MAC_CHECK_ENFORCE
 635         /* 21167099 - only check if we allow write */
 636         if (!mac_vnode_enforce) {
 637                 return;
 638         }
 639 #endif
 640         cred = vfs_context_ucred(ctx);
 641         if (!mac_cred_check_enforce(cred)) {
 642                 return;
 643         }
 644         VFS_KERNEL_DEBUG_START1(20, vp);
 645         MAC_PERFORM(vnode_notify_setflags, cred, vp, vp->v_label, flags);
 646         VFS_KERNEL_DEBUG_END1(20, vp);
 647 }
 648
 649 void
 650 mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode)
 651 {
 652         kauth_cred_t cred;
 653
 654 #if SECURITY_MAC_CHECK_ENFORCE
 655         /* 21167099 - only check if we allow write */
 656         if (!mac_vnode_enforce) {
 657                 return;
 658         }
 659 #endif
 660         cred = vfs_context_ucred(ctx);
 661         if (!mac_cred_check_enforce(cred)) {
 662                 return;
 663         }
 664         VFS_KERNEL_DEBUG_START1(21, vp);
 665         MAC_PERFORM(vnode_notify_setmode, cred, vp, vp->v_label, mode);
 666         VFS_KERNEL_DEBUG_END1(21, vp);
 667 }
 668
 669 void
 670 mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid)
 671 {
 672         kauth_cred_t cred;
 673
 674 #if SECURITY_MAC_CHECK_ENFORCE
 675         /* 21167099 - only check if we allow write */
 676         if (!mac_vnode_enforce) {
 677                 return;
 678         }
 679 #endif
 680         cred = vfs_context_ucred(ctx);
 681         if (!mac_cred_check_enforce(cred)) {
 682                 return;
 683         }
 684         VFS_KERNEL_DEBUG_START1(22, vp);
 685         MAC_PERFORM(vnode_notify_setowner, cred, vp, vp->v_label, uid, gid);
 686         VFS_KERNEL_DEBUG_END1(22, vp);
 687 }
 688
 689 void
 690 mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime)
 691 {
 692         kauth_cred_t cred;
 693
 694 #if SECURITY_MAC_CHECK_ENFORCE
 695         /* 21167099 - only check if we allow write */
 696         if (!mac_vnode_enforce) {
 697                 return;
 698         }
 699 #endif
 700         cred = vfs_context_ucred(ctx);
 701         if (!mac_cred_check_enforce(cred)) {
 702                 return;
 703         }
 704         VFS_KERNEL_DEBUG_START1(23, vp);
 705         MAC_PERFORM(vnode_notify_setutimes, cred, vp, vp->v_label, atime, mtime);
 706         VFS_KERNEL_DEBUG_END1(23, vp);
 707 }
 708
 709 void
 710 mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp)
 711 {
 712         kauth_cred_t cred;
 713
 714 #if SECURITY_MAC_CHECK_ENFORCE
 715         /* 21167099 - only check if we allow write */
 716         if (!mac_vnode_enforce) {
 717                 return;
 718         }
 719 #endif
 720         cred = vfs_context_ucred(ctx);
 721         if (!mac_cred_check_enforce(cred)) {
 722                 return;
 723         }
 724         VFS_KERNEL_DEBUG_START1(24, vp);
 725         MAC_PERFORM(vnode_notify_truncate, cred, file_cred, vp, vp->v_label);
 726         VFS_KERNEL_DEBUG_END1(24, vp);
 727 }
 728
 729 /*
 730  * Extended attribute 'name' was updated via
 731  * vn_setxattr() or vn_removexattr().  Allow the
 732  * policy to update the vnode label.
 733  */
 734 void
 735 mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp,
 736     const char *name)
 737 {
 738         int error = 0;
 739
 740 #if SECURITY_MAC_CHECK_ENFORCE
 741         /* 21167099 - only check if we allow write */
 742         if (!mac_vnode_enforce) {
 743                 return;
 744         }
 745 #endif
 746         if (!mac_label_vnodes) {
 747                 return;
 748         }
 749
 750         VFS_KERNEL_DEBUG_START1(25, vp);
 751         MAC_PERFORM(vnode_label_update_extattr, mp, mp->mnt_mntlabel, vp,
 752             vp->v_label, name);
 753         VFS_KERNEL_DEBUG_END1(25, vp);
 754         if (error == 0) {
 755                 return;
 756         }
 757
 758         vnode_lock(vp);
 759         vnode_relabel(vp);
 760         vnode_unlock(vp);
 761         return;
 762 }
 763
 764 static int
 765 mac_vnode_label_store(vfs_context_t ctx, struct vnode *vp,
 766     struct label *intlabel)
 767 {
 768         kauth_cred_t cred;
 769         int error;
 770
 771 #if SECURITY_MAC_CHECK_ENFORCE
 772         /* 21167099 - only check if we allow write */
 773         if (!mac_vnode_enforce) {
 774                 return 0;
 775         }
 776 #endif
 777         if (!mac_label_vnodes) {
 778                 return 0;
 779         }
 780
 781         cred = vfs_context_ucred(ctx);
 782         if (!mac_cred_check_enforce(cred)) {
 783                 return 0;
 784         }
 785         VFS_KERNEL_DEBUG_START1(26, vp);
 786         MAC_CHECK(vnode_label_store, cred, vp, vp->v_label, intlabel);
 787         VFS_KERNEL_DEBUG_END1(26, vp);
 788
 789         return error;
 790 }
 791
 792 void
 793 mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode *vp, off_t offset,
 794     struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execl, u_int *csflags,
 795     void *macextensions, int *disjoint, int *labelupdateerror)
 796 {
 797         kauth_cred_t cred;
 798         *disjoint = 0;
 799         int error;
 800         posix_cred_t pcred = posix_cred_get(new);
 801
 802 #if SECURITY_MAC_CHECK_ENFORCE
 803         /* 21167099 - only check if we allow write */
 804         if (!mac_proc_enforce || !mac_vnode_enforce) {
 805                 return;
 806         }
 807 #endif
 808
 809         /* mark the new cred to indicate "matching" includes the label */
 810         pcred->cr_flags |= CRF_MAC_ENFORCE;
 811
 812         cred = vfs_context_ucred(ctx);
 813
 814         /*
 815          * NB: Cannot use MAC_CHECK macro because we need a sequence point after
 816          *     calling exec_spawnattr_getmacpolicyinfo() and before passing the
 817          *     spawnattrlen as an argument to the hook.
 818          */
 819         VFS_KERNEL_DEBUG_START1(27, vp);
 820         {
 821                 struct mac_policy_conf *mpc;
 822                 u_int i;
 823
 824                 error = 0;
 825                 for (i = 0; i < mac_policy_list.staticmax; i++) {
 826                         mpc = mac_policy_list.entries[i].mpc;
 827                         if (mpc == NULL) {
 828                                 continue;
 829                         }
 830
 831                         mpo_cred_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_label_update_execve;
 832                         if (hook == NULL) {
 833                                 continue;
 834                         }
 835
 836                         size_t spawnattrlen = 0;
 837                         void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen);
 838
 839                         error = mac_error_select(hook(cred, new, vfs_context_proc(ctx), vp, offset, scriptvp,
 840                             vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint),
 841                             error);
 842                 }
 843                 if (mac_policy_list_conditional_busy() != 0) {
 844                         for (; i <= mac_policy_list.maxindex; i++) {
 845                                 mpc = mac_policy_list.entries[i].mpc;
 846                                 if (mpc == NULL) {
 847                                         continue;
 848                                 }
 849
 850                                 mpo_cred_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_label_update_execve;
 851                                 if (hook == NULL) {
 852                                         continue;
 853                                 }
 854
 855                                 size_t spawnattrlen = 0;
 856                                 void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen);
 857
 858                                 error = mac_error_select(hook(cred, new, vfs_context_proc(ctx), vp, offset, scriptvp,
 859                                     vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint),
 860                                     error);
 861                         }
 862                         mac_policy_list_unbusy();
 863                 }
 864         }
 865         *labelupdateerror = error;
 866         VFS_KERNEL_DEBUG_END1(27, vp);
 867 }
 868
 869 int
 870 mac_cred_check_label_update_execve(vfs_context_t ctx, struct vnode *vp, off_t offset,
 871     struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execlabel,
 872     struct proc *p, void *macextensions)
 873 {
 874         kauth_cred_t cred;
 875         int result = 0;
 876
 877 #if SECURITY_MAC_CHECK_ENFORCE
 878         /* 21167099 - only check if we allow write */
 879         if (!mac_proc_enforce || !mac_vnode_enforce) {
 880                 return result;
 881         }
 882 #endif
 883
 884         cred = vfs_context_ucred(ctx);
 885
 886         VFS_KERNEL_DEBUG_START1(28, vp);
 887         /*
 888          * NB: Cannot use MAC_BOOLEAN macro because we need a sequence point after
 889          *     calling exec_spawnattr_getmacpolicyinfo() and before passing the
 890          *     spawnattrlen as an argument to the hook.
