xnu-6153.141.1.tar.gz

[apple/xnu.git] / bsd / kern / posix_sem.c

diff --git a/bsd/kern/posix_sem.c b/bsd/kern/posix_sem.c
index 05f946900c6f34cd9bc75286df4a4e20158269c9..b1119d15381f0860b6e3dea3c44e2a56d45ee342 100644 (file)
--- a/bsd/kern/posix_sem.c
+++ b/bsd/kern/posix_sem.c
@@ -1,30 +1,36 @@
 /*
 /*

- * Copyright (c) 2000-2002 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000-2007 Apple Inc. All rights reserved.

  *
  *

- * @APPLE_LICENSE_HEADER_START@
- * 
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License").  You may not use this file except in compliance with the
- * License.  Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
- * 
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ *
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER

  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,

- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
- * License for the specific language governing rights and limitations
- * under the License.
- * 
- * @APPLE_LICENSE_HEADER_END@
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@

  */
 /*
  *     Copyright (c) 1990, 1996-1998 Apple Computer, Inc.
  *     All Rights Reserved.
  */
 /*
  */
 /*
  *     Copyright (c) 1990, 1996-1998 Apple Computer, Inc.
  *     All Rights Reserved.
  */
 /*

- * posix_shm.c : Support for POSIX semaphore APIs
+ * posix_sem.c : Support for POSIX semaphore APIs

  *
  *     File:   posix_sem.c
  *     Author: Ananthakrishna Ramesh
  *
  *     File:   posix_sem.c
  *     Author: Ananthakrishna Ramesh


@@ -34,16 +40,22 @@
  *     Created for MacOSX
  *
  */
  *     Created for MacOSX
  *
  */

+/*
+ * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
+ * support for mandatory and extensible security protections.  This notice
+ * is included in support of clause 2.2 (b) of the Apple Public License,
+ * Version 2.0.
+ */

 
 #include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>

-#include <sys/file.h>
+#include <sys/file_internal.h>

 #include <sys/filedesc.h>
 #include <sys/stat.h>
 #include <sys/filedesc.h>
 #include <sys/stat.h>

-#include <sys/buf.h>
-#include <sys/proc.h>
+#include <sys/proc_internal.h>
+#include <sys/kauth.h>

 #include <sys/mount.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>


@@ -51,58 +63,84 @@
 #include <sys/tty.h>
 #include <sys/malloc.h>
 #include <sys/semaphore.h>
 #include <sys/tty.h>
 #include <sys/malloc.h>
 #include <sys/semaphore.h>

+#include <sys/sysproto.h>
+#include <sys/proc_info.h>
+
+#if CONFIG_MACF
+#include <sys/vnode_internal.h>
+#include <security/mac_framework.h>
+#endif
+
+#include <security/audit/audit.h>
+

 #include <mach/mach_types.h>
 #include <mach/vm_prot.h>
 #include <mach/semaphore.h>
 #include <mach/sync_policy.h>
 #include <mach/mach_types.h>
 #include <mach/vm_prot.h>
 #include <mach/semaphore.h>
 #include <mach/sync_policy.h>

+#include <mach/task.h>
+#include <kern/kern_types.h>

 #include <kern/task.h>
 #include <kern/clock.h>
 #include <mach/kern_return.h>
 
 #include <kern/task.h>
 #include <kern/clock.h>
 #include <mach/kern_return.h>
 

-#define        PSEMNAMLEN      31      /* maximum name segment length we bother with */
+
+#define f_flag f_fglob->fg_flag
+#define f_type f_fglob->fg_ops->fo_type
+#define f_msgcount f_fglob->fg_msgcount
+#define f_cred f_fglob->fg_cred
+#define f_ops f_fglob->fg_ops
+#define f_offset f_fglob->fg_offset
+#define f_data f_fglob->fg_data
+#define PSEMNAMLEN      31      /* maximum name segment length we bother with */

 
 struct pseminfo {
 
 struct pseminfo {

-       unsigned int    psem_flags;
-       unsigned int    psem_usecount;
-       mode_t          psem_mode;
-       uid_t           psem_uid;
-       gid_t           psem_gid;
-       char            psem_name[PSEMNAMLEN + 1];      /* segment name */
-       void *          psem_semobject;
-       struct proc *   sem_proc;
+       unsigned int    psem_flags;
+       unsigned int    psem_usecount;
+       mode_t          psem_mode;
+       uid_t           psem_uid;
+       gid_t           psem_gid;
+       char            psem_name[PSEMNAMLEN + 1];      /* segment name */
+       semaphore_t     psem_semobject;
+       struct label *  psem_label;
+       pid_t           psem_creator_pid;
+       uint64_t        psem_creator_uniqueid;

 };
 #define PSEMINFO_NULL (struct pseminfo *)0
 
 };
 #define PSEMINFO_NULL (struct pseminfo *)0
 

-#define        PSEM_NONE       1
-#define        PSEM_DEFINED    2
-#define        PSEM_ALLOCATED  4
-#define        PSEM_MAPPED     8
-#define        PSEM_INUSE      0x10
-#define        PSEM_REMOVED    0x20
-#define        PSEM_INCREATE   0x40
-#define        PSEM_INDELETE   0x80
-
-struct psemcache {
-       LIST_ENTRY(psemcache) psem_hash;        /* hash chain */
-       struct  pseminfo *pseminfo;             /* vnode the name refers to */
-       int     psem_nlen;              /* length of name */
-       char    psem_name[PSEMNAMLEN + 1];      /* segment name */
+#define PSEM_NONE       1
+#define PSEM_DEFINED    2
+#define PSEM_ALLOCATED  4
+#define PSEM_MAPPED     8
+#define PSEM_INUSE      0x10
+#define PSEM_REMOVED    0x20
+#define PSEM_INCREATE   0x40
+#define PSEM_INDELETE   0x80
+
+struct  psemcache {
+       LIST_ENTRY(psemcache) psem_hash;        /* hash chain */
+       struct  pseminfo *pseminfo;             /* vnode the name refers to */
+       int     psem_nlen;              /* length of name */
+       char    psem_name[PSEMNAMLEN + 1];      /* segment name */

 };
 #define PSEMCACHE_NULL (struct psemcache *)0
 
 };
 #define PSEMCACHE_NULL (struct psemcache *)0
 

-struct psemstats {
-       long    goodhits;               /* hits that we can really use */
-       long    neghits;                /* negative hits that we can use */
-       long    badhits;                /* hits we must drop */
-       long    falsehits;              /* hits with id mismatch */
-       long    miss;           /* misses */
-       long    longnames;              /* long names that ignore cache */
+#define PSEMCACHE_NOTFOUND (0)
+#define PSEMCACHE_FOUND    (-1)
+#define PSEMCACHE_NEGATIVE (ENOENT)
+
+struct  psemstats {
+       long    goodhits;               /* hits that we can really use */
+       long    neghits;                /* negative hits that we can use */
+       long    badhits;                /* hits we must drop */
+       long    falsehits;              /* hits with id mismatch */
+       long    miss;           /* misses */
+       long    longnames;              /* long names that ignore cache */

 };
 
 struct psemname {
 };
 
 struct psemname {

-       char    *psem_nameptr;  /* pointer to looked up name */
-       long    psem_namelen;   /* length of looked up component */
-       u_long  psem_hash;      /* hash value of looked up name */
+       char    *psem_nameptr;  /* pointer to looked up name */
+       long    psem_namelen;   /* length of looked up component */
+       u_int32_t       psem_hash;      /* hash value of looked up name */

 };
 
 struct psemnode {
 };
 
 struct psemnode {


@@ -117,31 +155,67 @@ struct psemnode {
 
 #define PSEMHASH(pnp) \
        (&psemhashtbl[(pnp)->psem_hash & psemhash])
 
 #define PSEMHASH(pnp) \
        (&psemhashtbl[(pnp)->psem_hash & psemhash])

