6.7 MAC²ßÂÔÈë¿Úº¯Êý²Î¿¼

6.7.1 ͨÓõÄÄ£¿éÈë¿Úº¯Êý

6.7.1.1 mpo_init

void mpo_init(struct mac_policy_conf *conf);

²ÎÊý ˵Ã÷ Ëø¶¨
conf MAC ²ßÂÔ¶¨Òå  

¡¡¡¡²ßÂÔ¼ÓÔØÊ¼þ¡£µ±Ç°½ø³ÌÕý³ÖÓвßÂÔÁ´±íÉϵĻ¥³âËø£¬Òò´ËÊÇ·Ç˯Ãߵģ¬¶ÔÆäËûÄÚºË×ÓϵͳµÄµ÷ÓÃÒ²ÐëÉ÷ÖØ¡£ Èç¹ûÐèÒªÔÚ²ßÂÔ³õʼ»¯½×¶Î½øÐпÉÄÜÔì³É˯Ãß×èÈûµÄ´æ´¢·ÖÅä²Ù×÷£¬¿ÉÒÔ½«ËüÃÇ·ÅÔÚÒ»¸öµ¥¶ÀµÄÄ£¿é SYSINIT() ¹ý³ÌÖм¯ÖнøÐС£

6.7.1.2 mpo_destroy

void mpo_destroy(struct mac_policy_conf *conf);

²ÎÊý ˵Ã÷ Ëø¶¨
conf MAC ²ßÂÔ¶¨Òå  

¡¡¡¡²ßÂÔ¼ÓÔØÊ¼þ¡£±ØÐë³ÖÓвßÂÔÁ´±í»¥³âËø£¬Òò´ËÐèÒªÉ÷ÖØÐÐÊ¡£

6.7.1.3 mpo_syscall

int mpo_syscall(struct thread *td, int call, void *arg);

²ÎÊý ˵Ã÷ Ëø¶¨
td µ÷ÓÃÏß³Ì  
call ²ßÂÔÌØÓеÄϵͳµ÷ÓñàºÅ  
arg ϵͳµ÷ÓòÎÊýµÄÖ¸Õë  

¡¡¡¡¸ÃÈë¿Úº¯ÊýÌṩ²ßÂÔ¸´ÓõÄϵͳµ÷Óã¬ÕâÑù²ßÂÔÄ£¿é²»ÐèҪΪÆäÏòÓû§½ø³ÌÌṩµÄÿһ¸ö¶îÍâ·þÎñ¶ø×¢²áרÓõÄϵͳµ÷ÓᣠÓÉÓ¦ÓóÌÐòÌṩµÄ²ßÂÔ×¢²áÃû×ÖÀ´È·¶¨ÌṩÆäËùÉêÇë·þÎñµÄÌØ¶¨²ßÂÔ£¬ËùÓвÎÊý½«Í¨¹ý¸ÃÈë¿Úº¯Êý´«µÝ¸ø±»µ÷ÓõIJßÂÔ¡£ µ±ÊµÏÖзþÎñʱ£¬°²È«Ä£¿é±ØÐëÔÚ±ØÒªÊ±Í¨¹ý MAC ¿ò¼Üµ÷ÓÃÏàÓ¦µÄ·ÃÎÊ¿ØÖƼì²é»úÖÆ¡£ ±È·½Ëµ£¬¼ÙÈçÒ»¸ö²ßÂÔʵÏÖÁËijÖÖ¶îÍâµÄÐźŹ¦ÄÜ£¬ÄÇôËüÓ¦¸Ãµ÷ÓÃÏà¹ØµÄÐźŷÃÎÊ¿ØÖƼì²é£¬ÒÔ½ÓÊÜ MAC ¿ò¼ÜÖÐ×¢²áµÄÆäËû²ßÂԵļì²é¡£

×¢Òâ: ²»Í¬µÄÄ£¿éÐèÒª²¢·¢µØÊÖ¶¯½øÐÐcopyin()¿½±´ÏµÍ³µ÷ÓÃÊý¾Ý¡£

6.7.1.4 mpo_thread_userret

void mpo_thread_userret(struct thread *td);

²ÎÊý ˵Ã÷ Ëø¶¨
td ·µ»ØÏß³Ì  

¡¡¡¡Ê¹ÓøÃÈë¿Úº¯Êý£¬²ßÂÔÄ£¿éÄܹ»ÔÚÏ̷߳µ»ØÓû§¿Õ¼äʱ£¨ÏµÍ³µ÷Ó÷µ»Ø¡¢Òì³£·µ»ØµÈµÈ£©½øÐÐ MAC Ïà¹ØµÄ´¦Àí¹¤×÷¡£ ʹÓö¯Ì¬½ø³Ì±ê¼ÇµÄ²ßÂÔÐèҪʹÓøÃÈë¿Úº¯Êý£¬ÒòΪÔÚ´¦Àíϵͳµ÷ÓõĹý³ÌÖУ¬²¢²»ÊÇÔÚÈÎÒâʱ¿Ì¶¼ÄÜÉêÇëµ½½ø³ÌËøµÄ£» ½ø³ÌµÄ±ê¼Ç¿ÉÄܱíʾ´«Í³µÄÈÏÖ¤ÐÅÏ¢¡¢½ø³ÌÀúÊ·¼Ç¼»òÕ߯äËûÊý¾Ý¡£ÎªÊ¹ÓøÃÈë¿Úº¯Êý£¬¶Ô½ø³ÌÐÅÈÎ×´Ëù×÷µÄÐÞ¸Ä ¿ÉÄܱ»´æ·ÅÔÚ p_label ,¸ÃÓòÊÜÒ»¸ö½ø³Ì¼¶×ÔÐýËøµÄ±£»¤£»½ÓÏÂÀ´£¬ÉèÖÃÏ̼߳¶µÄTDF_ASTPENDING ±ê־λºÍ½ø³Ì¼¶µÄPS_MACPENDM±ê־룬±íÃ÷½«µ÷¶ÈÒ»¸ö¶Ô userret Èë¿Úº¯ÊýµÄµ÷Óá£Í¨¹ý¸ÃÈë¿Úº¯Êý£¬ ²ßÂÔ¿ÉÒÔÔÚÏà¶Ô¼òµ¥µÄͬ²½ÉÏÏÂÎÄÖд´½¨ÐÅÈÎ×´µÄÌæ´úÆ·¡£²ßÂÔ±à³ÌÈËÔ±±ØÐëÇå³þ£¬ÐèÒª±£Ö¤Óëµ÷¶ÈÒ»¸ö AST Ïà¹ØµÄʼþÖ´ÐдÎÐò£¬ ͬʱËùÖ´ÐÐµÄ AST ¿ÉÄܸܺ´ÔÓ£¬¶øÇÒÔÚ´¦Àí¶àÏß³ÌÓ¦ÓóÌÐòʱ¿ÉÄܱ»ÖØÈë¡£

6.7.2 ²Ù×÷±ê¼Ç

6.7.2.1 mpo_init_bpfdesc_label

void mpo_init_bpfdesc_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ó¦ÓõÄбê¼Ç  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄ bpfdesc£¨BPF ÃèÊö×Ó£©³õʼ»¯±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.2 mpo_init_cred_label

void mpo_init_cred_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»³õʼ»¯µÄбê¼Ç  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄÓû§ÐÅÈÎ×´³õʼ»¯±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.3 mpo_init_devfsdirent_label

void mpo_init_devfsdirent_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ó¦ÓõÄбê¼Ç  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄ devfs¡¡±íÏî³õʼ»¯±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.4 mpo_init_ifnet_label

void mpo_init_ifnet_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ó¦ÓõÄбê¼Ç  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄÍøÂç½Ó¿Ú³õʼ»¯±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.5 mpo_init_ipq_label

void mpo_init_ipq_label(struct label *label, int flag);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ó¦ÓõÄбê¼Ç  
flag ˯Ãß/²»Ë¯Ãß malloc(9); ²Î¼ûÏÂÎÄ  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄ IP ·ÖÆ¬ÖØ×é¶ÓÁгõʼ»¯±ê¼Ç¡£ÆäÖеÄflagÓò¿ÉÄÜÈ¡M_WAITOK »òM_NOWAITÖ®Ò»£¬ÓÃÀ´±ÜÃâÔڸóõʼ»¯µ÷ÓÃÖÐÒòΪ malloc(9) ¶ø½øÈë˯Ãß¡£IP ·ÖÆ¬ÖØ×é¶ÓÁеķÖÅä²Ù×÷ͨ³£ÊÇÔÚ ¶ÔÐÔÄÜÓÐÑϸñÒªÇóµÄ»·¾³Ï½øÐеģ¬Òò´ËʵÏÖ´úÂë±ØÐëСÐĵرÜÃâ˯Ãߺͳ¤Ê±¼äµÄ²Ù×÷¡£IP ·ÖÆ¬ÖØ×é¶ÓÁзÖÅä²Ù×÷ʧ°ÜʱÉÏÊöÈë¿Úº¯Êý½«Ê§°Ü·µ»Ø¡£

