xnu-2050.7.9.tar.gz

[apple/xnu.git] / security / mac_base.c

diff --git a/security/mac_base.c b/security/mac_base.c
index b659481314d7eec4bee46c912af821c88152fb0f..ae808e27796654e5ec484e6b767785569f1ce6de 100644 (file)
--- a/security/mac_base.c
+++ b/security/mac_base.c
@@ -79,7 +79,7 @@
 #include <sys/vfs_context.h>
 #include <sys/namei.h>
 #include <bsd/bsm/audit.h>
 #include <sys/vfs_context.h>
 #include <sys/namei.h>
 #include <bsd/bsm/audit.h>

-#include <bsd/bsm/audit_kernel.h>
+#include <bsd/security/audit/audit.h>

 #include <sys/file.h>
 #include <sys/file_internal.h>
 #include <sys/filedesc.h>
 #include <sys/file.h>
 #include <sys/file_internal.h>
 #include <sys/filedesc.h>


@@ -88,6 +88,7 @@
 #include <sys/kauth.h>
 #include <sys/sysproto.h>
 
 #include <sys/kauth.h>
 #include <sys/sysproto.h>
 

+#include <mach/exception_types.h>

 #include <mach/vm_types.h>
 #include <mach/vm_prot.h>
 
 #include <mach/vm_types.h>
 #include <mach/vm_prot.h>
 


@@ -95,7 +96,6 @@
 #include <kern/sched_prim.h>
 #include <osfmk/kern/task.h>
 #include <osfmk/kern/kalloc.h>
 #include <kern/sched_prim.h>
 #include <osfmk/kern/task.h>
 #include <osfmk/kern/kalloc.h>

-#include <libsa/libsa/kext.h>

 
 #if CONFIG_MACF
 #include <security/mac.h>
 
 #if CONFIG_MACF
 #include <security/mac.h>


@@ -105,6 +105,7 @@
 #include <security/mac_mach_internal.h>
 #endif
 
 #include <security/mac_mach_internal.h>
 #endif
 

+

 /* 
  * define MB_DEBUG to display run-time debugging information
  * #define MB_DEBUG 1
 /* 
  * define MB_DEBUG to display run-time debugging information
  * #define MB_DEBUG 1


@@ -123,7 +124,11 @@ SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
     "TrustedBSD MAC policy controls");
 
 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
     "TrustedBSD MAC policy controls");
 

-
+#if DEBUG
+#define SECURITY_MAC_CTLFLAGS CTLFLAG_RW | CTLFLAG_LOCKED
+#else
+#define SECURITY_MAC_CTLFLAGS CTLFLAG_RD | CTLFLAG_LOCKED
+#endif

 
 /*
  * Declare that the kernel provides MAC support, version 1.  This permits
 
 /*
  * Declare that the kernel provides MAC support, version 1.  This permits


@@ -140,7 +145,7 @@ MODULE_VERSION(kernel_mac_support, 1);
 
 static unsigned int mac_max_slots = MAC_MAX_SLOTS;
 static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
 
 static unsigned int mac_max_slots = MAC_MAX_SLOTS;
 static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD,
+SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,

     &mac_max_slots, 0, "");
 
 /*
     &mac_max_slots, 0, "");
 
 /*


@@ -161,94 +166,88 @@ int       mac_late = 0;
  * already has to deal with uninitialized labels, this probably won't
  * be a problem.  Note: currently no locking.  Will this be a problem?
  */
  * already has to deal with uninitialized labels, this probably won't
  * be a problem.  Note: currently no locking.  Will this be a problem?
  */

-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0
-static int     mac_labelmbufs = 0;
+#if CONFIG_MACF_NET
+unsigned int mac_label_mbufs   = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, SECURITY_MAC_CTLFLAGS,
+       &mac_label_mbufs, 0, "Label all MBUFs");