-LIST_HEAD(psemhashhead, psemcache) *psemhashtbl;       /* Hash Table */
-u_long psemhash;                               /* size of hash table - 1 */
-long   psemnument;                     /* number of cache entries allocated */
-struct psemstats psemstats;            /* cache effectiveness statistics */
-
-static int psem_cache_search __P((struct pseminfo **,
-                               struct psemname *, struct psemcache **));
-
-static int psem_read  __P((struct file *fp, struct uio *uio,
-                           struct ucred *cred, int flags, struct proc *p));
-static int psem_write  __P((struct file *fp, struct uio *uio,
-                           struct ucred *cred, int flags, struct proc *p));
-static int psem_ioctl  __P((struct file *fp, u_long com,
-                           caddr_t data, struct proc *p));
-static int psem_select  __P((struct file *fp, int which, void *wql,
-                           struct proc *p));
-static int psem_closefile  __P((struct file *fp, struct proc *p));
-
-struct         fileops psemops =
-       { psem_read, psem_write, psem_ioctl, psem_select, psem_closefile };
+LIST_HEAD(psemhashhead, psemcache) * psemhashtbl;        /* Hash Table */
+u_long  psemhash;                               /* size of hash table - 1 */
+long    psemnument;                     /* number of cache entries allocated */
+long    posix_sem_max = 10000;          /* tunable for max POSIX semaphores */
+                                        /* 10000 limits to ~1M of memory */
+SYSCTL_NODE(_kern, KERN_POSIX, posix, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "Posix");
+SYSCTL_NODE(_kern_posix, OID_AUTO, sem, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "Semaphores");
+SYSCTL_LONG(_kern_posix_sem, OID_AUTO, max, CTLFLAG_RW | CTLFLAG_LOCKED, &posix_sem_max, "max");
+
+struct psemstats psemstats;             /* cache effectiveness statistics */
+
+static int psem_access(struct pseminfo *pinfo, int mode, kauth_cred_t cred);
+static int psem_cache_search(struct pseminfo **,
+    struct psemname *, struct psemcache **);
+static int psem_delete(struct pseminfo * pinfo);
+
+static int psem_closefile(struct fileglob *fp, vfs_context_t ctx);
+static int psem_unlink_internal(struct pseminfo *pinfo, struct psemcache *pcache);
+
+static const struct fileops psemops = {
+       .fo_type     = DTYPE_PSXSEM,
+       .fo_read     = fo_no_read,
+       .fo_write    = fo_no_write,
+       .fo_ioctl    = fo_no_ioctl,
+       .fo_select   = fo_no_select,
+       .fo_close    = psem_closefile,
+       .fo_drain    = fo_no_drain,
+       .fo_kqfilter = fo_no_kqfilter,
+};
+
+static lck_grp_t       *psx_sem_subsys_lck_grp;
+static lck_grp_attr_t  *psx_sem_subsys_lck_grp_attr;
+static lck_attr_t      *psx_sem_subsys_lck_attr;
+static lck_mtx_t        psx_sem_subsys_mutex;
+
+#define PSEM_SUBSYS_LOCK() lck_mtx_lock(& psx_sem_subsys_mutex)
+#define PSEM_SUBSYS_UNLOCK() lck_mtx_unlock(& psx_sem_subsys_mutex)
+#define PSEM_SUBSYS_ASSERT_HELD() LCK_MTX_ASSERT(&psx_sem_subsys_mutex, LCK_MTX_ASSERT_OWNED)
+
+
+static int psem_cache_add(struct pseminfo *psemp, struct psemname *pnp, struct psemcache *pcp);
+static void psem_cache_delete(struct psemcache *pcp);
+int psem_cache_purge_all(proc_t);
+
+
+/* Initialize the mutex governing access to the posix sem subsystem */
+__private_extern__ void
+psem_lock_init( void )
+{
+       psx_sem_subsys_lck_grp_attr = lck_grp_attr_alloc_init();
+
+       psx_sem_subsys_lck_grp = lck_grp_alloc_init("posix shared memory", psx_sem_subsys_lck_grp_attr);
+
+       psx_sem_subsys_lck_attr = lck_attr_alloc_init();
+       lck_mtx_init(&psx_sem_subsys_mutex, psx_sem_subsys_lck_grp, psx_sem_subsys_lck_attr);
+}

 
 /*
 
 /*

- * Lookup an entry in the cache 
- * 
- * 
+ * Lookup an entry in the cache
+ *
+ *

  * status of -1 is returned if matches
  * If the lookup determines that the name does not exist
  * (negative cacheing), a status of ENOENT is returned. If the lookup
  * status of -1 is returned if matches
  * If the lookup determines that the name does not exist
  * (negative cacheing), a status of ENOENT is returned. If the lookup


@@ -149,39 +223,38 @@ struct    fileops psemops =
  */
 
 static int
  */
 
 static int

-psem_cache_search(psemp, pnp, pcache)
-       struct pseminfo **psemp;
-       struct psemname *pnp;
-       struct psemcache **pcache;
+psem_cache_search(struct pseminfo **psemp, struct psemname *pnp,
+    struct psemcache **pcache)

 {
 {

-       register struct psemcache *pcp, *nnp;
-       register struct psemhashhead *pcpp;
+       struct psemcache *pcp, *nnp;
+       struct psemhashhead *pcpp;

 
        if (pnp->psem_namelen > PSEMNAMLEN) {
                psemstats.longnames++;
 
        if (pnp->psem_namelen > PSEMNAMLEN) {
                psemstats.longnames++;

-               return (0);
+               return PSEMCACHE_NOTFOUND;

        }
 
        pcpp = PSEMHASH(pnp);
        for (pcp = pcpp->lh_first; pcp != 0; pcp = nnp) {
                nnp = pcp->psem_hash.le_next;
                if (pcp->psem_nlen == pnp->psem_namelen &&
        }
 
        pcpp = PSEMHASH(pnp);
        for (pcp = pcpp->lh_first; pcp != 0; pcp = nnp) {
                nnp = pcp->psem_hash.le_next;
                if (pcp->psem_nlen == pnp->psem_namelen &&

-                   !bcmp(pcp->psem_name, pnp->psem_nameptr,                                            (u_int)pcp-> psem_nlen))
+                   !bcmp(pcp->psem_name, pnp->psem_nameptr, (u_int)pcp->psem_nlen)) {

                        break;
                        break;

+               }

        }
 
        if (pcp == 0) {
                psemstats.miss++;
        }
 
        if (pcp == 0) {
                psemstats.miss++;

-               return (0);
+               return PSEMCACHE_NOTFOUND;

        }
 
        /* We found a "positive" match, return the vnode */
        }
 
        /* We found a "positive" match, return the vnode */

-        if (pcp->pseminfo) {
+       if (pcp->pseminfo) {

                psemstats.goodhits++;
                /* TOUCH(ncp); */
                *psemp = pcp->pseminfo;
                *pcache = pcp;
                psemstats.goodhits++;
                /* TOUCH(ncp); */
                *psemp = pcp->pseminfo;
                *pcache = pcp;

-               return (-1);
+               return PSEMCACHE_FOUND;

        }
 
        /*
        }
 
        /*


@@ -189,41 +262,34 @@ psem_cache_search(psemp, pnp, pcache)
         * The nc_vpid field records whether this is a whiteout.
         */
        psemstats.neghits++;
         * The nc_vpid field records whether this is a whiteout.
         */
        psemstats.neghits++;

-       return (ENOENT);
+       return PSEMCACHE_NEGATIVE;

 }
 
 /*
  * Add an entry to the cache.
  */
 static int
 }
 
 /*
  * Add an entry to the cache.
  */
 static int

-psem_cache_add(psemp, pnp)
-       struct pseminfo *psemp;
-       struct psemname *pnp;
+psem_cache_add(struct pseminfo *psemp, struct psemname *pnp, struct psemcache *pcp)

 {
 {

-       register struct psemcache *pcp;
-       register struct psemhashhead *pcpp;
+       struct psemhashhead *pcpp;

        struct pseminfo *dpinfo;
        struct psemcache *dpcp;
 
 #if DIAGNOSTIC
        struct pseminfo *dpinfo;
        struct psemcache *dpcp;
 
 #if DIAGNOSTIC

-       if (pnp->psem_namelen > NCHNAMLEN)
+       if (pnp->psem_namelen > PSEMNAMLEN) {

                panic("cache_enter: name too long");
                panic("cache_enter: name too long");

+       }

 #endif
 
 #endif
 

-       /*
-        * We allocate a new entry if we are less than the maximum
-        * allowed and the one at the front of the LRU list is in use.
-        * Otherwise we use the one at the front of the LRU list.
-        */
-       pcp = (struct psemcache *)_MALLOC(sizeof(struct psemcache), M_SHM, M_WAITOK);
+

        /*  if the entry has already been added by some one else return */
        /*  if the entry has already been added by some one else return */

-       if (psem_cache_search(&dpinfo, pnp, &dpcp) == -1) {
-               _FREE(pcp, M_SHM);
-               return(EEXIST);
+       if (psem_cache_search(&dpinfo, pnp, &dpcp) == PSEMCACHE_FOUND) {
+               return EEXIST;
+       }
+       if (psemnument >= posix_sem_max) {
+               return ENOSPC;

        }
        psemnument++;
        }
        psemnument++;

-
-       bzero(pcp, sizeof(struct psemcache));

        /*
         * Fill in cache info, if vp is NULL this is a "negative" cache entry.
         * For negative entries, we have to record whether it is a whiteout.
        /*
         * Fill in cache info, if vp is NULL this is a "negative" cache entry.
         * For negative entries, we have to record whether it is a whiteout.