 891          */
 892         {
 893                 struct mac_policy_conf *mpc;
 894                 u_int i;
 895
 896                 for (i = 0; i < mac_policy_list.staticmax; i++) {
 897                         mpc = mac_policy_list.entries[i].mpc;
 898                         if (mpc == NULL) {
 899                                 continue;
 900                         }
 901
 902                         mpo_cred_check_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_check_label_update_execve;
 903                         if (hook == NULL) {
 904                                 continue;
 905                         }
 906
 907                         size_t spawnattrlen = 0;
 908                         void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen);
 909
 910                         result = result || hook(cred, vp, offset, scriptvp, vp->v_label, scriptvnodelabel, execlabel, p, spawnattr, spawnattrlen);
 911                 }
 912                 if (mac_policy_list_conditional_busy() != 0) {
 913                         for (; i <= mac_policy_list.maxindex; i++) {
 914                                 mpc = mac_policy_list.entries[i].mpc;
 915                                 if (mpc == NULL) {
 916                                         continue;
 917                                 }
 918
 919                                 mpo_cred_check_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_check_label_update_execve;
 920                                 if (hook == NULL) {
 921                                         continue;
 922                                 }
 923
 924                                 size_t spawnattrlen = 0;
 925                                 void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen);
 926
 927                                 result = result || hook(cred, vp, offset, scriptvp, vp->v_label, scriptvnodelabel, execlabel, p, spawnattr, spawnattrlen);
 928                         }
 929                         mac_policy_list_unbusy();
 930                 }
 931         }
 932         VFS_KERNEL_DEBUG_END1(28, vp);
 933
 934         return result;
 935 }
 936
 937 int
 938 mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
 939     int acc_mode)
 940 {
 941         kauth_cred_t cred;
 942         int error;
 943         int mask;
 944
 945 #if SECURITY_MAC_CHECK_ENFORCE
 946         /* 21167099 - only check if we allow write */
 947         if (!mac_vnode_enforce) {
 948                 return 0;
 949         }
 950 #endif
 951         cred = vfs_context_ucred(ctx);
 952         if (!mac_cred_check_enforce(cred)) {
 953                 return 0;
 954         }
 955         /* Convert {R,W,X}_OK values to V{READ,WRITE,EXEC} for entry points */
 956         mask = ACCESS_MODE_TO_VNODE_MASK(acc_mode);
 957         VFS_KERNEL_DEBUG_START1(29, vp);
 958         MAC_CHECK(vnode_check_access, cred, vp, vp->v_label, mask);
 959         VFS_KERNEL_DEBUG_END1(29, vp);
 960         return error;
 961 }
 962
 963 int
 964 mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp)
 965 {
 966         kauth_cred_t cred;
 967         int error;
 968
 969 #if SECURITY_MAC_CHECK_ENFORCE
 970         /* 21167099 - only check if we allow write */
 971         if (!mac_vnode_enforce) {
 972                 return 0;
 973         }
 974 #endif
 975         cred = vfs_context_ucred(ctx);
 976         if (!mac_cred_check_enforce(cred)) {
 977                 return 0;
 978         }
 979         VFS_KERNEL_DEBUG_START1(30, dvp);
 980         MAC_CHECK(vnode_check_chdir, cred, dvp, dvp->v_label);
 981         VFS_KERNEL_DEBUG_END1(30, dvp);
 982         return error;
 983 }
 984
 985 int
 986 mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp,
 987     struct componentname *cnp)
 988 {
 989         kauth_cred_t cred;
 990         int error;
 991
 992 #if SECURITY_MAC_CHECK_ENFORCE
 993         /* 21167099 - only check if we allow write */
 994         if (!mac_vnode_enforce) {
 995                 return 0;
 996         }
 997 #endif
 998         cred = vfs_context_ucred(ctx);
 999         if (!mac_cred_check_enforce(cred)) {
1000                 return 0;
1001         }
1002         VFS_KERNEL_DEBUG_START1(31, dvp);
1003         MAC_CHECK(vnode_check_chroot, cred, dvp, dvp->v_label, cnp);
1004         VFS_KERNEL_DEBUG_END1(31, dvp);
1005         return error;
1006 }
1007
1008 int
1009 mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp,
1010     struct vnode *vp, struct componentname *cnp)
1011 {
1012         kauth_cred_t cred;
1013         int error;
1014
1015 #if SECURITY_MAC_CHECK_ENFORCE
1016         /* 21167099 - only check if we allow write */
1017         if (!mac_vnode_enforce) {
1018                 return 0;
1019         }
1020 #endif
1021         cred = vfs_context_ucred(ctx);
1022         if (!mac_cred_check_enforce(cred)) {
1023                 return 0;
1024         }
1025         VFS_KERNEL_DEBUG_START1(32, dvp);
1026         MAC_CHECK(vnode_check_clone, cred, dvp, dvp->v_label, vp,
1027             vp->v_label, cnp);
1028         VFS_KERNEL_DEBUG_END1(32, dvp);
1029         return error;
1030 }
1031 int
1032 mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp,
1033     struct componentname *cnp, struct vnode_attr *vap)
1034 {
1035         kauth_cred_t cred;
1036         int error;
1037
1038 #if SECURITY_MAC_CHECK_ENFORCE
1039         /* 21167099 - only check if we allow write */
1040         if (!mac_vnode_enforce) {
1041                 return 0;
1042         }
1043 #endif
1044         cred = vfs_context_ucred(ctx);
1045         if (!mac_cred_check_enforce(cred)) {
1046                 return 0;
1047         }
1048         VFS_KERNEL_DEBUG_START1(33, dvp);
1049         MAC_CHECK(vnode_check_create, cred, dvp, dvp->v_label, cnp, vap);
1050         VFS_KERNEL_DEBUG_END1(33, dvp);
1051         return error;
1052 }
1053
1054 int
1055 mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, struct vnode *vp,
1056     struct componentname *cnp)
1057 {
1058         kauth_cred_t cred;
1059         int error;
1060
1061 #if SECURITY_MAC_CHECK_ENFORCE
1062         /* 21167099 - only check if we allow write */
1063         if (!mac_vnode_enforce) {
1064                 return 0;
1065         }
1066 #endif
1067         cred = vfs_context_ucred(ctx);
1068         if (!mac_cred_check_enforce(cred)) {
1069                 return 0;
1070         }
1071         VFS_KERNEL_DEBUG_START1(34, dvp);
1072         MAC_CHECK(vnode_check_unlink, cred, dvp, dvp->v_label, vp,
1073             vp->v_label, cnp);
1074         VFS_KERNEL_DEBUG_END1(34, dvp);
1075         return error;
1076 }
1077 #if 0
1078 int
1079 mac_vnode_check_deleteacl(vfs_context_t ctx, struct vnode *vp,
1080     acl_type_t type)
1081 {
1082         kauth_cred_t cred;
1083         int error;
1084
1085 #if SECURITY_MAC_CHECK_ENFORCE
1086         /* 21167099 - only check if we allow write */
1087         if (!mac_vnode_enforce) {
1088                 return 0;
1089         }
1090 #endif
1091         cred = vfs_context_ucred(ctx);
1092         if (!mac_cred_check_enforce(cred)) {
1093                 return 0;
1094         }
1095         VFS_KERNEL_DEBUG_START1(35, dvp);
1096         MAC_CHECK(vnode_check_deleteacl, cred, vp, vp->v_label, type);
1097         VFS_KERNEL_DEBUG_END1(35, dvp);
1098         return error;
1099 }
1100 #endif
1101
1102 int
1103 mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp,
1104     const char *name)
1105 {
1106         kauth_cred_t cred;
1107         int error;
1108
1109 #if SECURITY_MAC_CHECK_ENFORCE
1110         /* 21167099 - only check if we allow write */
1111         if (!mac_vnode_enforce) {
1112                 return 0;
1113         }
1114 #endif
1115         cred = vfs_context_ucred(ctx);
1116         if (!mac_cred_check_enforce(cred)) {
1117                 return 0;
1118         }
1119         VFS_KERNEL_DEBUG_START1(36, vp);
1120         MAC_CHECK(vnode_check_deleteextattr, cred, vp, vp->v_label, name);
1121         VFS_KERNEL_DEBUG_END1(36, vp);
1122         return error;
1123 }
1124 int
1125 mac_vnode_check_exchangedata(vfs_context_t ctx,
1126     struct vnode *v1, struct vnode *v2)
1127 {
1128         kauth_cred_t cred;
1129         int error;
1130
1131 #if SECURITY_MAC_CHECK_ENFORCE
1132         /* 21167099 - only check if we allow write */
1133         if (!mac_vnode_enforce) {
1134                 return 0;
1135         }
1136 #endif
1137         cred = vfs_context_ucred(ctx);
1138         if (!mac_cred_check_enforce(cred)) {
1139                 return 0;
1140         }
1141         VFS_KERNEL_DEBUG_START1(37, v1);
1142         MAC_CHECK(vnode_check_exchangedata, cred, v1, v1->v_label,
1143             v2, v2->v_label);
1144         VFS_KERNEL_DEBUG_END1(37, v1);
1145
1146         return error;
1147 }
1148
1149 #if 0
1150 int
1151 mac_vnode_check_getacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type)
1152 {
1153         kauth_cred_t cred;
1154         int error;
1155
1156 #if SECURITY_MAC_CHECK_ENFORCE
1157         /* 21167099 - only check if we allow write */
1158         if (!mac_vnode_enforce) {
1159                 return 0;
1160         }
1161 #endif
1162         cred = vfs_context_ucred(ctx);
1163         if (!mac_cred_check_enforce(cred)) {
1164                 return 0;
1165         }
1166         VFS_KERNEL_DEBUG_START1(38, vp);
1167         MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type);
1168         VFS_KERNEL_DEBUG_END1(38, vp);
1169         return error;
1170 }
1171 #endif
1172
1173 int
1174 mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred,
1175     struct vnode *vp, struct vnode_attr *va)
1176 {
1177         kauth_cred_t cred;
1178         int error;
1179
1180 #if SECURITY_MAC_CHECK_ENFORCE
1181         /* 21167099 - only check if we allow write */
1182         if (!mac_vnode_enforce) {
1183                 return 0;
1184         }
1185 #endif
1186         cred = vfs_context_ucred(ctx);
1187         if (!mac_cred_check_enforce(cred)) {
1188                 return 0;
1189         }
1190         VFS_KERNEL_DEBUG_START1(39, vp);
1191         MAC_CHECK(vnode_check_getattr, cred, file_cred, vp, vp->v_label, va);
1192         VFS_KERNEL_DEBUG_END1(39, vp);
1193         return error;
1194 }
1195
1196 int
1197 mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
1198     struct attrlist *alist)
1199 {
1200         kauth_cred_t cred;
1201         int error;
1202
1203 #if SECURITY_MAC_CHECK_ENFORCE
1204         /* 21167099 - only check if we allow write */
1205         if (!mac_vnode_enforce) {
1206                 return 0;
1207         }
1208 #endif
1209         cred = vfs_context_ucred(ctx);
1210         if (!mac_cred_check_enforce(cred)) {
1211                 return 0;
1212         }
1213         VFS_KERNEL_DEBUG_START1(40, vp);
1214         MAC_CHECK(vnode_check_getattrlist, cred, vp, vp->v_label, alist);
1215         VFS_KERNEL_DEBUG_END1(40, vp);
1216
1217         /* Falsify results instead of returning error? */
1218         return error;
1219 }
1220
1221 int
1222 mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
1223     struct image_params *imgp)
1224 {
1225         kauth_cred_t cred;
1226         int error = 0;
1227
1228 #if SECURITY_MAC_CHECK_ENFORCE
1229         /* 21167099 - only check if we allow write */
1230         if (!mac_proc_enforce || !mac_vnode_enforce) {
1231                 return 0;
1232         }
1233 #endif
1234
1235         cred = vfs_context_ucred(ctx);
1236
1237         /*
1238          * NB: Cannot use MAC_CHECK macro because we need a sequence point after
1239          *     calling exec_spawnattr_getmacpolicyinfo() and before passing the
1240          *     spawnattrlen as an argument to the hook.