6.7.2.6 mpo_init_mbuf_label

void mpo_init_mbuf_label(int flag, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
flag ˯Ãß/²»Ë¯Ãß malloc(9); ²Î¼ûÏÂÎÄ  
label ½«±»³õʼ»¯µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄ mbuf Êý¾Ý°üÍ·²¿£¨mbuf£©³õʼ»¯±ê¼Ç¡£ ÆäÖеÄflagµÄÖµ¿ÉÄÜÈ¡M_WAITOKºÍM_NOWAITÖ®Ò»£¬ ÓÃÀ´±ÜÃâÔڸóõʼ»¯µ÷ÓÃÖÐÒòΪ malloc(9) ¶ø½øÈë˯Ãß¡£Mbuf Í·²¿µÄ·ÖÅä²Ù×÷³£³£ÔÚ¶ÔÐÔÄÜÓÐÑϸñÒªÇóµÄ»·¾³Ï±»Æµ·±Ö´ÐУ¬ Òò´ËʵÏÖ´úÂë±ØÐëСÐĵرÜÃâ˯Ãߺͳ¤Ê±¼äµÄ²Ù×÷¡£ÉÏÊöÈë¿Úº¯ÊýÔÚ Mbuf Í·²¿·ÖÅä²Ù×÷ʧ°Üʱ½«Ê§°Ü·µ»Ø¡£

6.7.2.7 mpo_init_mount_label

void mpo_init_mount_label(struct label *mntlabel, struct label *fslabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mntlabel ½«±»³õʼ»¯µÄmount ½á¹¹²ßÂÔ±ê¼Ç  
fslabel ½«±»³õʼ»¯µÄÎļþϵͳ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÒ»¸öнüʵÀý»¯µÄ mount µã³õʼ»¯±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.8 mpo_init_mount_fs_label

void mpo_init_mount_fs_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»³õʼ»¯µÄ±ê¼Ç  

¡¡¡¡ÎªÒ»¸öнü¼ÓÔØµÄÎļþϵͳ³õʼ»¯±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.9 mpo_init_pipe_label

void mpo_init_pipe_label(struct label*label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»ÌîдµÄ±ê¼Ç  

¡¡¡¡ÎªÒ»¸ö¸Õ¸ÕʵÀý»¯µÄ¹ÜµÀ³õʼ»¯°²È«±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.10 mpo_init_socket_label

void mpo_init_socket_label(struct label *label, int flag);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»³õʼ»¯µÄбê¼Ç  
flag malloc(9) flags  

¡¡¡¡ÎªÒ»¸ö¸Õ¸ÕʵÀý»¯µÄÌ×½Ó×Ö³õʼ»¯°²È«±ê¼Ç¡£ÆäÖÐµÄ flag ÓòµÄÖµ±ØÐë±»Ö¸¶¨Îª M_WAITOKºÍM_NOWAITÖ®Ò»£¬ÒÔ±ÜÃâÔڸóõʼ»¯³ÌÖÐʹÓÿÉÄÜ˯ÃßµÄmalloc(9) ¡£

6.7.2.11 mpo_init_socket_peer_label

void mpo_init_socket_peer_label(struct label *label, int flag);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»³õʼ»¯µÄбê¼Ç  
flag malloc(9) flags  

¡¡¡¡Îª¸Õ¸ÕʵÀý»¯µÄÌ×½Ó×Ö¶ÔµÈÌå½øÐбê¼ÇµÄ³õʼ»¯¡£ÆäÖÐµÄ flag ÓòµÄÖµ±ØÐë±»Ö¸¶¨Îª M_WAITOK ºÍ M_NOWAIT Ö®Ò»£¬ÒÔ±ÜÃâÔڸóõʼ»¯³ÌÖÐʹÓÿÉÄÜ˯ÃßµÄ malloc(9)¡£

6.7.2.12 mpo_init_proc_label

void mpo_init_proc_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»³õʼ»¯µÄбê¼Ç  

¡¡¡¡ÎªÒ»¸ö¸Õ¸ÕʵÀý»¯µÄ½ø³Ì³õʼ»¯°²È«±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.13 mpo_init_vnode_label

void mpo_init_vnode_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»³õʼ»¯µÄбê¼Ç  

¡¡¡¡ÎªÒ»¸ö¸Õ¸ÕʵÀý»¯µÄ vnode ³õʼ»¯°²È«±ê¼Ç¡£¿ÉÒÔ˯Ãß¡£

6.7.2.14 mpo_destroy_bpfdesc_label

void mpo_destroy_bpfdesc_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label bpfdesc ±ê¼Ç  

¡¡¡¡Ïú»ÙÒ»¸ö BPF ÃèÊö×ÓÉϵıê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäÓë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.15 mpo_destroy_cred_label

void mpo_destroy_cred_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄ±ê¼Ç  

¡¡¡¡Ïú»ÙÒ»¸öÐÅÈÎ×´Éϵıê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄÓë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.16 mpo_destroy_devfsdirent_label

void mpo_destroy_devfsdirent_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄ±ê¼Ç  

¡¡¡¡Ïú»ÙÒ»¸ö devfs ±íÏîÉϵıê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄÓë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.17 mpo_destroy_ifnet_label

void mpo_destroy_ifnet_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄ±ê¼Ç  

¡¡¡¡Ïú»ÙÓëÒ»¸öÒÑɾ³ý½Ó¿ÚÏà¹ØÁªµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄÓë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.18 mpo_destroy_ipq_label

void mpo_destroy_ipq_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄ±ê¼Ç  

¡¡¡¡Ïú»ÙÓëÒ»¸ö IP ·ÖƬ¶ÓÁÐÏà¹ØÁªµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄÓë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.19 mpo_destroy_mbuf_label

void mpo_destroy_mbuf_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄ±ê¼Ç  

¡¡¡¡Ïú»ÙÓëÒ»¸ö Mbuf Ïà¹ØÁªµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄÓë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.20 mpo_destroy_mount_label

void mpo_destroy_mount_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄ Mount µã±ê¼Ç  

¡¡¡¡Ïú»ÙÓëÒ»¸ö mount µãÏà¹ØÁªµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄÓë mntlabel Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.21 mpo_destroy_mount_label

void mpo_destroy_mount_label(struct label *mntlabel, struct label *fslabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mntlabel ½«±»Ïú»ÙµÄ Mount µã±ê¼Ç  
fslabel File system label being destroyed>  

¡¡¡¡Ïú»ÙÓëÒ»¸ö mount µãÏà¹ØÁªµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄ£¬Óë mntlabel ºÍfslabel Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.22 mpo_destroy_socket_label

void mpo_destroy_socket_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ïú»ÙµÄÌ×½Ó×Ö±ê¼Ç  

¡¡¡¡Ïú»ÙÓëÒ»¸öÌ×½Ó×ÖÏà¹ØÁªµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄ£¬Óë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.23 mpo_destroy_socket_peer_label

void mpo_destroy_socket_peer_label(struct label *peerlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
peerlabel ½«±»Ïú»ÙµÄÌ×½Ó×Ö¶ÔµÈʵÌå±ê¼Ç  

¡¡¡¡Ïú»ÙÓëÒ»¸öÌ×½Ó×ÖÏà¹ØÁªµÄ¶ÔµÈʵÌå±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄ£¬Óë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.24 mpo_destroy_pipe_label

void mpo_destroy_pipe_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ¹ÜµÀ±ê¼Ç  

¡¡¡¡Ïú»ÙÒ»¸ö¹ÜµÀµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄ£¬Óë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.25 mpo_destroy_proc_label

void mpo_destroy_proc_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½ø³Ì±ê¼Ç  

¡¡¡¡Ïú»ÙÒ»¸ö½ø³ÌµÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄ£¬Óë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.26 mpo_destroy_vnode_label

void mpo_destroy_vnode_label(struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½ø³Ì±ê¼Ç  

¡¡¡¡Ïú»ÙÒ»¸ö vnode µÄ±ê¼Ç¡£ÔÚ¸ÃÈë¿Úº¯ÊýÖУ¬²ßÂÔÓ¦µ±ÊÍ·ÅËùÓÐÔÚÄÚ²¿·ÖÅäµÄ£¬Óë label Ïà¹ØÁªµÄ´æ´¢¿Õ¼ä£¬ÒÔ±ãÏú»Ù¸Ã±ê¼Ç¡£

6.7.2.27 mpo_copy_mbuf_label

void mpo_copy_mbuf_label(struct label *src, struct label *dest);

²ÎÊý ˵Ã÷ Ëø¶¨
src Ô´±ê¼Ç  
dest Ä¿±ê±ê¼Ç  

¡¡¡¡½« src Öеıê¼ÇÐÅÏ¢¿½±´µ½ destÖС£

6.7.2.28 mpo_copy_pipe_label

void mpo_copy_pipe_label(struct label *src, struct label *dest);

²ÎÊý ˵Ã÷ Ëø¶¨
src Ô´±ê¼Ç  
dest Ä¿±ê±ê¼Ç  

¡¡¡¡½« src Öеıê¼ÇÐÅÏ¢¿½±´ÖÁ dest¡£

6.7.2.29 mpo_copy_vnode_label

void mpo_copy_vnode_label(struct label *src, struct label *dest);