@@ -236,107 +302,130 @@ psem_cache_add(psemp, pnp)
        pcpp = PSEMHASH(pnp);
 #if DIAGNOSTIC
        {
        pcpp = PSEMHASH(pnp);
 #if DIAGNOSTIC
        {

-               register struct psemcache *p;
+               struct psemcache *p;

 
 

-               for (p = pcpp->lh_first; p != 0; p = p->psem_hash.le_next)
-                       if (p == pcp)
+               for (p = pcpp->lh_first; p != 0; p = p->psem_hash.le_next) {
+                       if (p == pcp) {

                                panic("psem:cache_enter duplicate");
                                panic("psem:cache_enter duplicate");

+                       }
+               }

        }
 #endif
        LIST_INSERT_HEAD(pcpp, pcp, psem_hash);
        }
 #endif
        LIST_INSERT_HEAD(pcpp, pcp, psem_hash);

-       return(0);
+       return 0;

 }
 
 /*
  * Name cache initialization, from vfs_init() when we are booting
  */
 void
 }
 
 /*
  * Name cache initialization, from vfs_init() when we are booting
  */
 void

-psem_cache_init()
+psem_cache_init(void)

 {
 {

-       psemhashtbl = hashinit(desiredvnodes, M_SHM, &psemhash);
+       psemhashtbl = hashinit(posix_sem_max / 2, M_SHM, &psemhash);

 }
 
 static void
 }
 
 static void

-psem_cache_delete(pcp)
-       struct psemcache *pcp;
+psem_cache_delete(struct psemcache *pcp)

 {
 #if DIAGNOSTIC
 {
 #if DIAGNOSTIC

-       if (pcp->psem_hash.le_prev == 0)
+       if (pcp->psem_hash.le_prev == 0) {

                panic("psem namecache purge le_prev");
                panic("psem namecache purge le_prev");

-       if (pcp->psem_hash.le_next == pcp)
+       }
+       if (pcp->psem_hash.le_next == pcp) {

                panic("namecache purge le_next");
                panic("namecache purge le_next");

+       }

 #endif /* DIAGNOSTIC */
        LIST_REMOVE(pcp, psem_hash);
 #endif /* DIAGNOSTIC */
        LIST_REMOVE(pcp, psem_hash);

-       pcp->psem_hash.le_prev = 0;     
+       pcp->psem_hash.le_prev = NULL;

        psemnument--;
 }
 
 /*
        psemnument--;
 }
 
 /*

- * Invalidate a all entries to particular vnode.
- * 
- * We actually just increment the v_id, that will do it. The entries will
- * be purged by lookup as they get found. If the v_id wraps around, we
- * need to ditch the entire cache, to avoid confusion. No valid vnode will
- * ever have (v_id == 0).
+ * Remove all cached psem entries. Open semaphores (with a positive refcount)
+ * will continue to exist, but their cache entries tying them to a particular
+ * name/path will be removed making all future lookups on the name fail.

  */
  */

-void
-psem_cache_purge(void)
+int
+psem_cache_purge_all(__unused proc_t p)

 {
 {

-       struct psemcache *pcp;
+       struct psemcache *pcp, *tmppcp;

        struct psemhashhead *pcpp;
        struct psemhashhead *pcpp;

+       int error = 0;
+
+       if (kauth_cred_issuser(kauth_cred_get()) == 0) {
+               return EPERM;
+       }

 
 

+       PSEM_SUBSYS_LOCK();

        for (pcpp = &psemhashtbl[psemhash]; pcpp >= psemhashtbl; pcpp--) {
        for (pcpp = &psemhashtbl[psemhash]; pcpp >= psemhashtbl; pcpp--) {

-               while (pcp = pcpp->lh_first)
-                       psem_cache_delete(pcp);
+               LIST_FOREACH_SAFE(pcp, pcpp, psem_hash, tmppcp) {
+                       assert(pcp->psem_nlen);
+                       /*
+                        * unconditionally unlink the cache entry
+                        */
+                       error = psem_unlink_internal(pcp->pseminfo, pcp);
+                       if (error) {
+                               goto out;
+                       }
+               }

        }
        }

-}
+       assert(psemnument == 0);

 
 

-struct sem_open_args {
-       const char *name;
-       int oflag;
-       int mode;
-       int value;
-};
+out:
+       PSEM_SUBSYS_UNLOCK();
+
+       if (error) {
+               printf("%s: Error %d removing all semaphores: %ld remain!\n",
+                   __func__, error, psemnument);
+       }
+       return error;
+}

 
 int
 
 int

-sem_open(p, uap, retval)
-       struct proc *p;
-       register struct sem_open_args *uap;
-       register_t *retval;
+sem_open(proc_t p, struct sem_open_args *uap, user_addr_t *retval)

 {
 {

-       register struct filedesc *fdp = p->p_fd;
-       register struct file *fp;
-       register struct vnode *vp;
-       int flags, i;
-       struct file *nfp;
-       int type, indx, error;
+       size_t i;
+       int indx, error;

        struct psemname nd;
        struct pseminfo *pinfo;
        struct psemname nd;
        struct pseminfo *pinfo;

-       extern struct fileops psemops;
-       char * pnbuf;
+       struct fileproc *fp = NULL;
+       char *pnbuf = NULL;
+       struct pseminfo *new_pinfo = PSEMINFO_NULL;
+       struct psemnode *new_pnode = PSEMNODE_NULL;
+       struct psemcache *pcache = PSEMCACHE_NULL;

        char * nameptr;
        char * cp;
        size_t pathlen, plen;
        char * nameptr;
        char * cp;
        size_t pathlen, plen;

-       int fmode ;
+       int fmode;

        int cmode = uap->mode;
        int value = uap->value;
        int incache = 0;
        int cmode = uap->mode;
        int value = uap->value;
        int incache = 0;

-       struct psemnode * pnode = PSEMNODE_NULL;
-       struct psemcache * pcache = PSEMCACHE_NULL;
-       kern_return_t kret = KERN_SUCCESS;
-       int pinfo_alloc = 0;
+       struct psemcache *pcp = PSEMCACHE_NULL;
+       kern_return_t kret = KERN_INVALID_ADDRESS;      /* default fail */
+
+       AUDIT_ARG(fflags, uap->oflag);
+       AUDIT_ARG(mode, uap->mode);
+       AUDIT_ARG(value32, uap->value);

 
        pinfo = PSEMINFO_NULL;
 
 
        pinfo = PSEMINFO_NULL;
 

-       MALLOC_ZONE(pnbuf, caddr_t,
-                       MAXPATHLEN, M_NAMEI, M_WAITOK);
+       /*
+        * Preallocate everything we might need up front to avoid taking
+        * and dropping the lock, opening us up to race conditions.
+        */
+       MALLOC_ZONE(pnbuf, caddr_t, MAXPATHLEN, M_NAMEI, M_WAITOK | M_ZERO);
+       if (pnbuf == NULL) {
+               error = ENOSPC;
+               goto bad;
+       }
+

        pathlen = MAXPATHLEN;
        pathlen = MAXPATHLEN;