 #endif
 
 #endif
 

+
+/*
+ * Flag to indicate whether or not we should allocate label storage for
+ * new vnodes.  Since most dynamic policies we currently work with don't
+ * rely on vnode labeling, try to avoid paying the cost of mtag allocation
+ * unless specifically notified of interest.  One result of this is
+ * that if a dynamically loaded policy requests vnode labels, it must
+ * be able to deal with a NULL label being returned on any vnodes that
+ * were already in flight when the policy was loaded.  Since the policy
+ * already has to deal with uninitialized labels, this probably won't
+ * be a problem.
+ */
+unsigned int   mac_label_vnodes = 0;
+SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS,
+    &mac_label_vnodes, 0, "Label all vnodes");
+
+

 unsigned int   mac_mmap_revocation = 0;
 unsigned int   mac_mmap_revocation = 0;

-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, SECURITY_MAC_CTLFLAGS,

     &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
     "relabel");
 
 unsigned int   mac_mmap_revocation_via_cow = 0;
     &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
     "relabel");
 
 unsigned int   mac_mmap_revocation_via_cow = 0;

-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, SECURITY_MAC_CTLFLAGS,

     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
     "copy-on-write semantics, or by removing all write access");
 
 unsigned int mac_device_enforce = 1;
     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
     "copy-on-write semantics, or by removing all write access");
 
 unsigned int mac_device_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,

           &mac_device_enforce, 0, "Enforce MAC policy on device operations");
 
           &mac_device_enforce, 0, "Enforce MAC policy on device operations");
 

-unsigned int mac_file_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, file_enforce, CTLFLAG_RW,
-       &mac_file_enforce, 0, "Enforce MAC policy on file operations");
-
-unsigned int mac_iokit_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, iokit_enforce, CTLFLAG_RW,
-       &mac_file_enforce, 0, "Enforce MAC policy on IOKit operations");
-

 unsigned int   mac_pipe_enforce = 1;
 unsigned int   mac_pipe_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
 
 unsigned int   mac_posixsem_enforce = 1;
     &mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
 
 unsigned int   mac_posixsem_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
 
 unsigned int mac_posixshm_enforce = 1;
     &mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
 
 unsigned int mac_posixshm_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
 
 unsigned int   mac_proc_enforce = 1;
     &mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
 
 unsigned int   mac_proc_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, SECURITY_MAC_CTLFLAGS,

           &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
 
 unsigned int mac_socket_enforce = 1;
           &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
 
 unsigned int mac_socket_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, SECURITY_MAC_CTLFLAGS,

        &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
 
 unsigned int   mac_system_enforce = 1;
        &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
 
 unsigned int   mac_system_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
 
 unsigned int   mac_sysvmsg_enforce = 1;
     &mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
 
 unsigned int   mac_sysvmsg_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
 
 unsigned int   mac_sysvsem_enforce = 1;
     &mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
 
 unsigned int   mac_sysvsem_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
 
 unsigned int   mac_sysvshm_enforce = 1;
     &mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
 
 unsigned int   mac_sysvshm_enforce = 1;

-SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, CTLFLAG_RW,
+SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
 
 unsigned int   mac_vm_enforce = 1;
     &mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
 
 unsigned int   mac_vm_enforce = 1;

-SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, CTLFLAG_RW,
+SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, SECURITY_MAC_CTLFLAGS,

           &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
 
 unsigned int   mac_vnode_enforce = 1;
           &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
 
 unsigned int   mac_vnode_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, SECURITY_MAC_CTLFLAGS,

           &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
 
           &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
 

-
-#if CONFIG_MACF_MACH
-unsigned int   mac_port_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, port_enforce, CTLFLAG_RW,
-    &mac_port_enforce, 0, "Enforce MAC policy on Mach port operations");
-
-unsigned int   mac_task_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, task_enforce, CTLFLAG_RW,
-    &mac_task_enforce, 0, "Enforce MAC policy on Mach task operations");
-#endif
-
-#if CONFIG_MACF_NET
-unsigned int mac_label_mbufs   = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, CTLFLAG_RW,
-       &mac_label_mbufs, 0, "Label all MBUFs");
-#endif
-
-#if AUDIT
+#if CONFIG_AUDIT