²ÎÊý ˵Ã÷ Ëø¶¨
src Ô´±ê¼Ç  
dest Ä¿±ê±ê¼Ç  

¡¡¡¡½« src Öеıê¼ÇÐÅÏ¢¿½±´ÖÁ dest¡£

6.7.2.30 mpo_externalize_cred_label

int mpo_externalize_cred_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«ÓÃÍⲿÐÎʽ±íʾµÄ±ê¼Ç  
element_name ÐèÒªÍⲿ±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
sb ÓÃÀ´´æ·Å±ê¼ÇµÄÎı¾±íʾÐÎʽµÄ×Ö·ûbuffer  
claimed Èç¹û¿ÉÒÔÌî³äelement_data Óò£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç½á¹¹£¬²úÉúÒ»¸öÒÔÍⲿÐÎʽ±íʾµÄ±ê¼Ç¡£ Ò»¸öÍⲿÐÎʽ±ê¼Ç£¬ÊDZê¼ÇÄÚÈݵÄÎı¾±íʾ£¬ËüÓÉÓû§¼¶µÄÓ¦ÓóÌÐòʹÓã¬ÊÇÓû§¿É¶ÁµÄ¡£ ĿǰµÄMACʵÏÖ·½°¸½«ÒÀ´Îµ÷ÓòßÂÔµÄÏàÓ¦Èë¿Úº¯Êý£¬Òò´Ë£¬ ¾ßÌå²ßÂÔµÄʵÏÖ´úÂ룬ÐèÒªÔÚÌîдsb֮ǰ£¬Ïȼì²éelement_nameÖÐÖ¸¶¨µÄÃû×Ö¡£ Èç¹ûelement_nameÖеÄÄÚÈÝÓëÄãµÄ²ßÂÔÃû×Ö²»Ïà·û£¬ÔòÖ±½Ó·µ»Ø0¡£ ½öµ±×ª»»±ê¼ÇÊý¾ÝµÄ¹ý³ÌÖгöÏÖ´íÎóʱ£¬²Å·µ»Ø·Ç0Öµ¡£ Ò»µ©²ßÂÔ¾ö¶¨Ìîдelement_data£¬µÝÔö*claimµÄÊýÖµ¡£

6.7.2.31 mpo_externalize_ifnet_label

int mpo_externalize_ifnet_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«ÓÃÍⲿÐÎʽ±íʾµÄ±ê¼Ç  
element_name ÐèÒªÍⲿ±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
sb ÓÃÀ´´æ·Å±ê¼ÇµÄÎı¾±íʾÐÎʽµÄ×Ö·ûbuffer  
claimed Èç¹û¿ÉÒÔÌî³äelement_data Óò£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç½á¹¹£¬²úÉúÒ»¸öÒÔÍⲿÐÎʽ±íʾµÄ±ê¼Ç¡£ Ò»¸öÍⲿÐÎʽ±ê¼Ç£¬ÊDZê¼ÇÄÚÈݵÄÎı¾±íʾ£¬ËüÓÉÓû§¼¶µÄÓ¦ÓóÌÐòʹÓã¬ÊÇÓû§¿É¶ÁµÄ¡£ ĿǰµÄMACʵÏÖ·½°¸½«ÒÀ´Îµ÷ÓòßÂÔµÄÏàÓ¦Èë¿Úº¯Êý£¬Òò´Ë£¬ ¾ßÌå²ßÂÔµÄʵÏÖ´úÂ룬ÐèÒªÔÚÌîдsb֮ǰ£¬Ïȼì²éelement_nameÖÐÖ¸¶¨µÄÃû×Ö¡£ Èç¹ûelement_nameÖеÄÄÚÈÝÓëÄãµÄ²ßÂÔÃû×Ö²»Ïà·û£¬ÔòÖ±½Ó·µ»Ø0¡£ ½öµ±×ª»»±ê¼ÇÊý¾ÝµÄ¹ý³ÌÖгöÏÖ´íÎóʱ£¬²Å·µ»Ø·Ç0Öµ¡£ Ò»µ©²ßÂÔ¾ö¶¨Ìîдelement_data£¬µÝÔö*claimµÄÊýÖµ¡£

6.7.2.32 mpo_externalize_pipe_label

int mpo_externalize_pipe_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«ÓÃÍⲿÐÎʽ±íʾµÄ±ê¼Ç  
element_name ÐèÒªÍⲿ±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
sb ÓÃÀ´´æ·Å±ê¼ÇµÄÎı¾±íʾÐÎʽµÄ×Ö·ûbuffer  
claimed Èç¹û¿ÉÒÔÌî³äelement_data Óò£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç½á¹¹£¬²úÉúÒ»¸öÒÔÍⲿÐÎʽ±íʾµÄ±ê¼Ç¡£ Ò»¸öÍⲿÐÎʽ±ê¼Ç£¬ÊDZê¼ÇÄÚÈݵÄÎı¾±íʾ£¬ËüÓÉÓû§¼¶µÄÓ¦ÓóÌÐòʹÓã¬ÊÇÓû§¿É¶ÁµÄ¡£ ĿǰµÄMACʵÏÖ·½°¸½«ÒÀ´Îµ÷ÓòßÂÔµÄÏàÓ¦Èë¿Úº¯Êý£¬Òò´Ë£¬ ¾ßÌå²ßÂÔµÄʵÏÖ´úÂ룬ÐèÒªÔÚÌîдsb֮ǰ£¬Ïȼì²éelement_nameÖÐÖ¸¶¨µÄÃû×Ö¡£ Èç¹ûelement_nameÖеÄÄÚÈÝÓëÄãµÄ²ßÂÔÃû×Ö²»Ïà·û£¬ÔòÖ±½Ó·µ»Ø0¡£ ½öµ±×ª»»±ê¼ÇÊý¾ÝµÄ¹ý³ÌÖгöÏÖ´íÎóʱ£¬²Å·µ»Ø·Ç0Öµ¡£ Ò»µ©²ßÂÔ¾ö¶¨Ìîдelement_data£¬µÝÔö*claimµÄÊýÖµ¡£

6.7.2.33 mpo_externalize_socket_label

int mpo_externalize_socket_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«ÓÃÍⲿÐÎʽ±íʾµÄ±ê¼Ç  
element_name ÐèÒªÍⲿ±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
sb ÓÃÀ´´æ·Å±ê¼ÇµÄÎı¾±íʾÐÎʽµÄ×Ö·ûbuffer  
claimed Èç¹û¿ÉÒÔÌî³äelement_data Óò£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç½á¹¹£¬²úÉúÒ»¸öÒÔÍⲿÐÎʽ±íʾµÄ±ê¼Ç¡£ Ò»¸öÍⲿÐÎʽ±ê¼Ç£¬ÊDZê¼ÇÄÚÈݵÄÎı¾±íʾ£¬ËüÓÉÓû§¼¶µÄÓ¦ÓóÌÐòʹÓã¬ÊÇÓû§¿É¶ÁµÄ¡£ ĿǰµÄMACʵÏÖ·½°¸½«ÒÀ´Îµ÷ÓòßÂÔµÄÏàÓ¦Èë¿Úº¯Êý£¬Òò´Ë£¬ ¾ßÌå²ßÂÔµÄʵÏÖ´úÂ룬ÐèÒªÔÚÌîдsb֮ǰ£¬Ïȼì²éelement_nameÖÐÖ¸¶¨µÄÃû×Ö¡£ Èç¹ûelement_nameÖеÄÄÚÈÝÓëÄãµÄ²ßÂÔÃû×Ö²»Ïà·û£¬ÔòÖ±½Ó·µ»Ø0¡£ ½öµ±×ª»»±ê¼ÇÊý¾ÝµÄ¹ý³ÌÖгöÏÖ´íÎóʱ£¬²Å·µ»Ø·Ç0Öµ¡£ Ò»µ©²ßÂÔ¾ö¶¨Ìîдelement_data£¬µÝÔö*claimµÄÊýÖµ¡£

6.7.2.34 mpo_externalize_socket_peer_label

int mpo_externalize_socket_peer_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«ÓÃÍⲿÐÎʽ±íʾµÄ±ê¼Ç  
element_name ÐèÒªÍⲿ±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
sb ÓÃÀ´´æ·Å±ê¼ÇµÄÎı¾±íʾÐÎʽµÄ×Ö·ûbuffer  
claimed Èç¹û¿ÉÒÔÌî³äelement_data Óò£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç½á¹¹£¬²úÉúÒ»¸öÒÔÍⲿÐÎʽ±íʾµÄ±ê¼Ç¡£ Ò»¸öÍⲿÐÎʽ±ê¼Ç£¬ÊDZê¼ÇÄÚÈݵÄÎı¾±íʾ£¬ËüÓÉÓû§¼¶µÄÓ¦ÓóÌÐòʹÓã¬ÊÇÓû§¿É¶ÁµÄ¡£ ĿǰµÄMACʵÏÖ·½°¸½«ÒÀ´Îµ÷ÓòßÂÔµÄÏàÓ¦Èë¿Úº¯Êý£¬Òò´Ë£¬ ¾ßÌå²ßÂÔµÄʵÏÖ´úÂ룬ÐèÒªÔÚÌîдsb֮ǰ£¬Ïȼì²éelement_nameÖÐÖ¸¶¨µÄÃû×Ö¡£ Èç¹ûelement_nameÖеÄÄÚÈÝÓëÄãµÄ²ßÂÔÃû×Ö²»Ïà·û£¬ÔòÖ±½Ó·µ»Ø0¡£ ½öµ±×ª»»±ê¼ÇÊý¾ÝµÄ¹ý³ÌÖгöÏÖ´íÎóʱ£¬²Å·µ»Ø·Ç0Öµ¡£ Ò»µ©²ßÂÔ¾ö¶¨Ìîдelement_data£¬µÝÔö*claimµÄÊýÖµ¡£