-       error = copyinstr(uap->name, pnbuf,
-               MAXPATHLEN, &pathlen);
+       error = copyinstr(uap->name, pnbuf, MAXPATHLEN, &pathlen);

        if (error) {
                goto bad;
        }
        if (error) {
                goto bad;
        }

-       if (pathlen > PSEMNAMLEN) {
+       AUDIT_ARG(text, pnbuf);
+       if ((pathlen > PSEMNAMLEN)) {

                error = ENAMETOOLONG;
                goto bad;
        }
                error = ENAMETOOLONG;
                goto bad;
        }


@@ -349,7 +438,7 @@ sem_open(p, uap, retval)
                        error = EINVAL;
                        goto bad;
                }
                        error = EINVAL;
                        goto bad;
                }

-        } else {
+       } else {

                error = EINVAL;
                goto bad;
        }
                error = EINVAL;
                goto bad;
        }


@@ -359,376 +448,506 @@ sem_open(p, uap, retval)
        nameptr = pnbuf;
        nd.psem_nameptr = nameptr;
        nd.psem_namelen = plen;
        nameptr = pnbuf;
        nd.psem_nameptr = nameptr;
        nd.psem_namelen = plen;

-       nd. psem_hash =0;
+       nd.psem_hash = 0;

 
 

-        for (cp = nameptr, i=1; *cp != 0 && i <= plen; i++, cp++) {
-               nd.psem_hash += (unsigned char)*cp * i;
+       for (cp = nameptr, i = 1; *cp != 0 && i <= plen; i++, cp++) {
+               nd.psem_hash += (unsigned char)*cp * i;

        }
 
        }
 

-       error = psem_cache_search(&pinfo, &nd, &pcache);
+       /*
+        * attempt to allocate a new fp; if unsuccessful, the fp will be
+        * left unmodified (NULL).
+        */
+       error = falloc(p, &fp, &indx, vfs_context_current());
+       if (error) {
+               goto bad;
+       }

 
 

-       if (error == ENOENT) {
-               error = EINVAL;
+       /*
+        * We allocate a new entry if we are less than the maximum
+        * allowed and the one at the front of the LRU list is in use.
+        * Otherwise we use the one at the front of the LRU list.
+        */
+       MALLOC(pcp, struct psemcache *, sizeof(struct psemcache), M_SHM, M_WAITOK | M_ZERO);
+       if (pcp == PSEMCACHE_NULL) {
+               error = ENOMEM;

                goto bad;
                goto bad;

+       }

 
 

+       MALLOC(new_pinfo, struct pseminfo *, sizeof(struct pseminfo), M_SHM, M_WAITOK | M_ZERO);
+       if (new_pinfo == NULL) {
+               error = ENOSPC;
+               goto bad;

        }
        }

-       if (!error) {
-               incache = 0;
-       } else
-               incache = 1;
+#if CONFIG_MACF
+       mac_posixsem_label_init(new_pinfo);
+#endif
+
+       /*
+        * Provisionally create the semaphore in the new_pinfo; we have to do
+        * this here to prevent locking later.  We use the value of kret to
+        * signal success or failure, which is why we set its default value
+        * to KERN_INVALID_ADDRESS, above.
+        */
+

        fmode = FFLAGS(uap->oflag);
 
        fmode = FFLAGS(uap->oflag);
 

-       if (error = falloc(p, &nfp, &indx)) {
+       if ((fmode & O_CREAT)) {
+               if ((value < 0) || (value > SEM_VALUE_MAX)) {
+                       error = EINVAL;
+                       goto bad;
+               }
+
+               kret = semaphore_create(kernel_task, &new_pinfo->psem_semobject, SYNC_POLICY_FIFO, value);
+
+               if (kret != KERN_SUCCESS) {
+                       switch (kret) {
+                       case KERN_RESOURCE_SHORTAGE:
+                               error = ENOMEM;
+                               break;
+                       case KERN_PROTECTION_FAILURE:
+                               error = EACCES;
+                               break;
+                       default:
+                               error = EINVAL;
+                       }
+                       goto bad;
+               }
+       }
+
+       MALLOC(new_pnode, struct psemnode *, sizeof(struct psemnode), M_SHM, M_WAITOK | M_ZERO);
+       if (new_pnode == NULL) {
+               error = ENOSPC;

                goto bad;
        }
 
                goto bad;
        }
 

-       fp = nfp;
+       PSEM_SUBSYS_LOCK();
+       error = psem_cache_search(&pinfo, &nd, &pcache);
+
+       if (error == PSEMCACHE_NEGATIVE) {
+               error = EINVAL;
+               goto bad_locked;
+       }
+
+       if (error == PSEMCACHE_FOUND) {
+               incache = 1;
+       } else {
+               incache = 0;
+       }
+

        cmode &=  ALLPERMS;
 
        cmode &=  ALLPERMS;
 

-       if (((fmode & (O_CREAT | O_EXCL))==(O_CREAT | O_EXCL)) &&  incache) {
+       if (((fmode & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) && incache) {

                /* sem exists and opened O_EXCL */
 #if notyet
                if (pinfo->psem_flags & PSEM_INDELETE) {
                }
                /* sem exists and opened O_EXCL */
 #if notyet
                if (pinfo->psem_flags & PSEM_INDELETE) {
                }

-#endif 
+#endif
+               AUDIT_ARG(posix_ipc_perm, pinfo->psem_uid,
+                   pinfo->psem_gid, pinfo->psem_mode);

                error = EEXIST;
                error = EEXIST;

-               goto bad1;
+               goto bad_locked;

        }
        }

-       if (((fmode & (O_CREAT | O_EXCL))== O_CREAT) &&  incache) {
+       if (((fmode & (O_CREAT | O_EXCL)) == O_CREAT) && incache) {

                /* As per POSIX, O_CREAT has no effect */
                fmode &= ~O_CREAT;
        }
 
                /* As per POSIX, O_CREAT has no effect */
                fmode &= ~O_CREAT;
        }
 

-       if (fmode & O_CREAT) {
-               if((value < 0) && (value > SEM_VALUE_MAX)) {
-                       error = EINVAL;
-                       goto bad1;
-               }
-               pinfo = (struct pseminfo *)_MALLOC(sizeof(struct pseminfo), M_SHM, M_WAITOK);
-               bzero(pinfo, sizeof(struct pseminfo));
-               pinfo_alloc = 1;
+       if ((fmode & O_CREAT)) {
+               /* create a new one (commit the allocation) */
+               pinfo = new_pinfo;

                pinfo->psem_flags = PSEM_DEFINED | PSEM_INCREATE;
                pinfo->psem_usecount = 1;
                pinfo->psem_mode = cmode;
                pinfo->psem_flags = PSEM_DEFINED | PSEM_INCREATE;
                pinfo->psem_usecount = 1;
                pinfo->psem_mode = cmode;

-               pinfo->psem_uid = p->p_ucred->cr_uid;
-               pinfo->psem_gid = p->p_ucred->cr_gid;
-               kret = semaphore_create(kernel_task, &pinfo->psem_semobject,
-                            SYNC_POLICY_FIFO, value);
-               if(kret != KERN_SUCCESS) 
-                       goto bad3;
+               pinfo->psem_uid = kauth_getuid();
+               pinfo->psem_gid = kauth_getgid();
+               bcopy(pnbuf, &pinfo->psem_name[0], PSEMNAMLEN);
+               pinfo->psem_name[PSEMNAMLEN] = 0;

                pinfo->psem_flags &= ~PSEM_DEFINED;
                pinfo->psem_flags |= PSEM_ALLOCATED;
                pinfo->psem_flags &= ~PSEM_DEFINED;
                pinfo->psem_flags |= PSEM_ALLOCATED;

-               pinfo->sem_proc = p;
+               pinfo->psem_creator_pid = p->p_pid;
+               pinfo->psem_creator_uniqueid = p->p_uniqueid;
+
+#if CONFIG_MACF
+               error = mac_posixsem_check_create(kauth_cred_get(), nameptr);
+               if (error) {
+                       goto bad_locked;
+               }
+               mac_posixsem_label_associate(kauth_cred_get(), pinfo, nameptr);
+#endif