1241          */
1242         VFS_KERNEL_DEBUG_START1(41, vp);
1243         {
1244                 struct mac_policy_conf *mpc;
1245                 u_int i;
1246
1247                 for (i = 0; i < mac_policy_list.staticmax; i++) {
1248                         mpc = mac_policy_list.entries[i].mpc;
1249                         if (mpc == NULL) {
1250                                 continue;
1251                         }
1252
1253                         mpo_vnode_check_exec_t *hook = mpc->mpc_ops->mpo_vnode_check_exec;
1254                         if (hook == NULL) {
1255                                 continue;
1256                         }
1257
1258                         size_t spawnattrlen = 0;
1259                         void *spawnattr = exec_spawnattr_getmacpolicyinfo(imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen);
1260
1261                         error = mac_error_select(
1262                                 hook(cred,
1263                                 vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp,
1264                                 imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags,
1265                                 spawnattr, spawnattrlen), error);
1266                 }
1267                 if (mac_policy_list_conditional_busy() != 0) {
1268                         for (; i <= mac_policy_list.maxindex; i++) {
1269                                 mpc = mac_policy_list.entries[i].mpc;
1270                                 if (mpc == NULL) {
1271                                         continue;
1272                                 }
1273
1274                                 mpo_vnode_check_exec_t *hook = mpc->mpc_ops->mpo_vnode_check_exec;
1275                                 if (hook == NULL) {
1276                                         continue;
1277                                 }
1278
1279                                 size_t spawnattrlen = 0;
1280                                 void *spawnattr = exec_spawnattr_getmacpolicyinfo(imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen);
1281
1282                                 error = mac_error_select(
1283                                         hook(cred,
1284                                         vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp,
1285                                         imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags,
1286                                         spawnattr, spawnattrlen), error);
1287                         }
1288                         mac_policy_list_unbusy();
1289                 }
1290         }
1291         VFS_KERNEL_DEBUG_END1(41, vp);
1292
1293         return error;
1294 }
1295
1296 int
1297 mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp)
1298 {
1299         kauth_cred_t cred;
1300         int error;
1301
1302 #if SECURITY_MAC_CHECK_ENFORCE
1303         /* 21167099 - only check if we allow write */
1304         if (!mac_vnode_enforce) {
1305                 return 0;
1306         }
1307 #endif
1308         cred = vfs_context_ucred(ctx);
1309         if (!mac_cred_check_enforce(cred)) {
1310                 return 0;
1311         }
1312         VFS_KERNEL_DEBUG_START1(42, vp);
1313         MAC_CHECK(vnode_check_fsgetpath, cred, vp, vp->v_label);
1314         VFS_KERNEL_DEBUG_END1(42, vp);
1315         return error;
1316 }
1317
1318 int
1319 mac_vnode_check_signature(struct vnode *vp, struct cs_blob *cs_blob,
1320     struct image_params *imgp,
1321     unsigned int *cs_flags, unsigned int *signer_type,
1322     int flags)
1323 {
1324         int error;
1325         char *fatal_failure_desc = NULL;
1326         size_t fatal_failure_desc_len = 0;
1327
1328         char *vn_path = NULL;
1329         vm_size_t vn_pathlen = MAXPATHLEN;
1330         cpu_type_t cpu_type = (imgp == NULL) ? CPU_TYPE_ANY : imgp->ip_origcputype;
1331
1332
1333 #if SECURITY_MAC_CHECK_ENFORCE
1334         /* 21167099 - only check if we allow write */
1335         if (!mac_proc_enforce || !mac_vnode_enforce) {
1336                 return 0;
1337         }
1338 #endif
1339
1340         VFS_KERNEL_DEBUG_START1(43, vp);
1341         MAC_CHECK(vnode_check_signature, vp, vp->v_label, cpu_type, cs_blob,
1342             cs_flags, signer_type, flags, &fatal_failure_desc, &fatal_failure_desc_len);
1343         VFS_KERNEL_DEBUG_END1(43, vp);
1344
1345         if (fatal_failure_desc_len) {
1346                 // A fatal code signature validation failure occured, formulate a crash
1347                 // reason.
1348
1349                 char const *path = NULL;
1350
1351                 vn_path = (char *)kalloc(MAXPATHLEN);
1352                 if (vn_path != NULL) {
1353                         if (vn_getpath(vp, vn_path, (int*)&vn_pathlen) == 0) {
1354                                 path = vn_path;
1355                         } else {
1356                                 path = "(get vnode path failed)";
1357                         }
1358                 } else {
1359                         path = "(path alloc failed)";
1360                 }
1361
1362                 if (error == 0) {
1363                         panic("mac_vnode_check_signature: MAC hook returned no error, "
1364                             "but status is claimed to be fatal? "
1365                             "path: '%s', fatal_failure_desc_len: %ld, fatal_failure_desc:\n%s\n",
1366                             path, fatal_failure_desc_len, fatal_failure_desc);
1367                 }
1368
1369                 printf("mac_vnode_check_signature: %s: code signature validation failed fatally: %s",
1370                     path, fatal_failure_desc);
1371
1372                 if (imgp == NULL) {
1373                         goto out;
1374                 }
1375
1376                 os_reason_t reason = os_reason_create(OS_REASON_CODESIGNING,
1377                     CODESIGNING_EXIT_REASON_TASKGATED_INVALID_SIG);
1378
1379                 if (reason == OS_REASON_NULL) {
1380                         printf("mac_vnode_check_signature: %s: failure to allocate exit reason for validation failure: %s\n",
1381                             path, fatal_failure_desc);
1382                         goto out;
1383                 }
1384
1385                 imgp->ip_cs_error = reason;
1386                 reason->osr_flags = (OS_REASON_FLAG_GENERATE_CRASH_REPORT |
1387                     OS_REASON_FLAG_CONSISTENT_FAILURE);
1388
1389                 if (fatal_failure_desc == NULL) {
1390                         // This may happen if allocation for the buffer failed.