6.7.2.35 mpo_externalize_vnode_label

int mpo_externalize_vnode_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«ÓÃÍⲿÐÎʽ±íʾµÄ±ê¼Ç  
element_name ÐèÒªÍⲿ±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
sb ÓÃÀ´´æ·Å±ê¼ÇµÄÎı¾±íʾÐÎʽµÄ×Ö·ûbuffer  
claimed Èç¹û¿ÉÒÔÌî³äelement_data Óò£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç½á¹¹£¬²úÉúÒ»¸öÒÔÍⲿÐÎʽ±íʾµÄ±ê¼Ç¡£ Ò»¸öÍⲿÐÎʽ±ê¼Ç£¬ÊDZê¼ÇÄÚÈݵÄÎı¾±íʾ£¬ËüÓÉÓû§¼¶µÄÓ¦ÓóÌÐòʹÓã¬ÊÇÓû§¿É¶ÁµÄ¡£ ĿǰµÄMACʵÏÖ·½°¸½«ÒÀ´Îµ÷ÓòßÂÔµÄÏàÓ¦Èë¿Úº¯Êý£¬Òò´Ë£¬ ¾ßÌå²ßÂÔµÄʵÏÖ´úÂ룬ÐèÒªÔÚÌîдsb֮ǰ£¬Ïȼì²éelement_nameÖÐÖ¸¶¨µÄÃû×Ö¡£ Èç¹ûelement_nameÖеÄÄÚÈÝÓëÄãµÄ²ßÂÔÃû×Ö²»Ïà·û£¬ÔòÖ±½Ó·µ»Ø0¡£ ½öµ±×ª»»±ê¼ÇÊý¾ÝµÄ¹ý³ÌÖгöÏÖ´íÎóʱ£¬²Å·µ»Ø·Ç0Öµ¡£ Ò»µ©²ßÂÔ¾ö¶¨Ìîдelement_data£¬µÝÔö*claimµÄÊýÖµ¡£

6.7.2.36 mpo_internalize_cred_label

int mpo_internalize_cred_label(struct label *label, char *element_name, char *element_data, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ìî³äµÄ±ê¼Ç  
element_name ÐèÒªÄÚ²¿±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
element_data ÐèÒª±»×ª»»µÄÎı¾Êý¾Ý  
claimed Èç¹ûÊý¾Ý±»Õýȷת»»£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾ÝÒ»¸öÎı¾ÐÎʽµÄÍⲿ±íʾ±ê¼ÇÊý¾Ý£¬´´½¨Ò»¸öÄÚ²¿ÐÎʽµÄ±ê¼Ç½á¹¹¡£ ĿǰµÄMAC·½°¸½«ÒÀ´Îµ÷ÓÃËùÓвßÂÔµÄÏà¹ØÈë¿Úº¯Êý£¬À´ÏìÓ¦±ê¼ÇµÄÄÚ²¿×ª»»ÇëÇó£¬ Òò´Ë£¬ÊµÏÖ´úÂë±ØÐëÊ×ÏÈͨ¹ý±È½Ïelement_nameÖеÄÄÚÈݺÍ×Ô¼ºµÄ²ßÂÔÃû×Ö£¬ À´È·¶¨ÊÇ·ñÐèҪת»»element_dataÖдæ·ÅµÄÊý¾Ý¡£ ÀàËÆµÄ£¬Èç¹ûÃû×Ö²»Æ¥Åä»òÕßÊý¾Ýת»»²Ù×÷³É¹¦£¬¸Ãº¯Êý·µ»Ø0£¬²¢µÝÔö*claimedµÄÖµ¡£

6.7.2.37 mpo_internalize_ifnet_label

int mpo_internalize_ifnet_label(struct label *label, char *element_name, char *element_data, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ìî³äµÄ±ê¼Ç  
element_name ÐèÒªÄÚ²¿±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
element_data ÐèÒª±»×ª»»µÄÎı¾Êý¾Ý  
claimed Èç¹ûÊý¾Ý±»Õýȷת»»£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾ÝÒ»¸öÎı¾ÐÎʽµÄÍⲿ±íʾ±ê¼ÇÊý¾Ý£¬´´½¨Ò»¸öÄÚ²¿ÐÎʽµÄ±ê¼Ç½á¹¹¡£ ĿǰµÄMAC·½°¸½«ÒÀ´Îµ÷ÓÃËùÓвßÂÔµÄÏà¹ØÈë¿Úº¯Êý£¬À´ÏìÓ¦±ê¼ÇµÄÄÚ²¿×ª»»ÇëÇó£¬ Òò´Ë£¬ÊµÏÖ´úÂë±ØÐëÊ×ÏÈͨ¹ý±È½Ïelement_nameÖеÄÄÚÈݺÍ×Ô¼ºµÄ²ßÂÔÃû×Ö£¬ À´È·¶¨ÊÇ·ñÐèҪת»»element_dataÖдæ·ÅµÄÊý¾Ý¡£ ÀàËÆµÄ£¬Èç¹ûÃû×Ö²»Æ¥Åä»òÕßÊý¾Ýת»»²Ù×÷³É¹¦£¬¸Ãº¯Êý·µ»Ø0£¬²¢µÝÔö*claimedµÄÖµ¡£

6.7.2.38 mpo_internalize_pipe_label

int mpo_internalize_pipe_label(struct label *label, char *element_name, char *element_data, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ìî³äµÄ±ê¼Ç  
element_name ÐèÒªÄÚ²¿±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
element_data ÐèÒª±»×ª»»µÄÎı¾Êý¾Ý  
claimed Èç¹ûÊý¾Ý±»Õýȷת»»£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾ÝÒ»¸öÎı¾ÐÎʽµÄÍⲿ±íʾ±ê¼ÇÊý¾Ý£¬´´½¨Ò»¸öÄÚ²¿ÐÎʽµÄ±ê¼Ç½á¹¹¡£ ĿǰµÄMAC·½°¸½«ÒÀ´Îµ÷ÓÃËùÓвßÂÔµÄÏà¹ØÈë¿Úº¯Êý£¬À´ÏìÓ¦±ê¼ÇµÄÄÚ²¿×ª»»ÇëÇó£¬ Òò´Ë£¬ÊµÏÖ´úÂë±ØÐëÊ×ÏÈͨ¹ý±È½Ïelement_nameÖеÄÄÚÈݺÍ×Ô¼ºµÄ²ßÂÔÃû×Ö£¬ À´È·¶¨ÊÇ·ñÐèҪת»»element_dataÖдæ·ÅµÄÊý¾Ý¡£ ÀàËÆµÄ£¬Èç¹ûÃû×Ö²»Æ¥Åä»òÕßÊý¾Ýת»»²Ù×÷³É¹¦£¬¸Ãº¯Êý·µ»Ø0£¬²¢µÝÔö*claimedµÄÖµ¡£

6.7.2.39 mpo_internalize_socket_label

int mpo_internalize_socket_label(struct label *label, char *element_name, char *element_data, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ìî³äµÄ±ê¼Ç  
element_name ÐèÒªÄÚ²¿±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
element_data ÐèÒª±»×ª»»µÄÎı¾Êý¾Ý  
claimed Èç¹ûÊý¾Ý±»Õýȷת»»£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾ÝÒ»¸öÎı¾ÐÎʽµÄÍⲿ±íʾ±ê¼ÇÊý¾Ý£¬´´½¨Ò»¸öÄÚ²¿ÐÎʽµÄ±ê¼Ç½á¹¹¡£ ĿǰµÄMAC·½°¸½«ÒÀ´Îµ÷ÓÃËùÓвßÂÔµÄÏà¹ØÈë¿Úº¯Êý£¬À´ÏìÓ¦±ê¼ÇµÄÄÚ²¿×ª»»ÇëÇó£¬ Òò´Ë£¬ÊµÏÖ´úÂë±ØÐëÊ×ÏÈͨ¹ý±È½Ïelement_nameÖеÄÄÚÈݺÍ×Ô¼ºµÄ²ßÂÔÃû×Ö£¬ À´È·¶¨ÊÇ·ñÐèҪת»»element_dataÖдæ·ÅµÄÊý¾Ý¡£ ÀàËÆµÄ£¬Èç¹ûÃû×Ö²»Æ¥Åä»òÕßÊý¾Ýת»»²Ù×÷³É¹¦£¬¸Ãº¯Êý·µ»Ø0£¬²¢µÝÔö*claimedµÄÖµ¡£