        } else {
                /* semaphore should exist as it is without  O_CREAT */
                if (!incache) {
                        error = ENOENT;
        } else {
                /* semaphore should exist as it is without  O_CREAT */
                if (!incache) {
                        error = ENOENT;

-                       goto bad1;
+                       goto bad_locked;

                }
                }

-               if( pinfo->psem_flags & PSEM_INDELETE) {
+               if (pinfo->psem_flags & PSEM_INDELETE) {

                        error = ENOENT;
                        error = ENOENT;

-                       goto bad1;
-               }       
-               if (error = psem_access(pinfo, fmode, p->p_ucred, p))
-                       goto bad1;
+                       goto bad_locked;
+               }
+               AUDIT_ARG(posix_ipc_perm, pinfo->psem_uid,
+                   pinfo->psem_gid, pinfo->psem_mode);
+#if CONFIG_MACF
+               error = mac_posixsem_check_open(kauth_cred_get(), pinfo);
+               if (error) {
+                       goto bad_locked;
+               }
+#endif
+               if ((error = psem_access(pinfo, fmode, kauth_cred_get()))) {
+                       goto bad_locked;
+               }

        }
        }

-       pnode = (struct psemnode *)_MALLOC(sizeof(struct psemnode), M_SHM, M_WAITOK);
-       bzero(pnode, sizeof(struct psemnode));

 
        if (!incache) {
 
        if (!incache) {

-               if (error = psem_cache_add(pinfo, &nd)) {
-               goto bad2;
+               /* if successful, this will consume the pcp */
+               if ((error = psem_cache_add(pinfo, &nd, pcp))) {
+                       goto bad_locked;

                }
        }
        pinfo->psem_flags &= ~PSEM_INCREATE;
        pinfo->psem_usecount++;
                }
        }
        pinfo->psem_flags &= ~PSEM_INCREATE;
        pinfo->psem_usecount++;

-       pnode->pinfo = pinfo;
-       fp->f_flag = flags & FMASK;
-       fp->f_type = DTYPE_PSXSEM;
-       fp->f_ops = &psemops;
-       fp->f_data = (caddr_t)pnode;
-       *fdflags(p, indx) &= ~UF_RESERVED;
-       *retval = indx;
-       _FREE_ZONE(pnbuf, MAXPATHLEN, M_NAMEI);
-       return (0);
+       new_pnode->pinfo = pinfo;
+       PSEM_SUBSYS_UNLOCK();

 
 

-bad3:
-       switch (kret) {
-       case KERN_RESOURCE_SHORTAGE:
-               error = ENOMEM;
-       case KERN_PROTECTION_FAILURE:
-               error = EACCES;
-       default:
-               error = EINVAL;
+       /*
+        * if incache, we did not use the new pcp or the new pcp or the
+        * new . and we must free them.
+        */
+       if (incache) {
+               FREE(pcp, M_SHM);
+               pcp = PSEMCACHE_NULL;
+               if (new_pinfo != PSEMINFO_NULL) {
+                       /* return value ignored - we can't _not_ do this */
+                       (void)semaphore_destroy(kernel_task, new_pinfo->psem_semobject);
+#if CONFIG_MACF
+                       mac_posixsem_label_destroy(new_pinfo);
+#endif
+                       FREE(new_pinfo, M_SHM);
+                       new_pinfo = PSEMINFO_NULL;
+               }

        }
        }

-       goto bad1;
-bad2:
-       _FREE(pnode, M_SHM);
-       if (pinfo_alloc)
-               _FREE(pinfo, M_SHM);
-bad1:
-       fdrelse(p, indx);
-       ffree(nfp);
+
+       proc_fdlock(p);
+       fp->f_flag = fmode & FMASK;
+       fp->f_ops = &psemops;
+       fp->f_data = (caddr_t)new_pnode;
+       procfdtbl_releasefd(p, indx, NULL);
+       fp_drop(p, indx, fp, 1);
+       proc_fdunlock(p);
+
+       *retval = CAST_USER_ADDR_T(indx);
+       FREE_ZONE(pnbuf, MAXPATHLEN, M_NAMEI);
+       return 0;
+
+bad_locked:
+       PSEM_SUBSYS_UNLOCK();

 bad:
 bad:

-       _FREE_ZONE(pnbuf, MAXPATHLEN, M_NAMEI);
-       return (error);
+       if (pcp != PSEMCACHE_NULL) {
+               FREE(pcp, M_SHM);
+       }
+
+       if (new_pnode != PSEMNODE_NULL) {
+               FREE(new_pnode, M_SHM);
+       }
+
+       if (fp != NULL) {
+               fp_free(p, indx, fp);
+       }
+
+       if (new_pinfo != PSEMINFO_NULL) {
+               /*
+                * kret signals whether or not we successfully created a
+                * Mach semaphore for this semaphore; if so, we need to
+                * destroy it here.
+                */
+               if (kret == KERN_SUCCESS) {
+                       /* return value ignored - we can't _not_ do this */
+                       (void)semaphore_destroy(kernel_task, new_pinfo->psem_semobject);
+               }
+#if CONFIG_MACF
+               mac_posixsem_label_destroy(new_pinfo);
+#endif
+               FREE(new_pinfo, M_SHM);
+       }
+
+       if (pnbuf != NULL) {
+               FREE_ZONE(pnbuf, MAXPATHLEN, M_NAMEI);
+       }
+       return error;

 }
 
 }
 

-int
-psem_access(pinfo, mode, cred, p)
-       struct pseminfo *pinfo;
-       int mode;
-       struct ucred *cred;
-       struct proc *p;
+/*
+ * XXX This code is repeated in several places
+ */
+static int
+psem_access(struct pseminfo *pinfo, int mode, kauth_cred_t cred)

 {
 {

-       mode_t mask;
-       register gid_t *gp;
-       int i, error;
+       int mode_req = ((mode & FREAD) ? S_IRUSR : 0) |
+           ((mode & FWRITE) ? S_IWUSR : 0);

 
        /* Otherwise, user id 0 always gets access. */
 
        /* Otherwise, user id 0 always gets access. */

-       if (cred->cr_uid == 0)
-               return (0);
-
-       mask = 0;
-
-       /* Otherwise, check the owner. */
-       if (cred->cr_uid == pinfo->psem_uid) {
-               if (mode & FREAD)
-                       mask |= S_IRUSR;
-               if (mode & FWRITE)
-                       mask |= S_IWUSR;
-               return ((pinfo->psem_mode & mask) == mask ? 0 : EACCES);
-       }
-
-       /* Otherwise, check the groups. */
-       for (i = 0, gp = cred->cr_groups; i < cred->cr_ngroups; i++, gp++)
-               if (pinfo->psem_gid == *gp) {
-                       if (mode & FREAD)
-                               mask |= S_IRGRP;
-                       if (mode & FWRITE)
-                               mask |= S_IWGRP;
-                       return ((pinfo->psem_mode & mask) == mask ? 0 : EACCES);
-               }
+       if (!suser(cred, NULL)) {
+               return 0;
+       }

 
 

-       /* Otherwise, check everyone else. */
-       if (mode & FREAD)
-               mask |= S_IROTH;
-       if (mode & FWRITE)
-               mask |= S_IWOTH;
-       return ((pinfo->psem_mode & mask) == mask ? 0 : EACCES);
+       return posix_cred_access(cred, pinfo->psem_uid, pinfo->psem_gid, pinfo->psem_mode, mode_req);
+}
+
+static int
+psem_unlink_internal(struct pseminfo *pinfo, struct psemcache *pcache)
+{
+       PSEM_SUBSYS_ASSERT_HELD();
+
+       if (!pinfo || !pcache) {
+               return EINVAL;
+       }
+
+       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED)) == 0) {
+               return EINVAL;
+       }
+
+       if (pinfo->psem_flags & PSEM_INDELETE) {
+               return 0;
+       }
+
+       AUDIT_ARG(posix_ipc_perm, pinfo->psem_uid, pinfo->psem_gid,
+           pinfo->psem_mode);
+
+       pinfo->psem_flags |= PSEM_INDELETE;
+       pinfo->psem_usecount--;
+
+       if (!pinfo->psem_usecount) {
+               psem_delete(pinfo);
+               FREE(pinfo, M_SHM);
+       } else {
+               pinfo->psem_flags |= PSEM_REMOVED;
+       }
+
+       psem_cache_delete(pcache);
+       FREE(pcache, M_SHM);
+       return 0;