 /*
  * mac_audit_data_zone is the zone used for data pushed into the audit
  * record by policies. Using a zone simplifies memory management of this
 /*
  * mac_audit_data_zone is the zone used for data pushed into the audit
  * record by policies. Using a zone simplifies memory management of this


@@ -512,6 +511,13 @@ mac_policy_init(void)
        mac_labelzone_init();
 }
 
        mac_labelzone_init();
 }
 

+/* Function pointer set up for loading security extensions.
+ * It is set to an actual function after OSlibkernInit()
+ * has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
+ * after bsd_init().
+ */
+void (*load_security_extensions_function)(void) = 0;
+

 /*
  * Init after early Mach startup, but before BSD
  */
 /*
  * Init after early Mach startup, but before BSD
  */


@@ -526,7 +532,9 @@ mac_policy_initmach(void)
         * kernel startup.
         */
 
         * kernel startup.
         */
 

-       load_security_extensions();
+       if (load_security_extensions_function) {
+               load_security_extensions_function();
+       }

        mac_late = 1;
 #if CONFIG_MACF_MACH
        mac_label_journal_replay();
        mac_late = 1;
 #if CONFIG_MACF_MACH
        mac_label_journal_replay();


@@ -542,7 +550,7 @@ mac_policy_initbsd(void)
        struct mac_policy_conf *mpc;
        u_int i;
 
        struct mac_policy_conf *mpc;
        u_int i;
 

-#if AUDIT
+#if CONFIG_AUDIT

        mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
                                    AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
                                    8192, "mac_audit_data_zone");
        mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
                                    AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
                                    8192, "mac_audit_data_zone");


@@ -719,26 +727,6 @@ mac_policy_removefrom_labellist(mac_policy_handle_t handle)
 static void
 mac_policy_updateflags(void)
 {
 static void
 mac_policy_updateflags(void)
 {

-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0 /* port to new list style */
-
-       struct mac_policy_conf *tmpc;
-       int labelmbufs;
-
-       mac_policy_assert_exclusive();
-
-       labelmbufs = 0;
-
-       /* XXX - convert to new list structure */
-       LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) {
-               if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
-                       labelmbufs++;
-       }
-       LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
-               if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
-                       labelmbufs++;
-       }
-       mac_labelmbufs = (labelmbufs != 0);
-#endif

 }
 
 static __inline void
 }
 
 static __inline void


@@ -1181,17 +1169,43 @@ done:
 /*
  * Get the external forms of labels from all policies, for all label
  * namespaces contained in a list.
 /*
  * Get the external forms of labels from all policies, for all label
  * namespaces contained in a list.

+ *
+ * XXX This may be leaking an sbuf.

  */
 int
 mac_externalize(size_t mpo_externalize_off, struct label *label,
     const char *elementlist, char *outbuf, size_t outbuflen)
 {
        char *element;
  */
 int
 mac_externalize(size_t mpo_externalize_off, struct label *label,
     const char *elementlist, char *outbuf, size_t outbuflen)
 {
        char *element;

+       char *scratch_base;
+       char *scratch;

        struct sbuf sb;
        int error = 0, len;
 
        struct sbuf sb;
        int error = 0, len;
 

