3 files changed, 69 insertions, 0 deletions

diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 5e13434e5ecc..09e5c96c7885 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -86,6 +86,7 @@ struct thread;
 struct timespec;
 struct ucred;
 struct vattr;
+struct vfsconf;
 struct vfsoptlist;
 struct vnode;
 struct vop_setlabel_args;
@@ -248,6 +249,12 @@ int	mac_mount_check_stat(struct ucred *cred, struct mount *mp);
 void	mac_mount_create(struct ucred *cred, struct mount *mp);
 void	mac_mount_destroy(struct mount *);
 void	mac_mount_init(struct mount *);
+int	mac_mount_check_mount(struct ucred *cred, struct vnode *vp,
+	    struct vfsconf *, struct vfsoptlist **optlist, uint64_t fsflags);
+int	mac_mount_check_update(struct ucred *cred, struct mount *mp,
+	    struct vfsoptlist **optlist, uint64_t fsflags);
+int	mac_mount_check_unmount(struct ucred *cred, struct mount *mp,
+	    uint64_t flags);
 
 void	mac_netinet_arp_send(struct ifnet *ifp, struct mbuf *m);
 void	mac_netinet_firewall_reply(struct mbuf *mrecv, struct mbuf *msend);
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index a080d8cc4b8b..03c0ea2f8550 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -101,6 +101,7 @@ struct sysctl_req;
 struct thread;
 struct ucred;
 struct vattr;
+struct vfsconf;
 struct vfsoptlist;
 struct vnode;
 
@@ -295,6 +296,14 @@ typedef void	(*mpo_mount_create_t)(struct ucred *cred, struct mount *mp,
 		    struct label *mplabel);
 typedef void	(*mpo_mount_destroy_label_t)(struct label *label);
 typedef void	(*mpo_mount_init_label_t)(struct label *label);
+typedef int	(*mpo_mount_check_mount_t)(struct ucred *cred, struct vnode *vp,
+		    struct label *vplabel, struct vfsconf *vfsp,
+		    struct vfsoptlist **optlist, uint64_t fsflags);
+typedef int	(*mpo_mount_check_update_t)(struct ucred *cred,
+		    struct mount *mp, struct label *mplabel,
+		    struct vfsoptlist **optlist, uint64_t fsflags);
+typedef int	(*mpo_mount_check_unmount_t)(struct ucred *cred,
+		    struct mount *mp, struct label *mplabel, uint64_t flags);
 
 typedef void	(*mpo_netinet_arp_send_t)(struct ifnet *ifp,
 		    struct label *ifplabel, struct mbuf *m,
@@ -846,6 +855,9 @@ struct mac_policy_ops {
 	mpo_mount_create_t			mpo_mount_create;
 	mpo_mount_destroy_label_t		mpo_mount_destroy_label;
 	mpo_mount_init_label_t			mpo_mount_init_label;
+	mpo_mount_check_mount_t			mpo_mount_check_mount;
+	mpo_mount_check_update_t		mpo_mount_check_update;
+	mpo_mount_check_unmount_t		mpo_mount_check_unmount;
 
 	mpo_netinet_arp_send_t			mpo_netinet_arp_send;
 	mpo_netinet_firewall_reply_t		mpo_netinet_firewall_reply;
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index dc2bfa7c643b..2b88742c5c8e 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -123,6 +123,56 @@ mac_mount_init(struct mount *mp)
 		mp->mnt_label = NULL;
 }
 
+/*
+ * SDT doesn't have a PROBE7 version anymore, so we just drop the label.
+ */
+MAC_CHECK_PROBE_DEFINE5(mount_check_mount, "struct ucred *",
+    "struct vnode *", "struct vfsconf *",
+    "struct vfsoptlist **", "uint64_t");
+int
+mac_mount_check_mount(struct ucred *cred, struct vnode *vp,
+     struct vfsconf *vfsp, struct vfsoptlist **optlist, uint64_t fsflags)
+{
+	int error;
+
+	MAC_POLICY_CHECK(mount_check_mount, cred, vp, vp->v_label, vfsp,
+	    optlist, fsflags);
+	MAC_CHECK_PROBE5(mount_check_mount, error, cred, vp, vfsp, optlist,
+	    fsflags);
+
+	return (error);
+}
+
+MAC_CHECK_PROBE_DEFINE5(mount_check_update, "struct ucred *",
+    "struct mount *", "struct label *", "struct vfsoptlist **", "uint64_t");
+int
+mac_mount_check_update(struct ucred *cred, struct mount *mp,
+	    struct vfsoptlist **optlist, uint64_t fsflags)
+{
+	int error;
+
+	MAC_POLICY_CHECK(mount_check_update, cred, mp, mp->mnt_label,
+	    optlist, fsflags);
+	MAC_CHECK_PROBE5(mount_check_update, error, cred, mp, mp->mnt_label,
+	    optlist, fsflags);
+
+	return (error);
+}
+
+MAC_CHECK_PROBE_DEFINE4(mount_check_unmount, "struct ucred *",
+    "struct mount *", "struct label *", "uint64_t");
+int
+mac_mount_check_unmount(struct ucred *cred, struct mount *mp, uint64_t flags)
+{
+	int error;
+
+	MAC_POLICY_CHECK(mount_check_unmount, cred, mp, mp->mnt_label, flags);
+	MAC_CHECK_PROBE4(mount_check_unmount, error, cred, mp, mp->mnt_label,
+	    flags);
+
+	return (error);
+}
+
 struct label *
 mac_vnode_label_alloc(void)
 {