 }
 
 }
 

-struct sem_unlink_args {
-       const char *name;
-};

 
 int
 
 int

-sem_unlink(p, uap, retval)
-       struct proc *p;
-       register struct sem_unlink_args *uap;
-       register_t *retval;
+sem_unlink(__unused proc_t p, struct sem_unlink_args *uap, __unused int32_t *retval)

 {
 {

-       register struct filedesc *fdp = p->p_fd;
-       register struct file *fp;
-       int flags, i;
-       int error=0;
+       size_t i;
+       int error = 0;

        struct psemname nd;
        struct pseminfo *pinfo;
        struct psemname nd;
        struct pseminfo *pinfo;

-       extern struct fileops psemops;
-       char * pnbuf;

        char * nameptr;
        char * cp;
        char * nameptr;
        char * cp;

-       size_t pathlen, plen;
-       int fmode, cmode ;
-       int incache = 0;
-       struct psemnode * pnode = PSEMNODE_NULL;
+       char * pnbuf;
+       size_t pathlen;

        struct psemcache *pcache = PSEMCACHE_NULL;
        struct psemcache *pcache = PSEMCACHE_NULL;

-       kern_return_t kret;

 
        pinfo = PSEMINFO_NULL;
 
 
        pinfo = PSEMINFO_NULL;
 

-       MALLOC_ZONE(pnbuf, caddr_t,
-                       MAXPATHLEN, M_NAMEI, M_WAITOK);
+       MALLOC_ZONE(pnbuf, caddr_t, MAXPATHLEN, M_NAMEI, M_WAITOK);
+       if (pnbuf == NULL) {
+               return ENOSPC;         /* XXX non-standard */
+       }

        pathlen = MAXPATHLEN;
        pathlen = MAXPATHLEN;

-       error = copyinstr(uap->name, pnbuf,
-               MAXPATHLEN, &pathlen);
+       error = copyinstr(uap->name, pnbuf, MAXPATHLEN, &pathlen);

        if (error) {
                goto bad;
        }
        if (error) {
                goto bad;
        }

+       AUDIT_ARG(text, pnbuf);

        if (pathlen > PSEMNAMLEN) {
                error = ENAMETOOLONG;
                goto bad;
        }
 
        if (pathlen > PSEMNAMLEN) {
                error = ENAMETOOLONG;
                goto bad;
        }
 

+       nameptr = pnbuf;

 
 #ifdef PSXSEM_NAME_RESTRICT
 
 #ifdef PSXSEM_NAME_RESTRICT

-       nameptr = pnbuf;

        if (*nameptr == '/') {
                while (*(nameptr++) == '/') {
        if (*nameptr == '/') {
                while (*(nameptr++) == '/') {

-                       plen--;
+                       pathlen--;

                        error = EINVAL;
                        goto bad;
                }
                        error = EINVAL;
                        goto bad;
                }

-        } else {
+       } else {

                error = EINVAL;
                goto bad;
        }
 #endif /* PSXSEM_NAME_RESTRICT */
 
                error = EINVAL;
                goto bad;
        }
 #endif /* PSXSEM_NAME_RESTRICT */
 

-       plen = pathlen;
-       nameptr = pnbuf;

        nd.psem_nameptr = nameptr;
        nd.psem_nameptr = nameptr;

-       nd.psem_namelen = plen;
-       nd. psem_hash =0;
+       nd.psem_namelen = pathlen;
+       nd.psem_hash = 0;

 
 

-        for (cp = nameptr, i=1; *cp != 0 && i <= plen; i++, cp++) {
-               nd.psem_hash += (unsigned char)*cp * i;
+       for (cp = nameptr, i = 1; *cp != 0 && i <= pathlen; i++, cp++) {
+               nd.psem_hash += (unsigned char)*cp * i;

        }
 
        }
 

+       PSEM_SUBSYS_LOCK();

        error = psem_cache_search(&pinfo, &nd, &pcache);
 
        error = psem_cache_search(&pinfo, &nd, &pcache);
 

-       if (error == ENOENT) {
-               error = EINVAL;
+       if (error != PSEMCACHE_FOUND) {
+               PSEM_SUBSYS_UNLOCK();
+               error = ENOENT;

                goto bad;
                goto bad;

-

        }
        }

-       if (!error) {
-               error = EINVAL;
-               goto bad;
-       } else
-               incache = 1;
-       if (error = psem_access(pinfo, pinfo->psem_mode, p->p_ucred, p))
-               goto bad;

 
 

-       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED))==0) {
-               return (EINVAL);
+#if CONFIG_MACF
+       error = mac_posixsem_check_unlink(kauth_cred_get(), pinfo, nameptr);
+       if (error) {
+               PSEM_SUBSYS_UNLOCK();
+               goto bad;

        }
        }

-
-       if (pinfo->psem_flags & PSEM_INDELETE) {
-               error = 0;
+#endif
+       if ((error = psem_access(pinfo, pinfo->psem_mode, kauth_cred_get()))) {
+               PSEM_SUBSYS_UNLOCK();

                goto bad;
        }
                goto bad;
        }

-       pinfo->psem_flags |= PSEM_INDELETE;
-       pinfo->psem_usecount--;

 
 

-       if (!pinfo->psem_usecount) {
-               psem_delete(pinfo);
-               _FREE(pinfo,M_SHM);
-       } else
-               pinfo->psem_flags |= PSEM_REMOVED;
+       error = psem_unlink_internal(pinfo, pcache);
+       PSEM_SUBSYS_UNLOCK();

 
 

-       psem_cache_delete(pcache);
-       _FREE(pcache, M_SHM);
-       error = 0;

 bad:
 bad:

-       _FREE_ZONE(pnbuf, MAXPATHLEN, M_NAMEI);
-       return (error);
+       FREE_ZONE(pnbuf, MAXPATHLEN, M_NAMEI);
+       return error;

 }
 
 }
 

-struct sem_close_args {
-       sem_t *sem;
-};
-

 int
 int

-sem_close(p, uap, retval)
-       struct proc *p;
-       struct sem_close_args *uap;
-       register_t *retval;
+sem_close(proc_t p, struct sem_close_args *uap, __unused int32_t *retval)

 {
 {

-       int fd = (int)uap->sem;
-       register struct filedesc *fdp = p->p_fd;
-       register struct file *fp;
+       int fd = CAST_DOWN_EXPLICIT(int, uap->sem);
+       struct fileproc *fp;

        int error = 0;
 
        int error = 0;
 

+       AUDIT_ARG(fd, fd); /* XXX This seems wrong; uap->sem is a pointer */

 
 

-       if ((u_int)fd >= fdp->fd_nfiles ||
-                       (fp = fdp->fd_ofiles[fd]) == NULL ||
-                       (fdp->fd_ofileflags[fd] & UF_RESERVED))
-               return (EBADF);
+       proc_fdlock(p);
+       error = fp_lookup(p, fd, &fp, 1);
+       if (error) {
+               proc_fdunlock(p);
+               return error;
+       }
+       if (fp->f_type != DTYPE_PSXSEM) {
+               fp_drop(p, fd, fp, 1);
+               proc_fdunlock(p);
+               return EBADF;
+       }
+       procfdtbl_markclosefd(p, fd);
+       /* release the ref returned from fp_lookup before calling drain */
+       (void) os_ref_release_locked(&fp->f_iocount);
+       fileproc_drain(p, fp);

        fdrelse(p, fd);
        fdrelse(p, fd);

-       if( error = closef(fp, p))
-               return(error);
-       return(0);
+       error = closef_locked(fp, fp->f_fglob, p);
+       fileproc_free(fp);
+       proc_fdunlock(p);
+       return error;

 }
 
 }
 

-struct sem_wait_args {
-       sem_t *sem;
-};
+int
+sem_wait(proc_t p, struct sem_wait_args *uap, int32_t *retval)
+{
+       __pthread_testcancel(1);
+       return sem_wait_nocancel(p, (struct sem_wait_nocancel_args *)uap, retval);
+}

 
 int
 
 int

-sem_wait(p, uap, retval)
-       struct proc *p;
-       struct sem_wait_args *uap;
-       register_t *retval;
+sem_wait_nocancel(proc_t p, struct sem_wait_nocancel_args *uap, __unused int32_t *retval)