6.7.2.40 mpo_internalize_vnode_label

int mpo_internalize_vnode_label(struct label *label, char *element_name, char *element_data, int *claimed);

²ÎÊý ˵Ã÷ Ëø¶¨
label ½«±»Ìî³äµÄ±ê¼Ç  
element_name ÐèÒªÄÚ²¿±íʾ±ê¼ÇµÄ²ßÂÔµÄÃû×Ö  
element_data ÐèÒª±»×ª»»µÄÎı¾Êý¾Ý  
claimed Èç¹ûÊý¾Ý±»Õýȷת»»£¬ÔòÆäÊýÖµµÝÔö  

¡¡¡¡¸ù¾ÝÒ»¸öÎı¾ÐÎʽµÄÍⲿ±íʾ±ê¼ÇÊý¾Ý£¬´´½¨Ò»¸öÄÚ²¿ÐÎʽµÄ±ê¼Ç½á¹¹¡£ ĿǰµÄMAC·½°¸½«ÒÀ´Îµ÷ÓÃËùÓвßÂÔµÄÏà¹ØÈë¿Úº¯Êý£¬À´ÏìÓ¦±ê¼ÇµÄÄÚ²¿×ª»»ÇëÇó£¬ Òò´Ë£¬ÊµÏÖ´úÂë±ØÐëÊ×ÏÈͨ¹ý±È½Ïelement_nameÖеÄÄÚÈݺÍ×Ô¼ºµÄ²ßÂÔÃû×Ö£¬ À´È·¶¨ÊÇ·ñÐèҪת»»element_dataÖдæ·ÅµÄÊý¾Ý¡£ ÀàËÆµÄ£¬Èç¹ûÃû×Ö²»Æ¥Åä»òÕßÊý¾Ýת»»²Ù×÷³É¹¦£¬¸Ãº¯Êý·µ»Ø0£¬²¢µÝÔö*claimedµÄÖµ¡£

6.7.3 ±ê¼Çʼþ

¡¡¡¡²ßÂÔÄ£¿éʹÓÃMAC ¿ò¼ÜÌṩµÄ¡°±ê¼Çʼþ¡±ÀàÈë¿Úº¯Êý£¬¶ÔÄں˶ÔÏóµÄ±ê¼Ç½øÐвÙ×÷¡£²ßÂÔÄ£¿é½«¸ÐÐËȤµÄ±»±ê¼ÇÄں˶ÔÏóµÄÏà¹ØÉúÃüÖÜÆÚʼþ ×¢²áÔÚÇ¡µ±µÄÈë¿ÚµãÉÏ¡£¶ÔÏóµÄ³õʼ»¯¡¢´´½¨ºÍÏú»Ùʼþ¾ùÌṩÁ˹³×ӵ㡣ÔÚijЩ¶ÔÏóÉÏ»¹¿ÉÒÔʵÏÖÖØÐ±ê¼Ç£¬¼´£¬ÔÊÐíÓû§½ø³Ì¸Ä±ä¶ÔÏóÉϵıê¼ÇÖµ¡£ ¶ÔijЩ¶ÔÏó¿ÉÒÔʵÏÖÆäÌØ¶¨µÄ¶ÔÏóʼþ£¬±ÈÈçÓë IP ÖØ×éÏà¹ØµÄ±ê¼Çʼþ¡£Ò»¸öµäÐ͵ı»±ê¼Ç¶ÔÏóÔÚÆäÉúÃüÖÜÆÚÖн«ÓµÓÐÏÂÁÐÈë¿Úº¯Êý£º

±ê¼Ç³õʼ»¯                     o
£¨¶ÔÏóÏà¹ØµÄµÈ´ý£©              \
±ê¼Ç´´½¨                         o
                                  \
ÖØÐ±ê¼Çʼþ£¬                     o--<--.
¸÷ÖÖ¶ÔÏóÏà¹ØµÄ£¬                   |     |
·ÃÎÊ¿ØÖÆÊ¼þ                       ~-->--o
                                          \
±ê¼ÇÏú»Ù                                   o

¡¡¡¡Ê¹Óñê¼Ç³õʼ»¯Èë¿Úº¯Êý£¬²ßÂÔ¿ÉÒÔÒÔÒ»ÖÖͳһµÄ¡¢Óë¶ÔÏóʹÓû·¾³Î޹صķ½Ê½ÉèÖñê¼ÇµÄ³õʼֵ¡£ ·ÖÅä¸øÒ»¸ö²ßÂÔµÄȱʡ slot ֵΪ0£¬ÕâÑù²»Ê¹Óñê¼ÇµÄ²ßÂÔ¿ÉÄܲ¢²»ÐèÒªÖ´ÐÐרÃŵijõʼ»¯²Ù×÷¡£

¡¡¡¡±ê¼ÇµÄ´´½¨Ê¼þ·¢ÉúÔÚ½«Ò»¸öÄÚºËÊý¾Ý½á¹¹Í¬Ò»¸öÕæÊµµÄÄں˶ÔÏóÏà¹ØÁª£¨Äں˶ÔÏóʵÀý»¯£©µÄʱ¿Ì¡£ ÀýÈ磬ÔÚÕæÕý±»Ê¹ÓÃ֮ǰ£¬ÔÚÒ»¸ö»º³å³ØÄÚÒÑ·ÖÅäµÄ mbuf Êý¾Ý½á¹¹£¬½«±£³ÖΪ¡°Î´Ê¹Óá±×´Ì¬¡£ Òò´Ë£¬mbuf µÄ·ÖÅä²Ù×÷½«µ¼ÖÂÕë¶Ô¸Ã mbuf µÄ±ê¼Ç³õʼ»¯²Ù×÷£¬¶ø mbuf µÄ´´½¨²Ù×÷Ôò±»ÍƳٵ½¸Ã mbuf ÕæÕýÓëÒ»¸öÊý¾Ý±¨Ïà¹ØÁªµÄʱ¿Ì¡£ ͨ³££¬µ÷ÓÃÕß½«»áÌṩ´´½¨Ê¼þµÄÉÏÏÂÎÄ£¬°üÀ¨´´½¨»·¾³¡¢´´½¨¹ý³ÌÖÐÉæ¼°µÄÆäËû¶ÔÏóµÄ±ê¼ÇµÈ¡£ÀýÈ磬µ±Ò»¸öÌ×½Ó×Ö´´½¨Ò»¸ö mbuf ʱ£¬ ³ýÁËд´½¨µÄ mbuf ¼°Æä±ê¼ÇÖ®Í⣬×÷Ϊ´´½¨ÕßµÄÌ×½Ó×ÖÓëÆä±ê¼ÇÒ²±»Ìá½»¸ø²ßÂÔ¼ì²é¡£ ²»ÌᳫÔÚ´´½¨¶ÔÏóʱ¾ÍΪÆä·ÖÅäÄÚ´æµÄÔ­ÒòÓÐÁ½¸ö£º´´½¨²Ù×÷¿ÉÄÜ·¢ÉúÔÚ¶ÔÐÔÄÜÓÐÑϸñÒªÇóµÄÄں˽ӿÚÉÏ£» ¶øÇÒ£¬ÒòΪ´´½¨µ÷Óò»ÔÊÐíʧ°Ü£¬ËùÒÔÎÞ·¨±¨¸æÄÚ´æ·ÖÅäʧ°Ü¡£

¡¡¡¡¶ÔÏóÌØÓеÄʼþÒ»°ã²»»áÒý·¢ÆäËûµÄ±ê¼Çʼþ£¬µ«ÊÇÔÚ¶ÔÏóÉÏÏÂÎÄ·¢Éú¸Ä±äʱ£¬²ßÂÔʹÓÃËüÃÇ¿ÉÒÔ¶ÔÏà¹Ø±ê¼Ç½øÐÐÐ޸Ļò¸üвÙ×÷¡£ ÀýÈ磬ÔÚMAC_UPDATE_IPQ Èë¿Úº¯ÊýÖ®ÄÚ£¬Ä³¸ö IP ·ÖÆ¬ÖØ×é¶ÓÁеıê¼Ç¿ÉÄÜ»áÒòΪ¶ÓÁÐÖнÓÊÕÁËÐ嵀 mbuf ¶ø±»¸üС£

¡¡¡¡·ÃÎÊ¿ØÖÆÊ¼þ½«ÔÚºóÐøÕ½ÚÖÐÏêϸÌÖÂÛ¡£

¡¡¡¡²ßÂÔͨ¹ýÖ´Ðбê¼ÇÏú»Ù²Ù×÷£¬ÊÍ·ÅΪÆä·ÖÅäµÄ´æ´¢¿Õ¼ä»òά»¤µÄ״̬£¬Ö®ºóÄں˲ſÉÒÔÖØÓûòÕßÊͷŶÔÏóµÄÄÚºËÊý¾Ý½á¹¹¡£