-       sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);
-       while ((element = strsep(&elementlist, ",")) != NULL) {
+       /* allocate a scratch buffer the size of the string */
+       MALLOC(scratch_base, char *, strlen(elementlist)+1, M_MACTEMP, M_WAITOK); 
+       if (scratch_base == NULL) {
+               error = ENOMEM;
+               goto out;
+       }
+
+       /* copy the elementlist to the scratch buffer */
+       strlcpy(scratch_base, elementlist, strlen(elementlist)+1);
+
+       /*
+        * set up a temporary pointer that can be used to iterate the
+        * scratch buffer without losing the allocation address
+        */
+       scratch = scratch_base;
+
+       /* get an sbuf */
+       if (sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN) == NULL) {
+               /* could not allocate interior buffer */
+               error = ENOMEM;
+               goto out;
+       }
+       /* iterate the scratch buffer; NOTE: buffer contents modified! */
+       while ((element = strsep(&scratch, ",")) != NULL) {

                error = mac_label_externalize(mpo_externalize_off, label,
                    element, &sb);
                if (error)
                error = mac_label_externalize(mpo_externalize_off, label,
                    element, &sb);
                if (error)


@@ -1200,6 +1214,11 @@ mac_externalize(size_t mpo_externalize_off, struct label *label,
        if ((len = sbuf_len(&sb)) > 0)
                sbuf_setpos(&sb, len - 1);      /* trim trailing comma */
        sbuf_finish(&sb);
        if ((len = sbuf_len(&sb)) > 0)
                sbuf_setpos(&sb, len - 1);      /* trim trailing comma */
        sbuf_finish(&sb);

+
+out:
+       if (scratch_base != NULL)
+               FREE(scratch_base, M_MACTEMP);
+

        return (error);
 }
 
        return (error);
 }
 


@@ -1279,7 +1298,7 @@ mac_internalize(size_t mpo_internalize_off, struct label *label,
 /* system calls */
 
 int
 /* system calls */
 
 int

-__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __unused)
+__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)

 {
        char *elements, *buffer;
        struct user_mac mac;
 {
        char *elements, *buffer;
        struct user_mac mac;


@@ -1290,12 +1309,15 @@ __mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __
 
        AUDIT_ARG(pid, uap->pid);
        if (IS_64BIT_PROCESS(p)) {
 
        AUDIT_ARG(pid, uap->pid);
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error)
                return (error);
        }
        if (error)
                return (error);


@@ -1332,7 +1354,7 @@ __mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __
 }
 
 int
 }
 
 int

-__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unused)
+__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)

 {
        char *elements, *buffer;
        struct user_mac mac;
 {
        char *elements, *buffer;
        struct user_mac mac;


@@ -1341,12 +1363,15 @@ __mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unus
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error)
                return (error);
        }
        if (error)
                return (error);


@@ -1377,14 +1402,10 @@ __mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unus
        return (error);
 }
 
        return (error);
 }
 

-/*
- * MPSAFE
- */
-

 int
 int

-__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unused)
+__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)

 {
 {

-       kauth_cred_t newcred, oldcred;
+       kauth_cred_t newcred;

        struct label *intlabel;
        struct user_mac mac;
        char *buffer;
        struct label *intlabel;
        struct user_mac mac;
        char *buffer;


@@ -1392,12 +1413,15 @@ __mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unus
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error)
                return (error);
        }
        if (error)
                return (error);


@@ -1447,8 +1471,24 @@ out:
 }
 
 #if CONFIG_LCTX
 }
 
 #if CONFIG_LCTX

+/*
+ * __mac_get_lcid: 
+ *     Get login context ID.  A login context associates a BSD process 
+ *     with an instance of a user.  For more information see getlcid(2) man page.
+ *
+ * Parameters:    p                        Process requesting the get
+ *                uap                      User argument descriptor (see below)
+ *                ret                      (ignored)
+ *
+ * Indirect:      uap->lcid                login context ID to search
+ *                uap->mac_p.m_buflen      MAC info buffer size
+ *                uap->mac_p.m_string      MAC info user address
+ *
+ * Returns:        0                       Success
+ *                !0                       Not success
+ */

 int
 int

-__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, register_t *ret __unused)
+__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, int *ret __unused)

 {
        char *elements, *buffer;
        struct user_mac mac;
 {
        char *elements, *buffer;
        struct user_mac mac;


