4 files changed, 157 insertions, 50 deletions

diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index ff4ca4ff1349..26508749917d 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -120,6 +120,21 @@ static int	mac_late = 0;
  */
 static int	ea_warn_once = 0;
 
+#ifndef MAC_ALWAYS_LABEL_MBUF
+/*
+ * Flag to indicate whether or not we should allocate label storage for
+ * new mbufs.  Since most dynamic policies we currently work with don't
+ * rely on mbuf labeling, try to avoid paying the cost of mtag allocation
+ * unless specifically notified of interest.  One result of this is
+ * that if a dynamically loaded policy requests mbuf labels, it must
+ * be able to deal with a NULL label being returned on any mbufs that
+ * were already in flight when the policy was loaded.  Since the policy
+ * already has to deal with uninitialized labels, this probably won't
+ * be a problem.  Note: currently no locking.  Will this be a problem?
+ */
+static int	mac_labelmbufs = 0;
+#endif
+
 static int	mac_enforce_fs = 1;
 SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
     &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
@@ -281,6 +296,12 @@ static int mac_policy_list_busy;
 		    &mac_policy_list_lock);				\
 } while (0)
 
+#define	MAC_POLICY_LIST_ASSERT_EXCLUSIVE() do {				\
+	mtx_assert(&mac_policy_list_lock, MA_OWNED);			\
+	KASSERT(mac_policy_list_busy == 0,				\
+	    ("MAC_POLICY_LIST_ASSERT_EXCLUSIVE()"));			\
+} while (0)
+
 #define	MAC_POLICY_LIST_BUSY() do {					\
 	MAC_POLICY_LIST_LOCK();						\
 	mac_policy_list_busy++;						\
@@ -464,6 +485,35 @@ mac_late_init(void)
 }
 
 /*
+ * After the policy list has changed, walk the list to update any global
+ * flags.
+ */
+static void
+mac_policy_updateflags(void)
+{
+	struct mac_policy_conf *tmpc;
+#ifndef MAC_ALWAYS_LABEL_MBUF
+	int labelmbufs;
+#endif
+
+	MAC_POLICY_LIST_ASSERT_EXCLUSIVE();
+
+#ifndef MAC_ALWAYS_LABEL_MBUF
+	labelmbufs = 0;
+#endif
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+#ifndef MAC_ALWAYS_LABEL_MBUF
+		if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
+			labelmbufs++;
+#endif
+	}
+
+#ifndef MAC_ALWAYS_LABEL_MBUF
+	mac_labelmbufs = (labelmbufs != 0);
+#endif
+}
+
+/*
  * Allow MAC policy modules to register during boot, etc.
  */
 int
@@ -530,6 +580,7 @@ mac_policy_register(struct mac_policy_conf *mpc)
 	/* Per-policy initialization. */
 	if (mpc->mpc_ops->mpo_init != NULL)
 		(*(mpc->mpc_ops->mpo_init))(mpc);
+	mac_policy_updateflags();
 	MAC_POLICY_LIST_UNLOCK();
 
 	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
@@ -574,7 +625,7 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 
 	LIST_REMOVE(mpc, mpc_list);
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
-
+	mac_policy_updateflags();
 	MAC_POLICY_LIST_UNLOCK();
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
@@ -623,9 +674,11 @@ error_select(int error1, int error2)
 static struct label *
 mbuf_to_label(struct mbuf *mbuf)
 {
+	struct m_tag *tag;
 	struct label *label;
 
-	label = &mbuf->m_pkthdr.label;
+	tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL);
+	label = (struct label *)(tag+1);
 
 	return (label);
 }
@@ -727,20 +780,20 @@ mac_init_ipq(struct ipq *ipq, int flag)
 }
 
 int
-mac_init_mbuf(struct mbuf *m, int flag)
+mac_init_mbuf_tag(struct m_tag *tag, int flag)
 {
-	int error;
-
-	M_ASSERTPKTHDR(m);
+	struct label *label;
+	int error, trflag;
 
-	mac_init_label(&m->m_pkthdr.label);
+	label = (struct label *) (tag + 1);
+	mac_init_label(label);
 
-	MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag);
+	trflag = (flag == M_DONTWAIT ? M_NOWAIT : M_WAITOK);
+	MAC_CHECK(init_mbuf_label, label, trflag);
 	if (error) {
-		MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label);
-		mac_destroy_label(&m->m_pkthdr.label);
+		MAC_PERFORM(destroy_mbuf_label, label);
+		mac_destroy_label(label);
 	}
-
 #ifdef MAC_DEBUG
 	if (error == 0)
 		atomic_add_int(&nmacmbufs, 1);
@@ -748,6 +801,37 @@ mac_init_mbuf(struct mbuf *m, int flag)
 	return (error);
 }
 