¡¡¡¡³ýÁËÓëÌØ¶¨Äں˶ÔÏó°ó¶¨µÄÆÕͨ±ê¼ÇÖ®Í⣬»¹ÓÐÒ»ÖÖ¶îÍâµÄ±ê¼ÇÀàÐÍ£ºÁÙʱ±ê¼Ç¡£ÕâЩ±ê¼ÇÓÃÓÚ´æ·ÅÓÉÓû§½ø³ÌÌá½»µÄ¸üÐÂÐÅÏ¢¡£ ËüÃǵijõʼ»¯ºÍÏú»Ù²Ù×÷ÓëÆäËû±ê¼ÇÒ»Ñù£¬Ö»ÊÇ´´½¨Ê¼þ£¬MAC_INTERNALIZE£¬ÂÔÓв»Í¬£º ¸Ãº¯Êý½ÓÊÜÓû§Ìá½»µÄ±ê¼Ç£¬¸ºÔð½«Æäת»¯ÎªÄں˱íʾÐÎʽ¡£

6.7.3.1 Îļþϵͳ¶ÔÏó±ê¼Çʼþ²Ù×÷

6.7.3.1.1 mpo_associate_vnode_devfs

void mpo_associate_vnode_devfs(struct mount *mp, struct label *fslabel, struct devfs_dirent *de, struct label *delabel, struct vnode *vp, struct label *vlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mp Devfs ¹ÒÔØµã  
fslabel Devfs Îļþϵͳ±ê¼Ç (mp->mnt_fslabel)  
de Devfs Ŀ¼Ïî  
delabel Óë de Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
vp Óë de Ïà¹ØÁªµÄ vnode  
vlabel Óë vp Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý²ÎÊý de ´«ÈëµÄ devfs Ŀ¼Ïî¼°Æä±ê¼ÇÐÅÏ¢£¬ÎªÒ»¸öнü´´½¨µÄ devfs vnode Ìî³ä±ê¼Ç£¨vlabel£©¡£

6.7.3.1.2 mpo_associate_vnode_extattr

int mpo_associate_vnode_extattr(struct mount *mp, struct label *fslabel, struct vnode *vp, struct label *vlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mp Îļþϵͳ¹ÒÔØµã  
fslabel Îļþϵͳ±ê¼Ç  
vp ½«±»±ê¼ÇµÄ vnode  
vlabel Óë vp Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡´ÓÎļþϵͳÀ©Õ¹ÊôÐÔÖжÁÈ¡ vp µÄ±ê¼Ç¡£³É¹¦£¬·µ»Ø 0¡£ ²»³É¹¦£¬ÔòÔÚ errno Ö¸¶¨µÄÏàÓ¦µÄ´íÎó±àÂë¡£ Èç¹ûÎļþϵͳ²»Ö§³ÖÀ©Õ¹ÊôÐԵĶÁÈ¡²Ù×÷£¬Ôò¿ÉÒÔ¿¼Âǽ« fslabel ¿½±´ÖÁ vlabel¡£

6.7.3.1.3 mpo_associate_vnode_singlelabel

void mpo_associate_vnode_singlelabel(struct mount *mp, struct label *fslabel, struct vnode *vp, struct label *vlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mp Îļþϵͳ¹ÒÔØµã  
fslabel Îļþϵͳ±ê¼Ç  
vp ½«±»±ê¼ÇµÄ vnode  
vlabel Óë vp Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÔڷǶàÖØ±ê¼ÇÎļþϵͳÉÏ£¬Ê¹ÓøÃÈë¿Úº¯Êý£¬¸ù¾ÝÎļþϵͳ±ê¼Ç£¬fslabel£¬ Ϊ vp ÉèÖòßÂÔ±ê¼Ç¡£

6.7.3.1.4 mpo_create_devfs_device

void mpo_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
dev devfs_dirent ¶ÔÓ¦µÄÉ豸  
devfs_dirent ½«±»±ê¼ÇµÄ Devfs Ŀ¼Ïî  
label ½«±»ÌîдµÄ devfs_dirent ±ê¼Ç  

¡¡¡¡Îª´«ÈëÉ豸н¨µÄ devfs_dirent Ìîд±ê¼Ç¡£¸Ãº¯Êý½«ÔÚÉ豸Îļþϵͳ¼ÓÔØ¡¢Öع¹»òÌí¼ÓÐÂÉ豸ʱ±»µ÷Óá£

6.7.3.1.5 mpo_create_devfs_directory

void mpo_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
dirname н¨Ä¿Â¼µÄÃû×Ö  
namelen ×Ö·û´® dirname µÄ³¤¶È  
devfs_dirent н¨Ä¿Â¼ÔÚ Devfs ÖжÔÓ¦µÄĿ¼Ïî  

¡¡¡¡Îª´«ÈëĿ¼²ÎÊýµÄн¨ devfs_dirent Ìîд±ê¼Ç¡£¸Ãº¯Êý½«ÔÚ¼ÓÔØ¡¢Öع¹É豸Îļþϵͳ£¬»òÕßÌí¼ÓÒ»¸öÐèÒªÖ¸¶¨Ä¿Â¼½á¹¹µÄÐÂÉ豸ʱ±»µ÷Óá£

6.7.3.1.6 mpo_create_devfs_symlink

void mpo_create_devfs_symlink(struct ucred *cred, struct mount *mp, struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, struct label *delabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
mp devfs ¹ÒÔØµã  
dd Á´½ÓÄ¿±ê  
ddlabel Óë dd Ïà¹ØÁªµÄ±ê¼Ç  
de ·ûºÅÁ´½ÓÏî  
delabel Óë de Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÐ½ü´´½¨µÄ devfs(5) ·ûºÅÁ´½ÓÏîÌîд±ê¼Ç£¨delabel£©¡£

6.7.3.1.7 mpo_create_vnode_extattr

int mpo_create_vnode_extattr(struct ucred *cred, struct mount *mp, struct label *fslabel, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *vlabel, struct componentname *cnp);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
mount Îļþϵͳ¹ÒÔØµã  
label Îļþϵͳ±ê¼Ç  
dvp ¸¸Ä¿Â¼ vnode  
dlabel Óë dvp Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
vp д´½¨µÄ vnode  
vlabel Óë vp Ïà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
cnp vpÖеÄ×ÓÓòÃû×Ö  

¡¡¡¡½« vp µÄ±ê¼ÇдÈëÎļþÀ©Õ¹ÊôÐÔ¡£³É¹¦£¬½«±ê¼ÇÌîÈë vlabel£¬ ²¢·µ»Ø 0¡£·ñÔò£¬·µ»Ø¶ÔÓ¦µÄ´íÎó±àÂë¡£

6.7.3.1.8 mpo_create_mount

void mpo_create_mount(struct ucred *cred, struct mount *mp, struct label *mnt, struct label *fslabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
mp ¿ÍÌ壻½«±»¹ÒÔØµÄÎļþϵͳ  
mntlabel ½«±»ÌîдµÄ mp µÄ²ßÂÔ±ê¼Ç  
fslabel ½«±»¹ÒÔØµ½ mp µÄÎļþϵͳµÄ²ßÂÔ±ê¼Ç¡£  

¡¡¡¡Îª´«ÈëµÄÖ÷ÌåÐÅÈÎ×´Ëù´´½¨µÄ¹ÒÔØµãÌîд±ê¼Ç¡£¸Ãº¯Êý½«ÔÚÎļþϵͳ¹ÒÔØÊ±±»µ÷Óá£

6.7.3.1.9 mpo_create_root_mount

void mpo_create_root_mount(struct ucred *cred, struct mount *mp, struct label *mntlabel, struct label *fslabel);

²ÎÊý ˵Ã÷ Ëø¶¨
¼û µÚ 6.7.3.1.8 ½Ú.