@@ -1456,14 +1496,17 @@ __mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, register_t *ret __unus
        int error;
        size_t ulen;
 
        int error;
        size_t ulen;
 

-       AUDIT_ARG(value, uap->lcid);
+       AUDIT_ARG(value32, uap->lcid);

        if (IS_64BIT_PROCESS(p)) {
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
 
        if (error)
        }
 
        if (error)


@@ -1497,8 +1540,24 @@ __mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, register_t *ret __unus
        return (error);
 }
 
        return (error);
 }
 

+/*
+ * __mac_get_lctx:
+ *     Get login context label.  A login context associates a BSD process
+ *     associated with an instance of a user.
+ *
+ * Parameters:    p                        Process requesting the get
+ *                uap                      User argument descriptor (see below)
+ *                ret                      (ignored)
+ *
+ * Indirect:      uap->lcid                login context ID to search
+ *                uap->mac_p               MAC info 
+ *
+ * Returns:        0                       Success
+ *                !0                       Not success
+ *
+ */

 int
 int

-__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, register_t *ret __unused)
+__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, int *ret __unused)

 {
        char *elements, *buffer;
        struct user_mac mac;
 {
        char *elements, *buffer;
        struct user_mac mac;


@@ -1506,12 +1565,15 @@ __mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, register_t *ret __unus
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
 
        if (error)
        }
 
        if (error)


@@ -1550,7 +1612,7 @@ out:
 }
 
 int
 }
 
 int

-__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, register_t *ret __unused)
+__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, int *ret __unused)

 {
        struct user_mac mac;
        struct label *intlabel;
 {
        struct user_mac mac;
        struct label *intlabel;


@@ -1559,12 +1621,15 @@ __mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, register_t *ret __unus
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error)
                return (error);
        }
        if (error)
                return (error);


@@ -1609,21 +1674,21 @@ out:
 #else  /* LCTX */
 
 int
 #else  /* LCTX */
 
 int

-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
+__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
+__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
+__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 {
 
        return (ENOSYS);


@@ -1631,7 +1696,7 @@ __mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, regi
 #endif /* !LCTX */
 
 int
 #endif /* !LCTX */
 
 int

-__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
+__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)

 {
        struct fileproc *fp;
        struct vnode *vp;
 {
        struct fileproc *fp;
        struct vnode *vp;


@@ -1648,12 +1713,15 @@ __mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
        AUDIT_ARG(fd, uap->fd);
 
        if (IS_64BIT_PROCESS(p)) {
        AUDIT_ARG(fd, uap->fd);
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
 
        if (error) 
        }
 
        if (error) 


@@ -1691,10 +1759,12 @@ __mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
        
        switch (fp->f_fglob->fg_type) {
                case DTYPE_VNODE:
        
        switch (fp->f_fglob->fg_type) {
                case DTYPE_VNODE:

-

                        intlabel = mac_vnode_label_alloc();
                        intlabel = mac_vnode_label_alloc();

+                       if (intlabel == NULL) {
+                               error = ENOMEM;
+                               break;
+                       }

                        vp = (struct vnode *)fp->f_fglob->fg_data;
                        vp = (struct vnode *)fp->f_fglob->fg_data;

-

                        error = vnode_getwithref(vp);
                        if (error == 0) {
                                mac_vnode_label_copy(vp->v_label, intlabel);
                        error = vnode_getwithref(vp);
                        if (error == 0) {
                                mac_vnode_label_copy(vp->v_label, intlabel);


@@ -1735,9 +1805,6 @@ __mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
        return (error);
 }
 
        return (error);
 }
 

-/*
- * MPSAFE
- */

 static int
 mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 {
 static int
 mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 {


@@ -1751,12 +1818,15 @@ mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
 
        if (error)
        }
 
        if (error)


@@ -1767,8 +1837,11 @@ mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
                return (error);
 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
                return (error);
 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);

