aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac
diff options
context:
space:
mode:
Diffstat (limited to 'sys/security/mac')
-rw-r--r--sys/security/mac/mac_framework.c50
-rw-r--r--sys/security/mac/mac_framework.h18
-rw-r--r--sys/security/mac/mac_internal.h50
-rw-r--r--sys/security/mac/mac_net.c50
-rw-r--r--sys/security/mac/mac_pipe.c50
-rw-r--r--sys/security/mac/mac_policy.h15
-rw-r--r--sys/security/mac/mac_process.c50
-rw-r--r--sys/security/mac/mac_syscalls.c50
-rw-r--r--sys/security/mac/mac_system.c50
-rw-r--r--sys/security/mac/mac_vfs.c50
10 files changed, 384 insertions, 49 deletions
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 3d73df4e7977..1f36d551fce8 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -181,19 +181,6 @@ int __mac_set_proc(struct mac *_mac_p);
#else /* _KERNEL */
/*
- * MAC entry point operations
- */
-enum mac_ep_ops {
- MAC_OP_VNODE_READ,
- MAC_OP_VNODE_WRITE,
- MAC_OP_VNODE_POLL,
- MAC_OP_PIPE_READ,
- MAC_OP_PIPE_WRITE,
- MAC_OP_PIPE_STAT,
- MAC_OP_PIPE_POLL
-};
-
-/*
* Kernel functions to manage and evaluate labels.
*/
struct bpf_d;
@@ -307,9 +294,12 @@ int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
int mac_check_cred_visible(struct ucred *u1, struct ucred *u2);
int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m);
int mac_check_mount_stat(struct ucred *cred, struct mount *mp);
-int mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op);
int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe,
unsigned long cmd, void *data);
+int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe);
+int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe);
+int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe);
+int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe);
int mac_check_proc_debug(struct ucred *cred, struct proc *proc);
int mac_check_proc_sched(struct ucred *cred, struct proc *proc);
int mac_check_proc_signal(struct ucred *cred, struct proc *proc,
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index 9bc28ad730cd..b3707c2b0340 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -233,11 +233,17 @@ struct mac_policy_ops {
struct label *mntlabel);
int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe,
struct label *pipelabel, unsigned long cmd, void *data);
- int (*mpo_check_pipe_op)(struct ucred *cred, struct pipe *pipe,
- struct label *pipelabel, int op);
+ int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe,
+ struct label *pipelabel);
+ int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe,
+ struct label *pipelabel);
int (*mpo_check_pipe_relabel)(struct ucred *cred,
struct pipe *pipe, struct label *pipelabel,
struct label *newlabel);
+ int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe,
+ struct label *pipelabel);
+ int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe,
+ struct label *pipelabel);
int (*mpo_check_proc_debug)(struct ucred *cred,
struct proc *proc);
int (*mpo_check_proc_sched)(struct ucred *cred,
@@ -408,8 +414,11 @@ enum mac_op_constant {
MAC_CHECK_IFNET_TRANSMIT,
MAC_CHECK_MOUNT_STAT,
MAC_CHECK_PIPE_IOCTL,
- MAC_CHECK_PIPE_OP,
+ MAC_CHECK_PIPE_POLL,
+ MAC_CHECK_PIPE_READ,
MAC_CHECK_PIPE_RELABEL,
+ MAC_CHECK_PIPE_STAT,
+ MAC_CHECK_PIPE_WRITE,
MAC_CHECK_PROC_DEBUG,
MAC_CHECK_PROC_SCHED,
MAC_CHECK_PROC_SIGNAL,
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index f8cb676afbb7..7bf73931f0ca 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -667,14 +667,26 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_check_pipe_ioctl =
mpe->mpe_function;
break;
- case MAC_CHECK_PIPE_OP:
- mpc->mpc_ops->mpo_check_pipe_op =
+ case MAC_CHECK_PIPE_POLL:
+ mpc->mpc_ops->mpo_check_pipe_poll =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_READ:
+ mpc->mpc_ops->mpo_check_pipe_read =
mpe->mpe_function;
break;
case MAC_CHECK_PIPE_RELABEL:
mpc->mpc_ops->mpo_check_pipe_relabel =
mpe->mpe_function;
break;
+ case MAC_CHECK_PIPE_STAT:
+ mpc->mpc_ops->mpo_check_pipe_stat =
+ mpe->mpe_function;
+ break;
+ case MAC_CHECK_PIPE_WRITE:
+ mpc->mpc_ops->mpo_check_pipe_write =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_PROC_DEBUG:
mpc->mpc_ops->mpo_check_proc_debug =
mpe->mpe_function;
@@ -2539,11 +2551,21 @@ mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
}
int
-mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
{
int error;
- MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+ MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
return (error);
}
@@ -2560,6 +2582,26 @@ mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
}
int
+mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
+mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
+{
+ int error;
+
+ MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
+
+ return (error);
+}
+
+int
mac_check_proc_debug(struct ucred *cred, struct proc *proc)
{
int error;
generated by cgit v1.3 (git 2.53.0) at 2026-07-31 07:58:19 +0000