1391                         printf("mac_vnode_check_signature: %s: fatal failure is missing its description.\n", path);
1392                 } else {
1393                         mach_vm_address_t data_addr = 0;
1394
1395                         int reason_error = 0;
1396                         int kcdata_error = 0;
1397
1398                         if ((reason_error = os_reason_alloc_buffer_noblock(reason, kcdata_estimate_required_buffer_size
1399                             (1, fatal_failure_desc_len))) == 0 &&
1400                             (kcdata_error = kcdata_get_memory_addr(&reason->osr_kcd_descriptor,
1401                             EXIT_REASON_USER_DESC, fatal_failure_desc_len,
1402                             &data_addr)) == KERN_SUCCESS) {
1403                                 kern_return_t mc_error = kcdata_memcpy(&reason->osr_kcd_descriptor, (mach_vm_address_t)data_addr,
1404                                     fatal_failure_desc, fatal_failure_desc_len);
1405
1406                                 if (mc_error != KERN_SUCCESS) {
1407                                         printf("mac_vnode_check_signature: %s: failed to copy reason string "
1408                                             "(kcdata_memcpy error: %d, length: %ld)\n",
1409                                             path, mc_error, fatal_failure_desc_len);
1410                                 }
1411                         } else {
1412                                 printf("mac_vnode_check_signature: %s: failed to allocate space for reason string "
1413                                     "(os_reason_alloc_buffer error: %d, kcdata error: %d, length: %ld)\n",
1414                                     path, reason_error, kcdata_error, fatal_failure_desc_len);
1415                         }
1416                 }
1417         }
1418
1419 out:
1420         if (vn_path) {
1421                 kfree(vn_path, MAXPATHLEN);
1422         }
1423
1424         if (fatal_failure_desc_len > 0 && fatal_failure_desc != NULL) {
1425                 kfree(fatal_failure_desc, fatal_failure_desc_len);
1426         }
1427
1428         return error;
1429 }
1430
1431 #if 0
1432 int
1433 mac_vnode_check_getacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type)
1434 {
1435         kauth_cred_t cred;
1436         int error;
1437
1438 #if SECURITY_MAC_CHECK_ENFORCE
1439         /* 21167099 - only check if we allow write */
1440         if (!mac_vnode_enforce) {
1441                 return 0;
1442         }
1443 #endif
1444         cred = vfs_context_ucred(ctx);
1445         if (!mac_cred_check_enforce(cred)) {
1446                 return 0;
1447         }
1448         VFS_KERNEL_DEBUG_START1(44, vp);
1449         MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type);
1450         VFS_KERNEL_DEBUG_END1(44, vp);
1451         return error;
1452 }
1453 #endif
1454
1455 int
1456 mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
1457     const char *name, struct uio *uio)
1458 {
1459         kauth_cred_t cred;
1460         int error;
1461
1462 #if SECURITY_MAC_CHECK_ENFORCE
1463         /* 21167099 - only check if we allow write */
1464         if (!mac_vnode_enforce) {
1465                 return 0;
1466         }
1467 #endif
1468         cred = vfs_context_ucred(ctx);
1469         if (!mac_cred_check_enforce(cred)) {
1470                 return 0;
1471         }
1472         VFS_KERNEL_DEBUG_START1(45, vp);
1473         MAC_CHECK(vnode_check_getextattr, cred, vp, vp->v_label,
1474             name, uio);
1475         VFS_KERNEL_DEBUG_END1(45, vp);
1476         return error;
1477 }
1478
1479 int
1480 mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, u_int cmd)
1481 {
1482         kauth_cred_t cred;
1483         int error;
1484
1485 #if SECURITY_MAC_CHECK_ENFORCE
1486         /* 21167099 - only check if we allow write */
1487         if (!mac_vnode_enforce) {
1488                 return 0;
1489         }
1490 #endif
1491         cred = vfs_context_ucred(ctx);
1492         if (!mac_cred_check_enforce(cred)) {
1493                 return 0;
1494         }
1495         VFS_KERNEL_DEBUG_START1(46, vp);
1496         MAC_CHECK(vnode_check_ioctl, cred, vp, vp->v_label, cmd);
1497         VFS_KERNEL_DEBUG_END1(46, vp);
1498         return error;
1499 }
1500
1501 int
1502 mac_vnode_check_kqfilter(vfs_context_t ctx, kauth_cred_t file_cred,
1503     struct knote *kn, struct vnode *vp)
1504 {
1505         kauth_cred_t cred;
1506         int error;
1507
1508 #if SECURITY_MAC_CHECK_ENFORCE
1509         /* 21167099 - only check if we allow write */
1510         if (!mac_vnode_enforce) {
1511                 return 0;
1512         }
1513 #endif
1514         cred = vfs_context_ucred(ctx);
1515         if (!mac_cred_check_enforce(cred)) {
1516                 return 0;
1517         }
1518         VFS_KERNEL_DEBUG_START1(47, vp);
1519         MAC_CHECK(vnode_check_kqfilter, cred, file_cred, kn, vp,
1520             vp->v_label);
1521         VFS_KERNEL_DEBUG_END1(47, vp);
1522
1523         return error;
1524 }
1525
1526 int
1527 mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp,
1528     struct vnode *vp, struct componentname *cnp)
1529 {
1530         kauth_cred_t cred;
1531         int error;
1532
1533 #if SECURITY_MAC_CHECK_ENFORCE
1534         /* 21167099 - only check if we allow write */
1535         if (!mac_vnode_enforce) {
1536                 return 0;
1537         }
1538 #endif
1539         cred = vfs_context_ucred(ctx);
1540         if (!mac_cred_check_enforce(cred)) {
1541                 return 0;
1542         }
1543         VFS_KERNEL_DEBUG_START1(48, vp);
1544         MAC_CHECK(vnode_check_link, cred, dvp, dvp->v_label, vp,
1545             vp->v_label, cnp);
1546         VFS_KERNEL_DEBUG_END1(48, vp);
1547         return error;
1548 }
1549
1550 int
1551 mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp)
1552 {
1553         kauth_cred_t cred;
1554         int error;
1555
1556 #if SECURITY_MAC_CHECK_ENFORCE
1557         /* 21167099 - only check if we allow write */
1558         if (!mac_vnode_enforce) {
1559                 return 0;
1560         }
1561 #endif
1562         cred = vfs_context_ucred(ctx);
1563         if (!mac_cred_check_enforce(cred)) {
1564                 return 0;
1565         }
1566         VFS_KERNEL_DEBUG_START1(49, vp);
1567         MAC_CHECK(vnode_check_listextattr, cred, vp, vp->v_label);
1568         VFS_KERNEL_DEBUG_END1(49, vp);
1569         return error;
1570 }
1571
1572 int
1573 mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp,
1574     const char *path, size_t pathlen)
1575 {
1576         kauth_cred_t cred;
1577         int error;
1578
1579 #if SECURITY_MAC_CHECK_ENFORCE
1580         /* 21167099 - only check if we allow write */
1581         if (!mac_vnode_enforce) {
1582                 return 0;
1583         }
1584 #endif
1585         cred = vfs_context_ucred(ctx);
1586         if (!mac_cred_check_enforce(cred)) {
1587                 return 0;
1588         }
1589         VFS_KERNEL_DEBUG_START1(50, dvp);
1590         MAC_CHECK(vnode_check_lookup_preflight, cred, dvp, dvp->v_label, path, pathlen);
1591         VFS_KERNEL_DEBUG_END1(50, dvp);
1592         return error;
1593 }
1594
1595 int
1596 mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp,
1597     struct componentname *cnp)
1598 {
1599         kauth_cred_t cred;
1600         int error;
1601
1602 #if SECURITY_MAC_CHECK_ENFORCE
1603         /* 21167099 - only check if we allow write */
1604         if (!mac_vnode_enforce) {
1605                 return 0;
1606         }
1607 #endif
1608         cred = vfs_context_ucred(ctx);
1609         if (!mac_cred_check_enforce(cred)) {
1610                 return 0;
1611         }
1612         VFS_KERNEL_DEBUG_START1(51, dvp);
1613         MAC_CHECK(vnode_check_lookup, cred, dvp, dvp->v_label, cnp);
1614         VFS_KERNEL_DEBUG_END1(51, dvp);
1615         return error;
1616 }
1617
1618 int
1619 mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, int acc_mode)
1620 {
1621         kauth_cred_t cred;
1622         int error;
1623
1624 #if SECURITY_MAC_CHECK_ENFORCE
1625         /* 21167099 - only check if we allow write */
1626         if (!mac_vnode_enforce) {
1627                 return 0;
1628         }
1629 #endif
1630         cred = vfs_context_ucred(ctx);
1631         if (!mac_cred_check_enforce(cred)) {
1632                 return 0;
1633         }
1634         VFS_KERNEL_DEBUG_START1(52, vp);
1635         MAC_CHECK(vnode_check_open, cred, vp, vp->v_label, acc_mode);
1636         VFS_KERNEL_DEBUG_END1(52, vp);
1637         return error;
1638 }
1639
1640 int
1641 mac_vnode_check_read(vfs_context_t ctx, struct ucred *file_cred,
1642     struct vnode *vp)
1643 {
1644         kauth_cred_t cred;