+       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
+

        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {

+               FREE(buffer, M_MACTEMP);

                FREE(elements, M_MACTEMP);
                return (error);
        }
                FREE(elements, M_MACTEMP);
                return (error);
        }


@@ -1776,11 +1849,12 @@ mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 
        ctx = vfs_context_current();
 
 
        ctx = vfs_context_current();
 

-       NDINIT(&nd, LOOKUP,
+       NDINIT(&nd, LOOKUP, OP_LOOKUP,

                LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
                UIO_USERSPACE, path_p, ctx);
        error = namei(&nd);
        if (error) {
                LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
                UIO_USERSPACE, path_p, ctx);
        error = namei(&nd);
        if (error) {

+               FREE(buffer, M_MACTEMP);

                FREE(elements, M_MACTEMP);
                return (error);
        }
                FREE(elements, M_MACTEMP);
                return (error);
        }


@@ -1790,25 +1864,23 @@ mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 
        intlabel = mac_vnode_label_alloc();
        mac_vnode_label_copy(vp->v_label, intlabel);
 
        intlabel = mac_vnode_label_alloc();
        mac_vnode_label_copy(vp->v_label, intlabel);

-
-       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);

        error = mac_vnode_label_externalize(intlabel, elements, buffer,
        error = mac_vnode_label_externalize(intlabel, elements, buffer,

-                                           mac.m_buflen, M_WAITOK);
-       FREE(elements, M_MACTEMP);
-
+                                           mac.m_buflen, M_WAITOK);
+       mac_vnode_label_free(intlabel);

        if (error == 0)
                error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
        if (error == 0)
                error = copyout(buffer, mac.m_string, strlen(buffer) + 1);

-       FREE(buffer, M_MACTEMP);

 
        vnode_put(vp);
 
        vnode_put(vp);

-       mac_vnode_label_free(intlabel);
+
+       FREE(buffer, M_MACTEMP);
+       FREE(elements, M_MACTEMP);

 
        return (error);
 }
 
 int
 __mac_get_file(proc_t p, struct __mac_get_file_args *uap,
 
        return (error);
 }
 
 int
 __mac_get_file(proc_t p, struct __mac_get_file_args *uap,

-              register_t *ret __unused)
+              int *ret __unused)

 {
 
        return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));
 {
 
        return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));


@@ -1816,14 +1888,14 @@ __mac_get_file(proc_t p, struct __mac_get_file_args *uap,
 
 int
 __mac_get_link(proc_t p, struct __mac_get_link_args *uap,
 
 int
 __mac_get_link(proc_t p, struct __mac_get_link_args *uap,

-              register_t *ret __unused)
+              int *ret __unused)

 {
 
        return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
 }
 
 int
 {
 
        return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
 }
 
 int

-__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
+__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)

 {
 
        struct fileproc *fp;
 {
 
        struct fileproc *fp;


@@ -1841,12 +1913,15 @@ __mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
        AUDIT_ARG(fd, uap->fd);
 
        if (IS_64BIT_PROCESS(p)) {
        AUDIT_ARG(fd, uap->fd);
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error) 
                return (error);
        }
        if (error) 
                return (error);


@@ -1880,6 +1955,11 @@ __mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
        switch (fp->f_fglob->fg_type) {
 
                case DTYPE_VNODE:
        switch (fp->f_fglob->fg_type) {
 
                case DTYPE_VNODE:

+                       if (mac_label_vnodes == 0) {
+                               error = ENOSYS;
+                               break;
+                       }
+

                        intlabel = mac_vnode_label_alloc();
 
                        error = mac_vnode_label_internalize(intlabel, buffer);
                        intlabel = mac_vnode_label_alloc();
 
                        error = mac_vnode_label_internalize(intlabel, buffer);


@@ -1927,9 +2007,6 @@ __mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
        return (error);
 }
 
        return (error);
 }
 

-/*
- * MPSAFE
- */

 static int
 mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
                 int follow)
 static int
 mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
                 int follow)