+int
+mac_init_mbuf(struct mbuf *m, int flag)
+{
+	struct m_tag *tag;
+	int error;
+
+	M_ASSERTPKTHDR(m);
+
+#ifndef MAC_ALWAYS_LABEL_MBUF
+	/*
+	 * Don't reserve space for labels on mbufs unless we have a policy
+	 * that uses the labels.
+	 */
+	if (mac_labelmbufs) {
+#endif
+		tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
+		    flag);
+		if (tag == NULL)
+			return (ENOMEM);
+		error = mac_init_mbuf_tag(tag, flag);
+		if (error) {
+			m_tag_free(tag);
+			return (error);
+		}
+		m_tag_prepend(m, tag);
+#ifndef MAC_ALWAYS_LABEL_MBUF
+	}
+#endif
+	return (0);
+}
+
 void
 mac_init_mount(struct mount *mp)
 {
@@ -935,11 +1019,14 @@ mac_destroy_ipq(struct ipq *ipq)
 }
 
 void
-mac_destroy_mbuf(struct mbuf *m)
+mac_destroy_mbuf_tag(struct m_tag *tag)
 {
+	struct label *label;
 
-	MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label);
-	mac_destroy_label(&m->m_pkthdr.label);
+	label = (struct label *)(tag+1);
+
+	MAC_PERFORM(destroy_mbuf_label, label);
+	mac_destroy_label(label);
 #ifdef MAC_DEBUG
 	atomic_subtract_int(&nmacmbufs, 1);
 #endif
@@ -1033,6 +1120,21 @@ mac_destroy_vnode(struct vnode *vp)
 	mac_destroy_vnode_label(&vp->v_label);
 }
 
+void
+mac_copy_mbuf_tag(struct m_tag *src, struct m_tag *dest)
+{
+	struct label *src_label, *dest_label;
+
+	src_label = (struct label *)(src+1);
+	dest_label = (struct label *)(dest+1);
+
+	/*
+	 * mac_init_mbuf_tag() is called on the target tag in
+	 * m_tag_copy(), so we don't need to call it here.
+	 */
+	MAC_PERFORM(copy_mbuf_label, src_label, dest_label);
+}
+
 static void
 mac_copy_pipe_label(struct label *src, struct label *dest)
 {
@@ -2318,13 +2420,12 @@ mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
 	struct label *label;
 	int error;
 
+	M_ASSERTPKTHDR(mbuf);
+
 	if (!mac_enforce_network)
 		return (0);
 
-	M_ASSERTPKTHDR(mbuf);
 	label = mbuf_to_label(mbuf);
-	if (!(label->l_flags & MAC_FLAG_INITIALIZED))
-		if_printf(ifnet, "not initialized\n");
 
 	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
 	    label);
diff --git a/sys/kern/subr_mbuf.c b/sys/kern/subr_mbuf.c
index 123553bc53dd..ff226e7a79e0 100644
--- a/sys/kern/subr_mbuf.c
+++ b/sys/kern/subr_mbuf.c
@@ -1305,9 +1305,9 @@ m_gethdr(int how, short type)
 	if (mb != NULL) {
 		_mbhdr_setup(mb, type);
 #ifdef MAC
-		if (mac_init_mbuf(mb, how) != 0) {
+		if (mac_init_mbuf(mb, MBTOM(how)) != 0) {
 			m_free(mb);
-			return NULL;
+			return (NULL);
 		}
 #endif
 	}
@@ -1354,9 +1354,9 @@ m_gethdr_clrd(int how, short type)
 	if (mb != NULL) {
 		_mbhdr_setup(mb, type);
 #ifdef MAC
-		if (mac_init_mbuf(mb, how) != 0) {
+		if (mac_init_mbuf(mb, MBTOM(how)) != 0) {
 			m_free(mb);
-			return NULL;
+			return (NULL);
 		}
 #endif
 		bzero(mtod(mb, caddr_t), MHLEN);
@@ -1382,11 +1382,6 @@ m_free(struct mbuf *mb)
 