1645         int error;
1646
1647 #if SECURITY_MAC_CHECK_ENFORCE
1648         /* 21167099 - only check if we allow write */
1649         if (!mac_vnode_enforce) {
1650                 return 0;
1651         }
1652 #endif
1653         cred = vfs_context_ucred(ctx);
1654         if (!mac_cred_check_enforce(cred)) {
1655                 return 0;
1656         }
1657         VFS_KERNEL_DEBUG_START1(53, vp);
1658         MAC_CHECK(vnode_check_read, cred, file_cred, vp,
1659             vp->v_label);
1660         VFS_KERNEL_DEBUG_END1(53, vp);
1661
1662         return error;
1663 }
1664
1665 int
1666 mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *dvp)
1667 {
1668         kauth_cred_t cred;
1669         int error;
1670
1671 #if SECURITY_MAC_CHECK_ENFORCE
1672         /* 21167099 - only check if we allow write */
1673         if (!mac_vnode_enforce) {
1674                 return 0;
1675         }
1676 #endif
1677         cred = vfs_context_ucred(ctx);
1678         if (!mac_cred_check_enforce(cred)) {
1679                 return 0;
1680         }
1681         VFS_KERNEL_DEBUG_START1(54, dvp);
1682         MAC_CHECK(vnode_check_readdir, cred, dvp, dvp->v_label);
1683         VFS_KERNEL_DEBUG_END1(54, dvp);
1684         return error;
1685 }
1686
1687 int
1688 mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp)
1689 {
1690         kauth_cred_t cred;
1691         int error;
1692
1693 #if SECURITY_MAC_CHECK_ENFORCE
1694         /* 21167099 - only check if we allow write */
1695         if (!mac_vnode_enforce) {
1696                 return 0;
1697         }
1698 #endif
1699         cred = vfs_context_ucred(ctx);
1700         if (!mac_cred_check_enforce(cred)) {
1701                 return 0;
1702         }
1703         VFS_KERNEL_DEBUG_START1(55, vp);
1704         MAC_CHECK(vnode_check_readlink, cred, vp, vp->v_label);
1705         VFS_KERNEL_DEBUG_END1(55, vp);
1706         return error;
1707 }
1708
1709 int
1710 mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp,
1711     struct label *newlabel)
1712 {
1713         kauth_cred_t cred;
1714         int error;
1715
1716 #if SECURITY_MAC_CHECK_ENFORCE
1717         /* 21167099 - only check if we allow write */
1718         if (!mac_vnode_enforce) {
1719                 return 0;
1720         }
1721 #endif
1722         cred = vfs_context_ucred(ctx);
1723         if (!mac_cred_check_enforce(cred)) {
1724                 return 0;
1725         }
1726         VFS_KERNEL_DEBUG_START1(56, vp);
1727         MAC_CHECK(vnode_check_label_update, cred, vp, vp->v_label, newlabel);
1728         VFS_KERNEL_DEBUG_END1(56, vp);
1729
1730         return error;
1731 }
1732
1733 int
1734 mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp,
1735     struct vnode *vp, struct componentname *cnp, struct vnode *tdvp,
1736     struct vnode *tvp, struct componentname *tcnp)
1737 {
1738         kauth_cred_t cred;
1739         int error;
1740
1741 #if SECURITY_MAC_CHECK_ENFORCE
1742         /* 21167099 - only check if we allow write */
1743         if (!mac_vnode_enforce) {
1744                 return 0;
1745         }
1746 #endif
1747         cred = vfs_context_ucred(ctx);
1748         if (!mac_cred_check_enforce(cred)) {
1749                 return 0;
1750         }
1751
1752         VFS_KERNEL_DEBUG_START1(57, vp);
1753         MAC_CHECK(vnode_check_rename_from, cred, dvp, dvp->v_label, vp,
1754             vp->v_label, cnp);
1755         if (error) {
1756                 VFS_KERNEL_DEBUG_END1(57, vp);
1757                 return error;
1758         }
1759
1760         MAC_CHECK(vnode_check_rename_to, cred, tdvp, tdvp->v_label, tvp,
1761             tvp != NULL ? tvp->v_label : NULL, dvp == tdvp, tcnp);
1762         if (error) {
1763                 VFS_KERNEL_DEBUG_END1(57, vp);
1764                 return error;
1765         }
1766
1767         MAC_CHECK(vnode_check_rename, cred, dvp, dvp->v_label, vp,
1768             vp->v_label, cnp, tdvp, tdvp->v_label, tvp,
1769             tvp != NULL ? tvp->v_label : NULL, tcnp);
1770         VFS_KERNEL_DEBUG_END1(57, vp);
1771         return error;
1772 }
1773
1774 int
1775 mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp)
1776 {
1777         kauth_cred_t cred;
1778         int error;
1779
1780 #if SECURITY_MAC_CHECK_ENFORCE
1781         /* 21167099 - only check if we allow write */
1782         if (!mac_vnode_enforce) {
1783                 return 0;
1784         }
1785 #endif
1786         cred = vfs_context_ucred(ctx);
1787         if (!mac_cred_check_enforce(cred)) {
1788                 return 0;
1789         }
1790         VFS_KERNEL_DEBUG_START1(58, vp);
1791         MAC_CHECK(vnode_check_revoke, cred, vp, vp->v_label);
1792         VFS_KERNEL_DEBUG_END1(58, vp);
1793         return error;
1794 }
1795
1796 int
1797 mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist)
1798 {
1799         kauth_cred_t cred;
1800         int error;
1801
1802 #if SECURITY_MAC_CHECK_ENFORCE
1803         /* 21167099 - only check if we allow write */
1804         if (!mac_vnode_enforce) {
1805                 return 0;
1806         }
1807 #endif
1808         cred = vfs_context_ucred(ctx);
1809         if (!mac_cred_check_enforce(cred)) {
1810                 return 0;
1811         }
1812         VFS_KERNEL_DEBUG_START1(59, vp);
1813         MAC_CHECK(vnode_check_searchfs, cred, vp, vp->v_label, alist);
1814         VFS_KERNEL_DEBUG_END1(59, vp);
1815         return error;
1816 }
1817
1818 int
1819 mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, int which)
1820 {
1821         kauth_cred_t cred;
1822         int error;
1823
1824 #if SECURITY_MAC_CHECK_ENFORCE
1825         /* 21167099 - only check if we allow write */
1826         if (!mac_vnode_enforce) {
1827                 return 0;
1828         }
1829 #endif
1830         cred = vfs_context_ucred(ctx);
1831         if (!mac_cred_check_enforce(cred)) {
1832                 return 0;
1833         }
1834         VFS_KERNEL_DEBUG_START1(60, vp);
1835         MAC_CHECK(vnode_check_select, cred, vp, vp->v_label, which);
1836         VFS_KERNEL_DEBUG_END1(60, vp);
1837         return error;
1838 }
1839
1840 int
1841 mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp,
1842     struct kauth_acl *acl)
1843 {
1844         kauth_cred_t cred;
1845         int error;
1846
1847 #if SECURITY_MAC_CHECK_ENFORCE
1848         /* 21167099 - only check if we allow write */
1849         if (!mac_vnode_enforce) {
1850                 return 0;
1851         }
1852 #endif
1853         cred = vfs_context_ucred(ctx);
1854         if (!mac_cred_check_enforce(cred)) {
1855                 return 0;
1856         }
1857         VFS_KERNEL_DEBUG_START1(61, vp);
1858         MAC_CHECK(vnode_check_setacl, cred, vp, vp->v_label, acl);
1859         VFS_KERNEL_DEBUG_END1(61, vp);
1860         return error;
1861 }
1862
1863 int
1864 mac_vnode_check_setattrlist(vfs_context_t ctx, struct vnode *vp,
1865     struct attrlist *alist)
1866 {
1867         kauth_cred_t cred;
1868         int error;
1869
1870 #if SECURITY_MAC_CHECK_ENFORCE
1871         /* 21167099 - only check if we allow write */
1872         if (!mac_vnode_enforce) {
1873                 return 0;
1874         }
1875 #endif
1876         cred = vfs_context_ucred(ctx);
1877         if (!mac_cred_check_enforce(cred)) {
1878                 return 0;
1879         }
1880         VFS_KERNEL_DEBUG_START1(62, vp);
1881         MAC_CHECK(vnode_check_setattrlist, cred, vp, vp->v_label, alist);
1882         VFS_KERNEL_DEBUG_END1(62, vp);
1883         return error;
1884 }
1885
1886 int
1887 mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp,
1888     const char *name, struct uio *uio)
1889 {
1890         kauth_cred_t cred;
1891         int error;
1892
1893 #if SECURITY_MAC_CHECK_ENFORCE
1894         /* 21167099 - only check if we allow write */
1895         if (!mac_vnode_enforce) {
1896                 return 0;
1897         }
1898 #endif
1899         cred = vfs_context_ucred(ctx);
1900         if (!mac_cred_check_enforce(cred)) {
1901                 return 0;
1902         }
1903         VFS_KERNEL_DEBUG_START1(63, vp);
1904         MAC_CHECK(vnode_check_setextattr, cred, vp, vp->v_label,
1905             name, uio);
1906         VFS_KERNEL_DEBUG_END1(63, vp);
1907         return error;
1908 }
1909
1910 int
1911 mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags)
1912 {
1913         kauth_cred_t cred;
1914         int error;
1915
1916 #if SECURITY_MAC_CHECK_ENFORCE
1917         /* 21167099 - only check if we allow write */
1918         if (!mac_vnode_enforce) {
1919                 return 0;
1920         }
1921 #endif
1922         cred = vfs_context_ucred(ctx);
1923         if (!mac_cred_check_enforce(cred)) {
1924                 return 0;
1925         }