@@ -1943,13 +2020,19 @@ mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
        int error;
        size_t ulen;
 
        int error;
        size_t ulen;
 

+       if (mac_label_vnodes == 0)
+               return ENOSYS;
+

        if (IS_64BIT_PROCESS(p)) {
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error)
                return (error);
        }
        if (error)
                return (error);


@@ -1976,7 +2059,7 @@ mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
                return (error);
        }
 
                return (error);
        }
 

-       NDINIT(&nd, LOOKUP,
+       NDINIT(&nd, LOOKUP, OP_LOOKUP,

                LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
                UIO_USERSPACE, path_p, ctx);
        error = namei(&nd);
                LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
                UIO_USERSPACE, path_p, ctx);
        error = namei(&nd);


@@ -1997,7 +2080,7 @@ mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
 
 int
 __mac_set_file(proc_t p, struct __mac_set_file_args *uap,
 
 int
 __mac_set_file(proc_t p, struct __mac_set_file_args *uap,

-              register_t *ret __unused)
+              int *ret __unused)

 {
 
        return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));
 {
 
        return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));


@@ -2005,18 +2088,29 @@ __mac_set_file(proc_t p, struct __mac_set_file_args *uap,
 
 int
 __mac_set_link(proc_t p, struct __mac_set_link_args *uap,
 
 int
 __mac_set_link(proc_t p, struct __mac_set_link_args *uap,

-              register_t *ret __unused)
+              int *ret __unused)

 {
 
        return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
 }
 
 /*
 {
 
        return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
 }
 
 /*

- * MPSAFE
+ * __mac_syscall: Perform a MAC policy system call
+ *
+ * Parameters:    p                       Process calling this routine
+ *                uap                     User argument descriptor (see below)
+ *                retv                    (Unused)
+ *
+ * Indirect:      uap->policy             Name of target MAC policy
+ *                uap->call               MAC policy-specific system call to perform
+ *                uap->arg                MAC policy-specific system call arguments
+ *                
+ * Returns:        0                      Success
+ *                !0                      Not success
+ *

  */
  */

-

 int
 int

-__mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unused)
+__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)

 {
        struct mac_policy_conf *mpc;
        char target[MAC_MAX_POLICY_NAME];
 {
        struct mac_policy_conf *mpc;
        char target[MAC_MAX_POLICY_NAME];


@@ -2027,7 +2121,7 @@ __mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unuse
        error = copyinstr(uap->policy, target, sizeof(target), &ulen);
        if (error)
                return (error);
        error = copyinstr(uap->policy, target, sizeof(target), &ulen);
        if (error)
                return (error);

-       AUDIT_ARG(value, uap->call);
+       AUDIT_ARG(value32, uap->call);

        AUDIT_ARG(mac_string, target);
 
        error = ENOPOLICY;
        AUDIT_ARG(mac_string, target);
 
        error = ENOPOLICY;


@@ -2074,12 +2168,15 @@ mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
        size_t ulen;
 
        if (IS_64BIT_PROCESS(current_proc())) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(current_proc())) {

-               error = copyin(mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
        if (error)
                return (error);
        }
        if (error)
                return (error);


@@ -2109,16 +2206,29 @@ mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
        return (error);
 }
 
        return (error);
 }
 

+/*
+ * __mac_get_mount: Get mount point label information for a given pathname
+ *
+ * Parameters:    p                        (ignored)
+ *                uap                      User argument descriptor (see below)
+ *                ret                      (ignored)
+ *
+ * Indirect:      uap->path                Pathname
+ *                uap->mac_p               MAC info 
+ *
+ * Returns:        0                       Success
+ *                !0                       Not success
+ */

 int
 __mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
 int
 __mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,

-    register_t *ret __unused)
+    int *ret __unused)