 	if ((mb->m_flags & M_PKTHDR) != 0)
 		m_tag_delete_chain(mb, NULL);
-#ifdef MAC
-	if ((mb->m_flags & M_PKTHDR) &&
-	    (mb->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
-		mac_destroy_mbuf(mb);
-#endif
 	nb = mb->m_next;
 	if ((mb->m_flags & M_EXT) != 0) {
 		MEXT_REM_REF(mb);
@@ -1429,11 +1424,6 @@ m_freem(struct mbuf *mb)
 	while (mb != NULL) {
 		if ((mb->m_flags & M_PKTHDR) != 0)
 			m_tag_delete_chain(mb, NULL);
-#ifdef MAC
-		if ((mb->m_flags & M_PKTHDR) &&
-		    (mb->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
-			mac_destroy_mbuf(mb);
-#endif
 		persist = 0;
 		m = mb;
 		mb = mb->m_next;
@@ -1501,9 +1491,11 @@ m_getcl(int how, short type, int flags)
 		_mext_init_ref(mb, &cl_refcntmap[cl2ref(mb->m_ext.ext_buf)]);
 	}
 #ifdef MAC
-	if ((flags & M_PKTHDR) && (mac_init_mbuf(mb, how) != 0)) {
-		m_free(mb);
-		return NULL;
+	if (flags & M_PKTHDR) {
+		if (mac_init_mbuf(mb, MBTOM(how)) != 0) {
+			m_free(mb);
+			return (NULL);
+		}
 	}
 #endif
 	return (mb);
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index 55d828df28ee..08a7246409ef 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -88,21 +88,21 @@ m_move_pkthdr(struct mbuf *to, struct mbuf *from)
 #if 0
 	/* see below for why these are not enabled */
 	M_ASSERTPKTHDR(to);
+	/* Note: with MAC, this may not be a good assertion. */
 	KASSERT(SLIST_EMPTY(&to->m_pkthdr.tags),
 	    ("m_move_pkthdr: to has tags"));
 #endif
 	KASSERT((to->m_flags & M_EXT) == 0, ("m_move_pkthdr: to has cluster"));
 #ifdef MAC
+	/*
+	 * XXXMAC: It could be this should also occur for non-MAC?
+	 */
 	if (to->m_flags & M_PKTHDR)
-		mac_destroy_mbuf(to);
+		m_tag_delete_chain(to, NULL);
 #endif
 	to->m_flags = from->m_flags & M_COPYFLAGS;
 	to->m_data = to->m_pktdat;
 	to->m_pkthdr = from->m_pkthdr;		/* especially tags */
-#ifdef MAC
-	mac_init_mbuf(to, 1);			/* XXXMAC no way to fail */
-	mac_create_mbuf_from_mbuf(from, to);
-#endif
 	SLIST_INIT(&from->m_pkthdr.tags);	/* purge tags from src */
 	from->m_flags &= ~M_PKTHDR;
 }
@@ -125,20 +125,17 @@ m_dup_pkthdr(struct mbuf *to, struct mbuf *from, int how)
 	 * assertions to trip.  For now just disable them.
 	 */
 	M_ASSERTPKTHDR(to);
+	/* Note: with MAC, this may not be a good assertion. */
 	KASSERT(SLIST_EMPTY(&to->m_pkthdr.tags), ("m_dup_pkthdr: to has tags"));
 #endif
 #ifdef MAC
 	if (to->m_flags & M_PKTHDR)
-		mac_destroy_mbuf(to);
+		m_tag_delete_chain(to, NULL);
 #endif
 	to->m_flags = (from->m_flags & M_COPYFLAGS) | (to->m_flags & M_EXT);
 	if ((to->m_flags & M_EXT) == 0)
 		to->m_data = to->m_pktdat;
 	to->m_pkthdr = from->m_pkthdr;
-#ifdef MAC
-	mac_init_mbuf(to, 1);			/* XXXMAC no way to fail */
-	mac_create_mbuf_from_mbuf(from, to);
-#endif
 	SLIST_INIT(&to->m_pkthdr.tags);
 	return (m_tag_copy_chain(to, from, MBTOM(how)));
 }
@@ -158,12 +155,8 @@ m_prepend(struct mbuf *m, int len, int how)
 		m_freem(m);
 		return (NULL);
 	}
-	if (m->m_flags & M_PKTHDR) {
+	if (m->m_flags & M_PKTHDR)
 		M_MOVE_PKTHDR(mn, m);
-#ifdef MAC
-		mac_destroy_mbuf(m);
-#endif
-	}
 	mn->m_next = m;
 	m = mn;
 	if (len < MHLEN)
diff --git a/sys/kern/uipc_mbuf2.c b/sys/kern/uipc_mbuf2.c
index 50b37f54ec44..000bb243db41 100644
--- a/sys/kern/uipc_mbuf2.c
+++ b/sys/kern/uipc_mbuf2.c
@@ -68,10 +68,13 @@
 
 /*#define PULLDOWN_DEBUG*/
 
+#include "opt_mac.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
+#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/mutex.h>
@@ -327,6 +330,10 @@ m_tag_alloc(u_int32_t cookie, int type, int len, int wait)
 void
 m_tag_free(struct m_tag *t)
 {
+#ifdef MAC
+	if (t->m_tag_id == PACKET_TAG_MACLABEL)
+		mac_destroy_mbuf_tag(t);
+#endif
 	free(t, M_PACKET_TAGS);
 }
 
@@ -402,7 +409,21 @@ m_tag_copy(struct m_tag *t, int how)
 	p = m_tag_alloc(t->m_tag_cookie, t->m_tag_id, t->m_tag_len, how);
 	if (p == NULL)
 		return (NULL);
-	bcopy(t + 1, p + 1, t->m_tag_len); /* Copy the data */
+#ifdef MAC
+	/*
+	 * XXXMAC: we should probably pass off the initialization, and
+	 * copying here?  can we hide that PACKET_TAG_MACLABEL is
+	 * special from the mbuf code?
+	 */
+	if (t->m_tag_id == PACKET_TAG_MACLABEL) {
+		if (mac_init_mbuf_tag(p, how) != 0) {
+			m_tag_free(p);
+			return (NULL);
+		}
+		mac_copy_mbuf_tag(t, p);
+	} else
+#endif
+		bcopy(t + 1, p + 1, t->m_tag_len); /* Copy the data */
 	return p;
 }