¡¡¡¡Îª´«ÈëµÄÖ÷ÌåÐÅÈÎ×´Ëù´´½¨µÄ¹ÒÔØµãÌîд±ê¼Ç¡£¸Ãº¯Êý½«ÔÚ¹ÒÔØ¸ùÎļþϵͳʱ£¬mpo_create_mount; Ö®ºó±»µ÷Óá£

6.7.3.1.10 mpo_relabel_vnode

void mpo_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ½«±»ÖØÐ±ê¼ÇµÄ vnode  
vnodelabel vp ÏÖÓеIJßÂÔ±ê¼Ç  
newlabel ½«È¡´úvnodelabelµÄУ¨¿ÉÄÜÖ»ÊDz¿·Ö£©±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄбê¼ÇºÍÖ÷ÌåÐÅÈÎ×´£¬¸üвÎÊý vnode µÄ±ê¼Ç¡£

6.7.3.1.11 mpo_setlabel_vnode_extattr

int mpo_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, struct label *vlabel, struct label *intlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp д³ö±ê¼ÇËù¶ÔÓ¦µÄ vnode  
vlabel vpµÄ²ßÂÔ±ê¼Ç  
intlabel ½«±»Ð´Èë´ÅÅ̵ıê¼Ç  

¡¡¡¡½«²ÎÊý intlabel ¸ø³öµÄ±ê¼ÇÐÅϢдÈëÖ¸¶¨ vnode µÄÀ©Õ¹ÊôÐÔ¡£ ¸Ãº¯Êý±» vop_stdcreatevnode_ea Ëùµ÷Óá£

6.7.3.1.12 mpo_update_devfsdirent

void mpo_update_devfsdirent(struct devfs_dirent *devfs_dirent, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
devfs_dirent ¿ÍÌ壻devfs Ŀ¼Ïî  
direntlabel ½«±»¸üеÄdevfs_direntµÄ²ßÂÔ±ê¼Ç  
vp ¸¸ vnode ÒÑËø¶¨
vnodelabel vpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾ÝËù´«ÈëµÄ devfs vnode ±ê¼Ç£¬¶Ô devfs_dirent µÄ±ê¼Ç½øÐиüС£ ÖØÐ±ê¼ÇÒ»¸ö devfs vnode µÄ²Ù×÷³É¹¦Ö®ºó£¬½«µ÷Óøú¯ÊýÀ´È·Èϱê¼ÇµÄ¸Ä±ä£¬Èç´Ë£¬¼´Ê¹ÏàÓ¦µÄ vnode Êý¾Ý½á¹¹±»Äں˻ØÊÕÖØÓ㬠Ҳ²»»á¶ªÊ§±ê¼ÇµÄÐÂ״̬¡£ÁíÍ⣬ÔÚ devfs ÖÐн¨Ò»¸ö·ûºÅÁ´½Óʱ£¬½ô½Ó×Åmac_vnode_create_from_vnode£¬ Ò²½«µ÷Óøú¯Êý£¬¶Ô vnode ±ê¼Ç½øÐгõʼ»¯²Ù×÷¡£

6.7.3.2 IPC ¶ÔÏó±ê¼Çʼþ²Ù×÷

6.7.3.2.1 mpo_create_mbuf_from_socket

void mpo_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
socket Ì×½Ó×Ö Ì×½Ó×ÖËø¶¨ WIP
socketlabel socket µÄ²ßÂÔ±ê¼Ç  
m ¿ÍÌ壻mbuf  
mbuflabel ½«±»ÌîдµÄ m µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄÌ×½Ó×Ö±ê¼ÇΪд´½¨µÄmbufÍ·²¿ÉèÖñê¼Ç¡£ ÿµ±Ì×½Ó×Ö²úÉúÒ»¸öеÄÊý¾Ý±¨»òÕßÏûÏ¢£¬²¢½«Æä´æ´¢ÔÚ²ÎÊý mbuf ÖÐʱ£¬½«µ÷Óøú¯Êý¡£

6.7.3.2.2 mpo_create_pipe

void mpo_create_pipe(struct ucred *cred, struct pipe *pipe, struct label *pipelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipe µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄÖ÷ÌåÐÅÈÎ×´²ÎÊý£¬ÉèÖÃн¨¹ÜµÀµÄ±ê¼Ç¡£Ã¿µ±Ò»¸öйܵÀ±»´´½¨£¬¸Ãº¯Êý½«±»µ÷Óá£

6.7.3.2.3 mpo_create_socket

void mpo_create_socket(struct ucred *cred, struct socket *so, struct label *socketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
so ¿ÍÌ壻½«±»±ê¼ÇµÄÌ×½Ó×Ö  
socketlabel ½«±»ÌîдµÄ so µÄ±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄÖ÷ÌåÐÅÈÎ×´²ÎÊý£¬ÉèÖÃн¨Ì×½Ó×ֵıê¼Ç¡£Ã¿µ±Ð½¨Ò»¸öÌ×½Ó×Ö£¬¸Ãº¯Êý½«±»µ÷Óá£

6.7.3.2.4 mpo_create_socket_from_socket

void mpo_create_socket_from_socket(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
oldsocket ¼àÌýÌ×½Ó×Ö  
oldsocketlabel oldsocket µÄ²ßÂÔ±ê¼Ç  
newsocket н¨Ì×½Ó×Ö  
newsocketlabel newsocket µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý listen(2) Ì×½Ó×Ö oldsocket£¬ Ϊн¨ accept(2) µÄÌ×½Ó×Ö newsocket£¬ÉèÖñê¼Ç¡£

6.7.3.2.5 mpo_relabel_pipe

void mpo_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *oldlabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
oldlabel pipe µÄµ±Ç°²ßÂÔ±ê¼Ç  
newlabel ½«Îªpipe ÉèÖõÄеIJßÂÔ±ê¼Ç  

¡¡¡¡ÎªpipeÉèÖÃбê¼Çnewlabel¡£

6.7.3.2.6 mpo_relabel_socket

void mpo_relabel_socket(struct ucred *cred, struct socket *so, struct label *oldlabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
so ¿ÍÌ壻Ì×½Ó×Ö  
oldlabel so µÄµ±Ç°±ê¼Ç  
newlabel ½«Îªsocket ÉèÖõÄбê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄ±ê¼Ç²ÎÊý£¬¶ÔÌ×½Ó×ֵĵ±Ç°±ê¼Ç½øÐиüС£

6.7.3.2.7 mpo_set_socket_peer_from_mbuf

void mpo_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, struct label *oldlabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mbuf ´ÓÌ×½Ó×Ö½ÓÊÕµ½µÄµÚÒ»¸öÊý¾Ý±¨  
mbuflabel mbuf µÄ±ê¼Ç  
oldlabel Ì×½Ó×ֵĵ±Ç°±ê¼Ç  
newlabel ½«ÎªÌ×½Ó×ÖÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄ mbuf ±ê¼Ç£¬ÉèÖÃij¸ö stream Ì×½Ó×ֵĶԵȱêÖ¾¡£ ³ýUnixÓòµÄÌ×½Ó×ÖÖ®Í⣬ÿµ±Ò»¸ö stream Ì×½Ó×Ö½ÓÊÕµ½µÚÒ»¸öÊý¾Ý±¨Ê±£¬¸Ãº¯Êý½«±»µ÷Óá£

6.7.3.2.8 mpo_set_socket_peer_from_socket

void mpo_set_socket_peer_from_socket(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketpeerlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
oldsocket ±¾µØÌ×½Ó×Ö  
oldsocketlabel oldsocket µÄ²ßÂÔ±ê¼Ç  
newsocket ¶ÔµÈÌ×½Ó×Ö  
newsocketpeerlabel ½«ÎªnewsocketÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄÔ¶³ÌÌ×½Ó×ֶ˵㣬Ϊһ¸ö stream UNIX ÓëÌ×½Ó×ÖÉèÖöԵȱê¼Ç¡£ ÿµ±ÏàÓ¦µÄÌ×½Ó×Ö¶ÔÖ®¼ä½øÐÐÁ¬½Óʱ£¬¸Ãº¯Êý½«ÔÚÁ½¶Ë·Ö±ð±»µ÷Óá£

6.7.3.3 Network Object Labeling Event Operations

6.7.3.3.1 mpo_create_bpfdesc

void mpo_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, struct label *bpflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
bpf_d ¿ÍÌ壻bpf ÃèÊö×Ó  
bpf ½«Îªbpf_dÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄÖ÷ÌåÐÅÈÎ×´²ÎÊý£¬ÎªÐ½¨µÄ BPF ÃèÊö×ÓÉèÖñê¼Ç¡£ µ±½ø³Ì´ò¿ª BPF É豸½Úµãʱ£¬¸Ãº¯Êý½«±»µ÷Óá£

6.7.3.3.2 mpo_create_ifnet

void mpo_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
ifnet ÍøÂç½Ó¿Ú  
ifnetlabel ½«ÎªifnetÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÐ½¨µÄÍøÂç½Ó¿ÚÉèÖñê¼Ç¡£¸Ãº¯ÊýÔÚÒÔÏÂÇé¿öϱ»µ÷Ó㺠µ±Ò»¸öеÄÎïÀí½Ó¿Ú±äΪ¿ÉÓÃʱ£¬»òÕßµ±Ò»¸öα½Ó¿ÚÔÚÒýµ¼Ê±»òÓÉÓÚij¸öÓû§²Ù×÷¶øÊµÀý»¯Ê±¡£

6.7.3.3.3 mpo_create_ipq

void mpo_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
fragment µÚÒ»¸ö±»½ÓÊÕµÄ IP ·ÖƬ  
fragmentlabel fragment µÄ²ßÂÔ±ê¼Ç  
ipq ½«±»±ê¼ÇµÄ IP ÖØ×é¶ÓÁÐ  
ipqlabel ½«ÎªipqÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾ÝµÚÒ»¸ö½ÓÊÕµ½µÄ·ÖƬµÄ mbuf Í·²¿ÐÅÏ¢£¬ÎªÐ½¨µÄ IP ·ÖÆ¬ÖØ×é¶ÓÁÐÉèÖñê¼Ç¡£