1926         VFS_KERNEL_DEBUG_START1(64, vp);
1927         MAC_CHECK(vnode_check_setflags, cred, vp, vp->v_label, flags);
1928         VFS_KERNEL_DEBUG_END1(64, vp);
1929         return error;
1930 }
1931
1932 int
1933 mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode)
1934 {
1935         kauth_cred_t cred;
1936         int error;
1937
1938 #if SECURITY_MAC_CHECK_ENFORCE
1939         /* 21167099 - only check if we allow write */
1940         if (!mac_vnode_enforce) {
1941                 return 0;
1942         }
1943 #endif
1944         cred = vfs_context_ucred(ctx);
1945         if (!mac_cred_check_enforce(cred)) {
1946                 return 0;
1947         }
1948         VFS_KERNEL_DEBUG_START1(65, vp);
1949         MAC_CHECK(vnode_check_setmode, cred, vp, vp->v_label, mode);
1950         VFS_KERNEL_DEBUG_END1(65, vp);
1951         return error;
1952 }
1953
1954 int
1955 mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid,
1956     gid_t gid)
1957 {
1958         kauth_cred_t cred;
1959         int error;
1960
1961 #if SECURITY_MAC_CHECK_ENFORCE
1962         /* 21167099 - only check if we allow write */
1963         if (!mac_vnode_enforce) {
1964                 return 0;
1965         }
1966 #endif
1967         cred = vfs_context_ucred(ctx);
1968         if (!mac_cred_check_enforce(cred)) {
1969                 return 0;
1970         }
1971         VFS_KERNEL_DEBUG_START1(66, vp);
1972         MAC_CHECK(vnode_check_setowner, cred, vp, vp->v_label, uid, gid);
1973         VFS_KERNEL_DEBUG_END1(66, vp);
1974         return error;
1975 }
1976
1977 int
1978 mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
1979     struct timespec atime, struct timespec mtime)
1980 {
1981         kauth_cred_t cred;
1982         int error;
1983
1984 #if SECURITY_MAC_CHECK_ENFORCE
1985         /* 21167099 - only check if we allow write */
1986         if (!mac_vnode_enforce) {
1987                 return 0;
1988         }
1989 #endif
1990         cred = vfs_context_ucred(ctx);
1991         if (!mac_cred_check_enforce(cred)) {
1992                 return 0;
1993         }
1994         VFS_KERNEL_DEBUG_START1(67, vp);
1995         MAC_CHECK(vnode_check_setutimes, cred, vp, vp->v_label, atime,
1996             mtime);
1997         VFS_KERNEL_DEBUG_END1(67, vp);
1998         return error;
1999 }
2000
2001 int
2002 mac_vnode_check_stat(vfs_context_t ctx, struct ucred *file_cred,
2003     struct vnode *vp)
2004 {
2005         kauth_cred_t cred;
2006         int error;
2007
2008 #if SECURITY_MAC_CHECK_ENFORCE
2009         /* 21167099 - only check if we allow write */
2010         if (!mac_vnode_enforce) {
2011                 return 0;
2012         }
2013 #endif
2014         cred = vfs_context_ucred(ctx);
2015         if (!mac_cred_check_enforce(cred)) {
2016                 return 0;
2017         }
2018         VFS_KERNEL_DEBUG_START1(68, vp);
2019         MAC_CHECK(vnode_check_stat, cred, file_cred, vp,
2020             vp->v_label);
2021         VFS_KERNEL_DEBUG_END1(68, vp);
2022         return error;
2023 }
2024
2025 int
2026 mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp,
2027     struct componentname *cnp)
2028 {
2029         kauth_cred_t cred;
2030         int error;
2031
2032 #if SECURITY_MAC_CHECK_ENFORCE
2033         /* 21167099 - only check if we allow write */
2034         if (!mac_vnode_enforce) {
2035                 return 0;
2036         }
2037 #endif
2038         cred = vfs_context_ucred(ctx);
2039         if (!mac_cred_check_enforce(cred)) {
2040                 return 0;
2041         }
2042         VFS_KERNEL_DEBUG_START1(69, dvp);
2043         MAC_CHECK(vnode_check_trigger_resolve, cred, dvp, dvp->v_label, cnp);
2044         VFS_KERNEL_DEBUG_END1(69, dvp);
2045         return error;
2046 }
2047
2048 int
2049 mac_vnode_check_truncate(vfs_context_t ctx, struct ucred *file_cred,
2050     struct vnode *vp)
2051 {
2052         kauth_cred_t cred;
2053         int error;
2054
2055 #if SECURITY_MAC_CHECK_ENFORCE
2056         /* 21167099 - only check if we allow write */
2057         if (!mac_vnode_enforce) {
2058                 return 0;
2059         }
2060 #endif
2061         cred = vfs_context_ucred(ctx);
2062         if (!mac_cred_check_enforce(cred)) {
2063                 return 0;
2064         }
2065         VFS_KERNEL_DEBUG_START1(70, vp);
2066         MAC_CHECK(vnode_check_truncate, cred, file_cred, vp,
2067             vp->v_label);
2068         VFS_KERNEL_DEBUG_END1(70, vp);
2069
2070         return error;
2071 }
2072
2073 int
2074 mac_vnode_check_write(vfs_context_t ctx, struct ucred *file_cred,
2075     struct vnode *vp)
2076 {
2077         kauth_cred_t cred;
2078         int error;
2079
2080 #if SECURITY_MAC_CHECK_ENFORCE
2081         /* 21167099 - only check if we allow write */
2082         if (!mac_vnode_enforce) {
2083                 return 0;
2084         }
2085 #endif
2086         cred = vfs_context_ucred(ctx);
2087         if (!mac_cred_check_enforce(cred)) {
2088                 return 0;
2089         }
2090         VFS_KERNEL_DEBUG_START1(71, vp);
2091         MAC_CHECK(vnode_check_write, cred, file_cred, vp, vp->v_label);
2092         VFS_KERNEL_DEBUG_END1(71, vp);
2093
2094         return error;
2095 }
2096
2097 int
2098 mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
2099     struct componentname *cnp, struct vnode_attr *vap)
2100 {
2101         kauth_cred_t cred;
2102         int error;
2103
2104 #if SECURITY_MAC_CHECK_ENFORCE
2105         /* 21167099 - only check if we allow write */
2106         if (!mac_vnode_enforce) {
2107                 return 0;
2108         }
2109 #endif
2110         cred = vfs_context_ucred(ctx);
2111         if (!mac_cred_check_enforce(cred)) {
2112                 return 0;
2113         }
2114         VFS_KERNEL_DEBUG_START1(72, dvp);
2115         MAC_CHECK(vnode_check_uipc_bind, cred, dvp, dvp->v_label, cnp, vap);
2116         VFS_KERNEL_DEBUG_END1(72, dvp);
2117         return error;
2118 }
2119
2120 int
2121 mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so)
2122 {
2123         kauth_cred_t cred;
2124         int error;
2125
2126 #if SECURITY_MAC_CHECK_ENFORCE
2127         /* 21167099 - only check if we allow write */
2128         if (!mac_vnode_enforce) {
2129                 return 0;
2130         }
2131 #endif
2132         cred = vfs_context_ucred(ctx);
2133         if (!mac_cred_check_enforce(cred)) {
2134                 return 0;
2135         }
2136         VFS_KERNEL_DEBUG_START1(73, vp);
2137         MAC_CHECK(vnode_check_uipc_connect, cred, vp, vp->v_label, (socket_t) so);
2138         VFS_KERNEL_DEBUG_END1(73, vp);
2139         return error;
2140 }
2141
2142 void
2143 mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, struct label *newlabel)
2144 {
2145         kauth_cred_t cred = vfs_context_ucred(ctx);
2146         struct label *tmpl = NULL;
2147
2148         if (vp->v_label == NULL) {
2149                 tmpl = mac_vnode_label_alloc();
2150         }
2151
2152         vnode_lock(vp);
2153
2154         /* recheck after lock */
2155         if (vp->v_label == NULL) {
2156                 vp->v_label = tmpl;
2157                 tmpl = NULL;
2158         }
2159
2160         VFS_KERNEL_DEBUG_START1(74, vp);
2161         MAC_PERFORM(vnode_label_update, cred, vp, vp->v_label, newlabel);
2162         VFS_KERNEL_DEBUG_END1(74, vp);
2163         vnode_unlock(vp);
2164
2165         if (tmpl != NULL) {
2166                 mac_vnode_label_free(tmpl);
2167         }
2168 }
2169
2170 int
2171 mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offset)
2172 {
2173         int error;
2174
2175 #if SECURITY_MAC_CHECK_ENFORCE
2176         /* 21167099 - only check if we allow write */
2177         if (!mac_proc_enforce || !mac_vnode_enforce) {
2178                 return 0;
2179         }
2180 #endif
2181
2182         VFS_KERNEL_DEBUG_START1(75, vp);
2183         MAC_CHECK(vnode_find_sigs, p, vp, offset, vp->v_label);
2184         VFS_KERNEL_DEBUG_END1(75, vp);
2185
2186         return error;
2187 }
2188
2189 void
2190 mac_mount_label_associate(vfs_context_t ctx, struct mount *mp)
2191 {
2192         kauth_cred_t cred = vfs_context_ucred(ctx);
2193
2194         /* XXX: eventually this logic may be handled by the policy? */
2195
2196         /* We desire MULTILABEL for the root filesystem. */
2197         if ((mp->mnt_flag & MNT_ROOTFS) &&
2198             (strcmp(mp->mnt_vfsstat.f_fstypename, "hfs") == 0)) {
2199                 mp->mnt_flag |= MNT_MULTILABEL;
2200         }
2201
2202         /* MULTILABEL on DEVFS. */
2203         if (strcmp(mp->mnt_vfsstat.f_fstypename, "devfs") == 0) {
2204                 mp->mnt_flag |= MNT_MULTILABEL;
2205         }
2206
2207         /* MULTILABEL on FDESC pseudo-filesystem. */
2208         if (strcmp(mp->mnt_vfsstat.f_fstypename, "fdesc") == 0) {