 {
 {

-       int fd = (int)uap->sem;
-       register struct filedesc *fdp = p->p_fd;
-       struct file *fp;
+       int fd = CAST_DOWN_EXPLICIT(int, uap->sem);
+       struct fileproc *fp;

        struct pseminfo * pinfo;
        struct pseminfo * pinfo;

-       struct psemnode * pnode ;
+       struct psemnode * pnode;

        kern_return_t kret;
        int error;
 
        kern_return_t kret;
        int error;
 

-       if (error = fdgetf(p, (int)uap->sem, &fp))
-               return (error);
-       if (fp->f_type != DTYPE_PSXSEM)
-               return(EBADF);
-       if (((pnode = (struct psemnode *)fp->f_data)) == PSEMNODE_NULL )
-               return(EINVAL);
-       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL)
-               return(EINVAL);
-       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED)) 
-                       != PSEM_ALLOCATED) {
-               return(EINVAL);
+       error = fp_getfpsem(p, fd, &fp, &pnode);
+       if (error) {
+               return error;

        }
        }

-
+       if (((pnode = (struct psemnode *)fp->f_data)) == PSEMNODE_NULL) {
+               error = EINVAL;
+               goto out;
+       }
+       PSEM_SUBSYS_LOCK();
+       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL) {
+               PSEM_SUBSYS_UNLOCK();
+               error = EINVAL;
+               goto out;
+       }
+       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED))
+           != PSEM_ALLOCATED) {
+               PSEM_SUBSYS_UNLOCK();
+               error = EINVAL;
+               goto out;
+       }
+#if CONFIG_MACF
+       error = mac_posixsem_check_wait(kauth_cred_get(), pinfo);
+       if (error) {
+               PSEM_SUBSYS_UNLOCK();
+               goto out;
+       }
+#endif
+       PSEM_SUBSYS_UNLOCK();

        kret = semaphore_wait(pinfo->psem_semobject);
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:
        kret = semaphore_wait(pinfo->psem_semobject);
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:

-               return (EACCES);
+               error = EACCES;
+               break;

        case KERN_ABORTED:
        case KERN_OPERATION_TIMED_OUT:
        case KERN_ABORTED:
        case KERN_OPERATION_TIMED_OUT:

-               return (EINTR);
+               error = EINTR;
+               break;

        case KERN_SUCCESS:
        case KERN_SUCCESS:

-               return(0);
+               error = 0;
+               break;

        default:
        default:

-               return (EINVAL);
+               error = EINVAL;
+               break;

        }
        }

+out:
+       fp_drop(p, fd, fp, 0);
+       return error;

 }
 
 }
 

-struct sem_trywait_args {
-       sem_t *sem;
-};
-

 int
 int

-sem_trywait(p, uap, retval)
-       struct proc *p;
-       struct sem_trywait_args *uap;
-       register_t *retval;
+sem_trywait(proc_t p, struct sem_trywait_args *uap, __unused int32_t *retval)

 {
 {

-       int fd = (int)uap->sem;
-       register struct filedesc *fdp = p->p_fd;
-       struct file *fp;
+       int fd = CAST_DOWN_EXPLICIT(int, uap->sem);
+       struct fileproc *fp;

        struct pseminfo * pinfo;
        struct pseminfo * pinfo;

-       struct psemnode * pnode ;
+       struct psemnode * pnode;

        kern_return_t kret;
        mach_timespec_t wait_time;
        int error;
        kern_return_t kret;
        mach_timespec_t wait_time;
        int error;

-       
-       if (error = fdgetf(p, (int)uap->sem, &fp))
-               return (error);
-       if (fp->f_type != DTYPE_PSXSEM)
-               return(EBADF);
-       if (((pnode = (struct psemnode *)fp->f_data)) == PSEMNODE_NULL )
-               return(EINVAL);
-       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL)
-               return(EINVAL);
-       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED)) 
-                       != PSEM_ALLOCATED) {
-               return(EINVAL);
-       }

 
 

+       error = fp_getfpsem(p, fd, &fp, &pnode);
+       if (error) {
+               return error;
+       }
+       if (((pnode = (struct psemnode *)fp->f_data)) == PSEMNODE_NULL) {
+               error = EINVAL;
+               goto out;
+       }
+       PSEM_SUBSYS_LOCK();
+       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL) {
+               PSEM_SUBSYS_UNLOCK();
+               error = EINVAL;
+               goto out;
+       }
+       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED))
+           != PSEM_ALLOCATED) {
+               PSEM_SUBSYS_UNLOCK();
+               error = EINVAL;
+               goto out;
+       }
+#if CONFIG_MACF
+       error = mac_posixsem_check_wait(kauth_cred_get(), pinfo);
+       if (error) {
+               PSEM_SUBSYS_UNLOCK();
+               goto out;
+       }
+#endif
+       PSEM_SUBSYS_UNLOCK();

        wait_time.tv_sec = 0;
        wait_time.tv_nsec = 0;
 
        wait_time.tv_sec = 0;
        wait_time.tv_nsec = 0;
 


@@ -736,207 +955,209 @@ sem_trywait(p, uap, retval)
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:

-               return (EINVAL);
+               error = EINVAL;
+               break;

        case KERN_ABORTED:
        case KERN_ABORTED:

-               return (EINTR);
+               error = EINTR;
+               break;

        case KERN_OPERATION_TIMED_OUT:
        case KERN_OPERATION_TIMED_OUT:

-               return (EAGAIN);
+               error = EAGAIN;
+               break;

        case KERN_SUCCESS:
        case KERN_SUCCESS:

-               return(0);
+               error = 0;
+               break;

        default:
        default:

-               return (EINVAL);
+               error = EINVAL;
+               break;

        }
        }

+out:
+       fp_drop(p, fd, fp, 0);
+       return error;

 }
 
 }
 

-struct sem_post_args {
-       sem_t *sem;
-};
-

 int
 int

-sem_post(p, uap, retval)
-       struct proc *p;
-       struct sem_post_args *uap;
-       register_t *retval;
+sem_post(proc_t p, struct sem_post_args *uap, __unused int32_t *retval)

 {
 {

-       int fd = (int)uap->sem;
-       register struct filedesc *fdp = p->p_fd;
-       struct file *fp;
+       int fd = CAST_DOWN_EXPLICIT(int, uap->sem);
+       struct fileproc *fp;

        struct pseminfo * pinfo;
        struct pseminfo * pinfo;

-       struct psemnode * pnode ;
+       struct psemnode * pnode;

        kern_return_t kret;
        int error;
 
        kern_return_t kret;
        int error;
 

-       if (error = fdgetf(p, (int)uap->sem, &fp))
-               return (error);
-       if (fp->f_type != DTYPE_PSXSEM)
-               return(EBADF);
-       if (((pnode = (struct psemnode *)fp->f_data)) == PSEMNODE_NULL )
-               return(EINVAL);
-       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL)
-               return(EINVAL);
-       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED)) 
-                       != PSEM_ALLOCATED) {
-               return(EINVAL);
+       error = fp_getfpsem(p, fd, &fp, &pnode);
+       if (error) {
+               return error;

        }
        }

-
+       if (((pnode = (struct psemnode *)fp->f_data)) == PSEMNODE_NULL) {
+               error = EINVAL;
+               goto out;
+       }
+       PSEM_SUBSYS_LOCK();
+       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL) {
+               PSEM_SUBSYS_UNLOCK();
+               error = EINVAL;
+               goto out;
+       }
+       if ((pinfo->psem_flags & (PSEM_DEFINED | PSEM_ALLOCATED))
+           != PSEM_ALLOCATED) {
+               PSEM_SUBSYS_UNLOCK();
+               error = EINVAL;
+               goto out;
+       }
+#if CONFIG_MACF
+       error = mac_posixsem_check_post(kauth_cred_get(), pinfo);
+       if (error) {
+               PSEM_SUBSYS_UNLOCK();
+               goto out;
+       }
+#endif
+       PSEM_SUBSYS_UNLOCK();

        kret = semaphore_signal(pinfo->psem_semobject);
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:
        kret = semaphore_signal(pinfo->psem_semobject);
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:

-               return (EINVAL);
+               error = EINVAL;
+               break;

        case KERN_ABORTED:
        case KERN_OPERATION_TIMED_OUT:
        case KERN_ABORTED:
        case KERN_OPERATION_TIMED_OUT:

-               return (EINTR);
+               error = EINTR;
+               break;

        case KERN_SUCCESS:
        case KERN_SUCCESS:

-               return(0);
+               error = 0;
+               break;

        default:
        default:

-               return (EINVAL);
+               error = EINVAL;
+               break;

        }
        }

-}
-
-struct sem_init_args {
-       sem_t *sem;
-       int phsared;
-       unsigned int value;
-};
-
-int
-sem_init(p, uap, retval)
-       struct proc *p;
-       struct sem_init_args *uap;
-       register_t *retval;
-{
-       return(ENOSYS);
-}
-
-struct sem_destroy_args {
-       sem_t *sem;
-};
-
-int
-sem_destroy(p, uap, retval)
-       struct proc *p;
-       struct sem_destroy_args *uap;
-       register_t *retval;
-{
-       return(ENOSYS);
-}
-
-struct sem_getvalue_args {
-       sem_t *sem;
-       int * sval;
-};
-
-int
-sem_getvalue(p, uap, retval)
-       struct proc *p;
-       struct sem_getvalue_args *uap;
-       register_t *retval;
-{
-       return(ENOSYS);
+out:
+       fp_drop(p, fd, fp, 0);
+       return error;

 }
 
 static int
 }
 
 static int

-psem_close(pnode, flags, cred, p)
-       register struct psemnode *pnode;
-       int flags;
-       struct ucred *cred;
-       struct proc *p;
+psem_close(struct psemnode *pnode, __unused int flags)

 {
 {

-       int error=0;
-       kern_return_t kret;
-       register struct pseminfo *pinfo;
+       int error = 0;
+       struct pseminfo *pinfo;

 
 

-       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL)
-               return(EINVAL);
+       PSEM_SUBSYS_LOCK();
+       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL) {
+               PSEM_SUBSYS_UNLOCK();
+               return EINVAL;
+       }

 
        if ((pinfo->psem_flags & PSEM_ALLOCATED) != PSEM_ALLOCATED) {
 
        if ((pinfo->psem_flags & PSEM_ALLOCATED) != PSEM_ALLOCATED) {

-               return(EINVAL);
+               PSEM_SUBSYS_UNLOCK();
+               return EINVAL;

        }
 #if DIAGNOSTIC
        }
 #if DIAGNOSTIC

-       if(!pinfo->psem_usecount) {
+       if (!pinfo->psem_usecount) {

                kprintf("negative usecount in psem_close\n");
        }
 #endif /* DIAGNOSTIC */
        pinfo->psem_usecount--;
 
                kprintf("negative usecount in psem_close\n");
        }
 #endif /* DIAGNOSTIC */
        pinfo->psem_usecount--;
 

-       if ((pinfo->psem_flags & PSEM_REMOVED) && !pinfo->psem_usecount) {
+       if ((pinfo->psem_flags & PSEM_REMOVED) && !pinfo->psem_usecount) {
+               PSEM_SUBSYS_UNLOCK();
+               /* lock dropped as only semaphore is destroyed here */

                error = psem_delete(pinfo);
                error = psem_delete(pinfo);

-               _FREE(pinfo,M_SHM);
+               FREE(pinfo, M_SHM);
+       } else {
+               PSEM_SUBSYS_UNLOCK();

        }
        }

-       _FREE(pnode, M_SHM);
-       return (error);
+       /* subsystem lock is dropped when we get here */
+       FREE(pnode, M_SHM);
+       return error;

 }
 
 static int
 }
 
 static int

-psem_closefile(fp, p)
-       struct file *fp;
-       struct proc *p;
+psem_closefile(struct fileglob *fg, __unused vfs_context_t ctx)

 {
 {

+       int error;
+
+       /*
+        * Not locked as psem_close is called only from here and is locked
+        * properly
+        */
+       error =  psem_close(((struct psemnode *)fg->fg_data), fg->fg_flag);

 
 

-       return (psem_close(((struct psemnode *)fp->f_data), fp->f_flag,
-               fp->f_cred, p));
+       return error;

 }
 
 }
 

-int 
+static int

 psem_delete(struct pseminfo * pinfo)
 {
        kern_return_t kret;
 
        kret = semaphore_destroy(kernel_task, pinfo->psem_semobject);
 psem_delete(struct pseminfo * pinfo)
 {
        kern_return_t kret;
 
        kret = semaphore_destroy(kernel_task, pinfo->psem_semobject);

+#if CONFIG_MACF
+       mac_posixsem_label_destroy(pinfo);
+#endif

 
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:
 
        switch (kret) {
        case KERN_INVALID_ADDRESS:
        case KERN_PROTECTION_FAILURE:

-               return (EINVAL);
+               return EINVAL;

        case KERN_ABORTED:
        case KERN_OPERATION_TIMED_OUT:
        case KERN_ABORTED:
        case KERN_OPERATION_TIMED_OUT:

-               return (EINTR);
+               return EINTR;

        case KERN_SUCCESS:
        case KERN_SUCCESS:

-               return(0);
+               return 0;

        default:
        default:

-               return (EINVAL);
+               return EINVAL;

        }
 }
 
        }
 }
 

-static int
-psem_read(fp, uio, cred, flags, p)
-       struct file *fp;
-       struct uio *uio;
-       struct ucred *cred;
-       int flags;
-       struct proc *p;
+int
+fill_pseminfo(struct psemnode *pnode, struct psem_info * info)

 {
 {

-       return(EOPNOTSUPP);
-}
+       struct pseminfo *pinfo;
+       struct vinfo_stat  *sb;

 
 

-static int
-psem_write(fp, uio, cred, flags, p)
-       struct file *fp;
-       struct uio *uio;
-       struct ucred *cred;
-       int flags;
-       struct proc *p;
-{
-       return(EOPNOTSUPP);
-}
+       PSEM_SUBSYS_LOCK();
+       if ((pinfo = pnode->pinfo) == PSEMINFO_NULL) {
+               PSEM_SUBSYS_UNLOCK();
+               return EINVAL;
+       }

 
 

-static int
-psem_ioctl(fp, com, data, p)
-       struct file *fp;
-       u_long com;
-       caddr_t data;
-       struct proc *p;
-{
-       return(EOPNOTSUPP);
+#if 0
+       if ((pinfo->psem_flags & PSEM_ALLOCATED) != PSEM_ALLOCATED) {
+               PSEM_SUBSYS_UNLOCK();
+               return EINVAL;
+       }
+#endif
+
+       sb = &info->psem_stat;
+       bzero(sb, sizeof(struct vinfo_stat));
+
+       sb->vst_mode = pinfo->psem_mode;
+       sb->vst_uid = pinfo->psem_uid;
+       sb->vst_gid = pinfo->psem_gid;
+       sb->vst_size = pinfo->psem_usecount;
+       bcopy(&pinfo->psem_name[0], &info->psem_name[0], PSEMNAMLEN + 1);
+
+       PSEM_SUBSYS_UNLOCK();
+       return 0;

 }
 
 }
 

-static int
-psem_select(fp, which, wql, p)
-       struct file *fp;
-       int which;
-       void *wql;
-       struct proc *p;
+#if CONFIG_MACF
+void
+psem_label_associate(struct fileproc *fp, struct vnode *vp, vfs_context_t ctx)

 {
 {

-       return(EOPNOTSUPP);
+       struct psemnode *pnode;
+       struct pseminfo *psem;
+
+       PSEM_SUBSYS_LOCK();
+       pnode = (struct psemnode *)fp->f_fglob->fg_data;
+       if (pnode != NULL) {
+               psem = pnode->pinfo;
+               if (psem != NULL) {
+                       mac_posixsem_vnode_label_associate(
+                               vfs_context_ucred(ctx), psem, psem->psem_label,
+                               vp, vp->v_label);
+               }
+       }
+       PSEM_SUBSYS_UNLOCK();

 }
 }

+#endif