 {
        struct nameidata nd;
        struct vfs_context *ctx = vfs_context_current();
        struct mount *mp;
        int error;
 
 {
        struct nameidata nd;
        struct vfs_context *ctx = vfs_context_current();
        struct mount *mp;
        int error;
 

-       NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNPATH1,
+       NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,

                UIO_USERSPACE, uap->path, ctx);
        error = namei(&nd);
        if (error) {
                UIO_USERSPACE, uap->path, ctx);
        error = namei(&nd);
        if (error) {


@@ -2130,6 +2240,61 @@ __mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
        return mac_mount_label_get(mp, uap->mac_p);
 }
 
        return mac_mount_label_get(mp, uap->mac_p);
 }
 

+/*
+ * mac_schedule_userret()
+ *
+ * Schedule a callback to the mpo_thread_userret hook. The mpo_thread_userret
+ * hook is called just before the thread exit from the kernel in ast_taken().
+ *
+ * Returns:     0              Success
+ *             !0              Not successful
+ */
+int
+mac_schedule_userret(void)
+{
+
+       act_set_astmacf(current_thread());
+       return (0);
+}
+
+/*
+ * mac_do_machexc()
+ *
+ * Do a Mach exception.  This should only be done in the mpo_thread_userret
+ * callback.
+ *
+ * params:     code            exception code
+ *             subcode         exception subcode
+ *             flags           flags:
+ *                             MAC_DOEXCF_TRACED  Only do exception if being
+ *                                                ptrace()'ed.
+ *
+ *
+ * Returns:     0              Success
+ *             !0              Not successful
+ */
+int
+mac_do_machexc(int64_t code, int64_t subcode, uint32_t flags)
+{
+       mach_exception_data_type_t  codes[EXCEPTION_CODE_MAX];
+       proc_t p = current_proc();
+
+       /* Only allow execption codes in MACF's reserved range. */
+       if ((code < EXC_MACF_MIN) || (code > EXC_MACF_MAX))
+               return (1);
+
+       if (flags & MAC_DOEXCF_TRACED &&
+           !(p->p_lflag & P_LTRACED && (p->p_lflag & P_LPPWAIT) == 0))
+               return (0);
+
+
+       /* Send the Mach exception */
+       codes[0] = (mach_exception_data_type_t)code;
+       codes[1] = (mach_exception_data_type_t)subcode;
+
+       return (bsd_exception(EXC_SOFTWARE, codes, 2) != KERN_SUCCESS);
+}
+

 #else /* MAC */
 
 int
 #else /* MAC */
 
 int


@@ -2183,91 +2348,91 @@ mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
 }
 
 int
 }
 
 int

-__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, register_t *ret __unused)
+__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, register_t *ret __unused)
+__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, register_t *ret __unused)
+__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, register_t *ret __unused)
+__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, register_t *ret __unused)
+__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, register_t *ret __unused)
+__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, register_t *ret __unused)
+__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, register_t *ret __unused)
+__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, register_t *ret __unused)
+__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, register_t *ret __unused)
+__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
+__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
+__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 
 int
 {
 
        return (ENOSYS);
 }
 
 int

-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
+__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 {
 
        return (ENOSYS);


@@ -2275,9 +2440,23 @@ __mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, regi
 
 int
 __mac_get_mount(proc_t p __unused,
 
 int
 __mac_get_mount(proc_t p __unused,

-    struct __mac_get_mount_args *uap __unused, register_t *ret __unused)
+    struct __mac_get_mount_args *uap __unused, int *ret __unused)

 {
 
        return (ENOSYS);
 }
 {
 
        return (ENOSYS);
 }

+
+int
+mac_schedule_userret(void)
+{
+
+       return (1);
+}
+
+int
+mac_do_machexc(int64_t code __unused, int64_t subcode __unused, uint32_t flags __unused)
+{
+
+       return (1);
+}

 #endif /* !MAC */
 #endif /* !MAC */