2209                 mp->mnt_flag |= MNT_MULTILABEL;
2210         }
2211
2212         /* MULTILABEL on all NFS filesystems. */
2213         if (strcmp(mp->mnt_vfsstat.f_fstypename, "nfs") == 0) {
2214                 mp->mnt_flag |= MNT_MULTILABEL;
2215         }
2216
2217         /* MULTILABEL on all AFP filesystems. */
2218         if (strcmp(mp->mnt_vfsstat.f_fstypename, "afpfs") == 0) {
2219                 mp->mnt_flag |= MNT_MULTILABEL;
2220         }
2221
2222         if (mp->mnt_vtable != NULL) {
2223                 /* Any filesystem that supports native XATTRs. */
2224                 if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNATIVEXATTR)) {
2225                         mp->mnt_flag |= MNT_MULTILABEL;
2226                 }
2227
2228                 /* Filesystem does not support multilabel. */
2229                 if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNOMACLABEL) &&
2230                     (mp->mnt_flag & MNT_MULTILABEL)) {
2231                         mp->mnt_flag &= ~MNT_MULTILABEL;
2232                 }
2233         }
2234
2235         VFS_KERNEL_DEBUG_START1(76, mp);
2236         MAC_PERFORM(mount_label_associate, cred, mp, mp->mnt_mntlabel);
2237         VFS_KERNEL_DEBUG_END1(76, mp);
2238 #if DEBUG
2239         printf("MAC Framework enabling %s support: %s -> %s (%s)\n",
2240             mp->mnt_flag & MNT_MULTILABEL ? "multilabel" : "singlelabel",
2241             mp->mnt_vfsstat.f_mntfromname,
2242             mp->mnt_vfsstat.f_mntonname,
2243             mp->mnt_vfsstat.f_fstypename);
2244 #endif
2245 }
2246
2247 int
2248 mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp,
2249     struct componentname *cnp, const char *vfc_name)
2250 {
2251         kauth_cred_t cred;
2252         int error;
2253
2254 #if SECURITY_MAC_CHECK_ENFORCE
2255         /* 21167099 - only check if we allow write */
2256         if (!mac_vnode_enforce) {
2257                 return 0;
2258         }
2259 #endif
2260         cred = vfs_context_ucred(ctx);
2261         if (!mac_cred_check_enforce(cred)) {
2262                 return 0;
2263         }
2264         VFS_KERNEL_DEBUG_START1(77, vp);
2265         MAC_CHECK(mount_check_mount, cred, vp, vp->v_label, cnp, vfc_name);
2266         VFS_KERNEL_DEBUG_END1(77, vp);
2267
2268         return error;
2269 }
2270
2271 int
2272 mac_mount_check_mount_late(vfs_context_t ctx, struct mount *mp)
2273 {
2274         kauth_cred_t cred;
2275         int error;
2276
2277 #if SECURITY_MAC_CHECK_ENFORCE
2278         /* 21167099 - only check if we allow write */
2279         if (!mac_vnode_enforce) {
2280                 return 0;
2281         }
2282 #endif
2283         cred = vfs_context_ucred(ctx);
2284         if (!mac_cred_check_enforce(cred)) {
2285                 return 0;
2286         }
2287         VFS_KERNEL_DEBUG_START1(78, mp);
2288         MAC_CHECK(mount_check_mount_late, cred, mp);
2289         VFS_KERNEL_DEBUG_END1(78, mp);
2290
2291         return error;
2292 }
2293
2294 int
2295 mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp,
2296     const char *name)
2297 {
2298         kauth_cred_t cred;
2299         int error;
2300
2301 #if SECURITY_MAC_CHECK_ENFORCE
2302         /* 21167099 - only check if we allow write */
2303         if (!mac_vnode_enforce) {
2304                 return 0;
2305         }
2306 #endif
2307         cred = vfs_context_ucred(ctx);
2308         if (!mac_cred_check_enforce(cred)) {
2309                 return 0;
2310         }
2311         VFS_KERNEL_DEBUG_START1(79, mp);
2312         MAC_CHECK(mount_check_snapshot_create, cred, mp, name);
2313         VFS_KERNEL_DEBUG_END1(79, mp);
2314         return error;
2315 }
2316
2317 int
2318 mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp,
2319     const char *name)
2320 {
2321         kauth_cred_t cred;
2322         int error;
2323
2324 #if SECURITY_MAC_CHECK_ENFORCE
2325         /* 21167099 - only check if we allow write */
2326         if (!mac_vnode_enforce) {
2327                 return 0;
2328         }
2329 #endif
2330         cred = vfs_context_ucred(ctx);
2331         if (!mac_cred_check_enforce(cred)) {
2332                 return 0;
2333         }
2334         VFS_KERNEL_DEBUG_START1(80, mp);
2335         MAC_CHECK(mount_check_snapshot_delete, cred, mp, name);
2336         VFS_KERNEL_DEBUG_END1(80, mp);
2337         return error;
2338 }
2339
2340 int
2341 mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp,
2342     const char *name)
2343 {
2344         kauth_cred_t cred;
2345         int error;
2346
2347 #if SECURITY_MAC_CHECK_ENFORCE
2348         /* 21167099 - only check if we allow write */
2349         if (!mac_vnode_enforce) {
2350                 return 0;
2351         }
2352 #endif
2353         cred = vfs_context_ucred(ctx);
2354         if (!mac_cred_check_enforce(cred)) {
2355                 return 0;
2356         }
2357         VFS_KERNEL_DEBUG_START1(81, mp);
2358         MAC_CHECK(mount_check_snapshot_revert, cred, mp, name);
2359         VFS_KERNEL_DEBUG_END1(81, mp);
2360         return error;
2361 }
2362
2363 int
2364 mac_mount_check_remount(vfs_context_t ctx, struct mount *mp)
2365 {
2366         kauth_cred_t cred;
2367         int error;
2368
2369 #if SECURITY_MAC_CHECK_ENFORCE
2370         /* 21167099 - only check if we allow write */
2371         if (!mac_vnode_enforce) {
2372                 return 0;
2373         }
2374 #endif
2375         cred = vfs_context_ucred(ctx);
2376         if (!mac_cred_check_enforce(cred)) {
2377                 return 0;
2378         }
2379         VFS_KERNEL_DEBUG_START1(82, mp);
2380         MAC_CHECK(mount_check_remount, cred, mp, mp->mnt_mntlabel);
2381         VFS_KERNEL_DEBUG_END1(82, mp);
2382
2383         return error;
2384 }
2385
2386 int
2387 mac_mount_check_umount(vfs_context_t ctx, struct mount *mp)
2388 {
2389         kauth_cred_t cred;
2390         int error;
2391
2392 #if SECURITY_MAC_CHECK_ENFORCE
2393         /* 21167099 - only check if we allow write */
2394         if (!mac_vnode_enforce) {
2395                 return 0;
2396         }
2397 #endif
2398         cred = vfs_context_ucred(ctx);
2399         if (!mac_cred_check_enforce(cred)) {
2400                 return 0;
2401         }
2402         VFS_KERNEL_DEBUG_START1(83, mp);
2403         MAC_CHECK(mount_check_umount, cred, mp, mp->mnt_mntlabel);
2404         VFS_KERNEL_DEBUG_END1(83, mp);
2405
2406         return error;
2407 }
2408
2409 int
2410 mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp,
2411     struct vfs_attr *vfa)
2412 {
2413         kauth_cred_t cred;
2414         int error;
2415
2416 #if SECURITY_MAC_CHECK_ENFORCE
2417         /* 21167099 - only check if we allow write */
2418         if (!mac_vnode_enforce) {
2419                 return 0;
2420         }
2421 #endif
2422         cred = vfs_context_ucred(ctx);
2423         if (!mac_cred_check_enforce(cred)) {
2424                 return 0;
2425         }
2426         VFS_KERNEL_DEBUG_START1(84, mp);
2427         MAC_CHECK(mount_check_getattr, cred, mp, mp->mnt_mntlabel, vfa);
2428         VFS_KERNEL_DEBUG_END1(84, mp);
2429         return error;
2430 }
2431
2432 int
2433 mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp,
2434     struct vfs_attr *vfa)
2435 {
2436         kauth_cred_t cred;
2437         int error;
2438
2439 #if SECURITY_MAC_CHECK_ENFORCE
2440         /* 21167099 - only check if we allow write */
2441         if (!mac_vnode_enforce) {
2442                 return 0;
2443         }
2444 #endif
2445         cred = vfs_context_ucred(ctx);
2446         if (!mac_cred_check_enforce(cred)) {
2447                 return 0;
2448         }
2449         VFS_KERNEL_DEBUG_START1(85, mp);
2450         MAC_CHECK(mount_check_setattr, cred, mp, mp->mnt_mntlabel, vfa);
2451         VFS_KERNEL_DEBUG_END1(85, mp);
2452         return error;
2453 }
2454
2455 int
2456 mac_mount_check_stat(vfs_context_t ctx, struct mount *mount)
2457 {
2458         kauth_cred_t cred;
2459         int error;
2460
2461 #if SECURITY_MAC_CHECK_ENFORCE
2462         /* 21167099 - only check if we allow write */
2463         if (!mac_vnode_enforce) {
2464                 return 0;
2465         }
2466 #endif
2467         cred = vfs_context_ucred(ctx);
2468         if (!mac_cred_check_enforce(cred)) {
2469                 return 0;
2470         }
2471         VFS_KERNEL_DEBUG_START1(86, mount);
2472         MAC_CHECK(mount_check_stat, cred, mount, mount->mnt_mntlabel);
2473         VFS_KERNEL_DEBUG_END1(86, mount);
2474
2475         return error;
2476 }
2477
2478 int
2479 mac_mount_check_label_update(vfs_context_t ctx, struct mount *mount)
2480 {
2481         kauth_cred_t cred;
2482         int error;
2483
2484 #if SECURITY_MAC_CHECK_ENFORCE
2485         /* 21167099 - only check if we allow write */
2486         if (!mac_vnode_enforce) {
2487                 return 0;
2488         }
2489 #endif
2490         cred = vfs_context_ucred(ctx);
2491         if (!mac_cred_check_enforce(cred)) {
2492                 return 0;
2493         }
2494         VFS_KERNEL_DEBUG_START1(87, mount);
2495         MAC_CHECK(mount_check_label_update, cred, mount, mount->mnt_mntlabel);
2496         VFS_KERNEL_DEBUG_END1(87, mount);
2497
2498         return error;
2499 }
2500
2501 int
2502 mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, u_int cmd)
2503 {
2504         kauth_cred_t cred;
2505         int error;
2506
2507 #if SECURITY_MAC_CHECK_ENFORCE
2508         /* 21167099 - only check if we allow write */
2509         if (!mac_vnode_enforce) {
2510                 return 0;
2511         }
2512 #endif
2513         cred = vfs_context_ucred(ctx);
2514         if (!mac_cred_check_enforce(cred)) {
2515                 return 0;
2516         }
2517         VFS_KERNEL_DEBUG_START1(88, mp);
2518         MAC_CHECK(mount_check_fsctl, cred, mp, mp->mnt_mntlabel, cmd);
2519         VFS_KERNEL_DEBUG_END1(88, mp);
2520
2521         return error;
2522 }
2523
2524 void
2525 mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
2526     const char *fullpath)
2527 {
2528 #if SECURITY_MAC_CHECK_ENFORCE
2529         /* 21167099 - only check if we allow write */
2530         if (!mac_device_enforce) {
2531                 return;
2532         }
2533 #endif
2534
2535         VFS_KERNEL_DEBUG_START1(89, de);
2536         MAC_PERFORM(devfs_label_associate_device, dev, de, de->dn_label,
2537             fullpath);
2538         VFS_KERNEL_DEBUG_END1(89, de);
2539 }
2540
2541 void
2542 mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
2543     struct devnode *de, const char *fullpath)
2544 {
2545 #if SECURITY_MAC_CHECK_ENFORCE
2546         /* 21167099 - only check if we allow write */
2547         if (!mac_device_enforce) {
2548                 return;
2549         }
2550 #endif
2551
2552         VFS_KERNEL_DEBUG_START1(90, de);
2553         MAC_PERFORM(devfs_label_associate_directory, dirname, dirnamelen, de,
2554             de->dn_label, fullpath);
2555         VFS_KERNEL_DEBUG_END1(90, de);
2556 }
2557
2558 int
2559 vn_setlabel(struct vnode *vp, struct label *intlabel, vfs_context_t context)
2560 {
2561         int error;
2562
2563 #if SECURITY_MAC_CHECK_ENFORCE
2564         /* 21167099 - only check if we allow write */
2565         if (!mac_vnode_enforce) {
2566                 return 0;
2567         }
2568 #endif
2569         if (!mac_label_vnodes) {
2570                 return 0;
2571         }
2572
2573         if (vp->v_mount == NULL) {
2574                 printf("vn_setlabel: null v_mount\n");
2575                 if (vp->v_type != VNON) {
2576                         printf("vn_setlabel: null v_mount with non-VNON\n");
2577                 }
2578                 return EBADF;
2579         }
2580
2581         if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
2582                 return ENOTSUP;
2583         }
2584
2585         /*
2586          * Multi-phase commit.  First check the policies to confirm the
2587          * change is OK.  Then commit via the filesystem.  Finally,
2588          * update the actual vnode label.  Question: maybe the filesystem
2589          * should update the vnode at the end as part of VNOP_SETLABEL()?
2590          */
2591         error = mac_vnode_check_label_update(context, vp, intlabel);
2592         if (error) {
2593                 return error;
2594         }
2595
2596         error = VNOP_SETLABEL(vp, intlabel, context);
2597         if (error == ENOTSUP) {
2598                 error = mac_vnode_label_store(context, vp,
2599                     intlabel);
2600                 if (error) {
2601                         printf("%s: mac_vnode_label_store failed %d\n",
2602                             __func__, error);
2603                         return error;
2604                 }
2605                 mac_vnode_label_update(context, vp, intlabel);
2606         } else if (error) {
2607                 printf("vn_setlabel: vop setlabel failed %d\n", error);
2608                 return error;
2609         }
2610
2611         return 0;
2612 }
2613
2614 int
2615 mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp,
2616     struct vnode *vp, vfs_context_t ctx)
2617 {
2618         struct fileproc *fp;
2619 #if CONFIG_MACF_SOCKET_SUBSET
2620         struct socket *so;
2621 #endif
2622         struct pipe *cpipe;
2623         struct vnode *fvp;
2624         struct proc *p;
2625         int error;
2626
2627         error = 0;
2628
2629         VFS_KERNEL_DEBUG_START1(91, vp);
2630         /*
2631          * If no backing file, let the policy choose which label to use.
2632          */
2633         if (fnp->fd_fd == -1) {
2634                 MAC_PERFORM(vnode_label_associate_file, vfs_context_ucred(ctx),
2635                     mp, mp->mnt_mntlabel, NULL, NULL, vp, vp->v_label);
2636                 VFS_KERNEL_DEBUG_END1(91, vp);
2637                 return 0;
2638         }
2639
2640         p = vfs_context_proc(ctx);
2641         error = fp_lookup(p, fnp->fd_fd, &fp, 0);
2642         if (error) {
2643                 VFS_KERNEL_DEBUG_END1(91, vp);
2644                 return error;
2645         }
2646
2647         if (fp->f_fglob == NULL) {
2648                 error = EBADF;
2649                 goto out;
2650         }
2651
2652         switch (FILEGLOB_DTYPE(fp->f_fglob)) {
2653         case DTYPE_VNODE:
2654                 fvp = (struct vnode *)fp->f_fglob->fg_data;
2655                 if ((error = vnode_getwithref(fvp))) {
2656                         goto out;
2657                 }
2658                 if (fvp->v_label != NULL) {
2659                         if (mac_label_vnodes != 0 && vp->v_label == NULL) {
2660                                 mac_vnode_label_init(vp); /* init dst label */
2661                         }
2662                         MAC_PERFORM(vnode_label_copy, fvp->v_label, vp->v_label);
2663                 }
2664                 (void)vnode_put(fvp);
2665                 break;
2666 #if CONFIG_MACF_SOCKET_SUBSET
2667         case DTYPE_SOCKET:
2668                 so = (struct socket *)fp->f_fglob->fg_data;
2669                 socket_lock(so, 1);
2670                 MAC_PERFORM(vnode_label_associate_socket,
2671                     vfs_context_ucred(ctx), (socket_t)so, so->so_label,
2672                     vp, vp->v_label);
2673                 socket_unlock(so, 1);
2674                 break;
2675 #endif
2676         case DTYPE_PSXSHM:
2677                 pshm_label_associate(fp, vp, ctx);
2678                 break;
2679         case DTYPE_PSXSEM:
2680                 psem_label_associate(fp, vp, ctx);
2681                 break;
2682         case DTYPE_PIPE:
2683                 cpipe = (struct pipe *)fp->f_fglob->fg_data;
2684                 /* kern/sys_pipe.c:pipe_select() suggests this test. */
2685                 if (cpipe == (struct pipe *)-1) {
2686                         error = EINVAL;
2687                         goto out;
2688                 }
2689                 PIPE_LOCK(cpipe);
2690                 MAC_PERFORM(vnode_label_associate_pipe, vfs_context_ucred(ctx),
2691                     cpipe, cpipe->pipe_label, vp, vp->v_label);
2692                 PIPE_UNLOCK(cpipe);
2693                 break;
2694         case DTYPE_KQUEUE:
2695         case DTYPE_FSEVENTS:
2696         case DTYPE_ATALK:
2697         case DTYPE_NETPOLICY:
2698         default:
2699                 MAC_PERFORM(vnode_label_associate_file, vfs_context_ucred(ctx),
2700                     mp, mp->mnt_mntlabel, fp->f_fglob, fp->f_fglob->fg_label,
2701                     vp, vp->v_label);
2702                 break;
2703         }
2704 out:
2705         VFS_KERNEL_DEBUG_END1(91, vp);
2706         fp_drop(p, fnp->fd_fd, fp, 0);
2707         return error;
2708 }
2709
2710 intptr_t
2711 mac_vnode_label_get(struct vnode *vp, int slot, intptr_t sentinel)
2712 {
2713         struct label *l;
2714
2715         KASSERT(vp != NULL, ("mac_vnode_label_get: NULL vnode"));
2716         l = vp->v_label;
2717         if (l != NULL) {
2718                 return mac_label_get(l, slot);
2719         } else {
2720                 return sentinel;
2721         }
2722 }
2723
2724 void
2725 mac_vnode_label_set(struct vnode *vp, int slot, intptr_t v)
2726 {
2727         struct label *l;
2728         KASSERT(vp != NULL, ("mac_vnode_label_set: NULL vnode"));
2729         l = vp->v_label;
2730         if (l == NULL) {
2731                 mac_vnode_label_init(vp);
2732                 l = vp->v_label;
2733         }
2734         mac_label_set(l, slot, v);
2735 }