6.7.3.3.4 mpo_create_datagram_from_ipq

void mpo_create_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
ipq IP ÖØ×é¶ÓÁÐ  
ipqlabel ipq µÄ²ßÂÔ±ê¼Ç  
datagram ½«±»±ê¼ÇµÄÊý¾Ý±¨  
datagramlabel ½«ÎªdatagramlabelÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ý IP ·ÖÆ¬ÖØ×é¶ÓÁУ¬Îª¸Õ¸ÕÖØ×éÍê±ÏµÄ IP Êý¾Ý±¨ÉèÖñê¼Ç¡£

6.7.3.3.5 mpo_create_fragment

void mpo_create_fragment(struct mbuf *datagram, struct label *datagramlabel, struct mbuf *fragment, struct label *fragmentlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
datagram Êý¾Ý±¨  
datagramlabel datagram µÄ²ßÂÔ±ê¼Ç  
fragment ½«±»±ê¼ÇµÄ·ÖƬ  
fragmentlabel ½«ÎªdatagramÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾ÝÊý¾Ý±¨Ëù¶ÔÓ¦µÄ mbuf Í·²¿ÐÅÏ¢£¬ÎªÆäн¨µÄ·ÖƬµÄ mbuf Í·²¿ÉèÖñê¼Ç¡£

6.7.3.3.6 mpo_create_mbuf_from_mbuf

void mpo_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
oldmbuf ÒÑÓеģ¨Ô´£©mbuf  
oldmbuflabel oldmbuf µÄ²ßÂÔ±ê¼Ç  
newmbuf ½«±»±ê¼ÇµÄн¨ mbuf  
newmbuflabel ½«ÎªnewmbufÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾Ýij¸öÏÖÓÐÊý¾Ý±¨µÄ mbuf Í·²¿ÐÅÏ¢£¬ÎªÐ½¨Êý¾Ý±¨µÄ mbuf Í·²¿ÉèÖñê¼Ç¡£ÔÚÐí¶àÌõ¼þϽ«»áµ÷Óøú¯Êý£¬ ±ÈÈ磬ÓÉÓÚ¶ÔÆëÒªÇó¶øÖØÐ·ÖÅäij¸ö mbuf ʱ¡£

6.7.3.3.7 mpo_create_mbuf_linklayer

void mpo_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
ifnet ÍøÂç½Ó¿Ú  
ifnetlabel ifnet µÄ²ßÂÔ±ê¼Ç  
mbuf н¨Êý¾Ý±¨µÄ mbuf Í·²¿  
mbuflabel ½«ÎªmbufÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÔÚ¸ø¶¨½Ó¿ÚÉÏÓÉÓÚij¸öÁ´Â·²ãÏìÓ¦¶øÐ½¨µÄÊý¾Ý±¨µÄmbufÍ·²¿ÉèÖñê¼Ç¡£ ¸Ãº¯Êý½«ÔÚÈô¸ÉÌõ¼þϱ»µ÷Ó㬱ÈÈçµ±IPv4ºÍIPv6ЭÒéÕ»ÔÚÏìÓ¦ARP»òÕßND6ʱ¡£

6.7.3.3.8 mpo_create_mbuf_from_bpfdesc

void mpo_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, struct mbuf *mbuf, struct label *mbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
bpf_d BPF ÃèÊö×Ó  
bpflabel bpflabel µÄ²ßÂÔ±ê¼Ç  
mbuf ½«±»±ê¼ÇµÄн¨ mbuf  
mbuflabel ½«ÎªmbufÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÊ¹ÓòÎÊý BPF ÃèÊö×Ó´´½¨µÄÐÂÊý¾Ý±¨µÄ mbuf Í·²¿ÉèÖñê¼Ç¡£ µ±¶Ô²ÎÊý BPF ÃèÊö×ÓËù¹ØÁªµÄ BPF É豸½øÐÐд²Ù×÷ʱ£¬¸Ãº¯Êý½«±»µ÷Óá£

6.7.3.3.9 mpo_create_mbuf_from_ifnet

void mpo_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
ifnet ÍøÂç½Ó¿Ú  
ifnetlabel ifnetlabel µÄ²ßÂÔ±ê¼Ç  
mbuf н¨Êý¾Ý±¨µÄ mbuf Í·²¿  
mbuflabel ½«ÎªmbufÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡Îª´ÓÍøÂç½Ó¿Ú²ÎÊý´´½¨µÄÊý¾Ý±¨µÄ mbuf Í·²¿ÉèÖñê¼Ç¡£

6.7.3.3.10 mpo_create_mbuf_multicast_encap

void mpo_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *newmbuf, struct label *newmbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
oldmbuf ÏÖÓÐÊý¾Ý±¨µÄ mbuf Í·²¿  
oldmbuflabel oldmbuf µÄ²ßÂÔ±ê¼Ç  
ifnet ÍøÂç½Ó¿Ú  
ifnetlabel ifnet µÄ²ßÂÔ±ê¼Ç  
newmbuf ½«±»±ê¼ÇµÄн¨Êý¾Ý±¨ mbuf Í·²¿  
newmbuflabel ½«ÎªnewmbufÌîдµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡µ±´«ÈëµÄÒÑÓÐÊý¾Ý±¨±»¸ø¶¨¶à²¥·â×°½Ó¿Ú£¨multicast encapsulation interface£©´¦Àíʱ±»µ÷Ó㬠Ϊд´½¨µÄÊý¾Ý±¨ËùÔÚ mbuf Í·²¿ÉèÖñê¼Ç¡£ ÿµ±Ê¹ÓøÃÐéÄâ½Ó¿Ú´«µÝÒ»¸ömbufʱ£¬½«µ÷Óøú¯Êý¡£

6.7.3.3.11 mpo_create_mbuf_netlayer

void mpo_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
oldmbuf ½ÓÊÕµÄÊý¾Ý±¨  
oldmbuflabel oldmbuf µÄ²ßÂÔ±ê¼Ç  
newmbuf н¨Êý¾Ý±¨  
newmbuflabel newmbuf µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÎªÓÉ IP ¶ÑÕ»ÒòΪÏìÓ¦½ÓÊÕÊý¾Ý±¨£¨oldmbuf£©¶øÐ½¨µÄÊý¾Ý±¨ÉèÖÃÆä mbuf Í·²¿µÄ±ê¼Ç¡£ Ðí¶àÇé¿öÏÂÐèÒªµ÷Óøú¯Êý£¬±ÈÈ磬ÏìÓ¦ ICMP ÇëÇóÊý¾Ý±¨Ê±¡£

6.7.3.3.12 mpo_fragment_match

int mpo_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
fragment IP Êý¾Ý±¨·ÖƬ  
fragmentlabel fragment µÄ²ßÂÔ±ê¼Ç  
ipq IP ·ÖÆ¬ÖØ×é¶ÓÁÐ  
ipqlabel ipq µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾ÝËù´«ÈëµÄ IP ·ÖÆ¬ÖØ×é¶ÓÁУ¨ipq£©µÄ±ê¼Ç£¬ ¼ì²é°üº¬Ò»¸ö IP Êý¾Ý±¨£¨fragment£©µÄ mbuf µÄÍ·²¿ÊÇ·ñ·ûºÏÆäÒªÇó¡£ ·ûºÏ£¬Ôò·µ»Ø1¡£·ñÔò£¬·µ»Ø0¡£ ÿµ± IP ¶ÑÕ»³¢ÊÔ½«Ò»¸ö¸Õ¸Õ½ÓÊÕµ½µÄ·ÖƬ·ÅÈëij¸öÒÑÓÐµÄ·ÖÆ¬ÖØ×é¶ÓÁÐÖÐʱ£¬½«µ÷Óøú¯Êý½øÐа²È«¼ì²é£» Èç¹ûʧ°Ü£¬½«Îª·ÖÆ¬ÖØÐÂʵÀý»¯Ò»¸öÐ嵀ᅮ¬ÖØ×é¶ÓÁС£ ²ßÂÔ¿ÉÒÔÀûÓøÃÈë¿Úº¯Êý£¬¸ù¾Ý±ê¼Ç»òÕ߯äËûÐÅÏ¢×èÖ¹²»ÆÚÍûµÄ IP ·ÖÆ¬ÖØ×é¡£

6.7.3.3.13 mpo_relabel_ifnet

void mpo_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
ifnet ¿ÍÌå£»ÍøÂç½Ó¿Ú  
ifnetlabel ifnet µÄ²ßÂÔ±ê¼Ç  
newlabel ½«ÎªifnetÉèÖõÄбê¼Ç  

¡¡¡¡¸ù¾ÝËù´«ÈëµÄбê¼Ç£¬newlabel£¬ÒÔ¼°Ö÷ÌåÐÅÈÎ×´£¬ cred£¬¶ÔÍøÂç½Ó¿ÚµÄ±ê¼Ç½øÐиüС£

6.7.3.3.14 mpo_update_ipq

void mpo_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
mbuf IP ·ÖƬ  
mbuflabel mbuf µÄ²ßÂÔ±ê¼Ç  
ipq IP ·ÖÆ¬ÖØ×é¶ÓÁÐ  
ipqlabel ½«±»¸üеÄipqµÄµ±Ç°²ßÂÔ±ê¼Ç  

¡¡¡¡¸ù¾ÝËù´«ÈëµÄ IP ·ÖƬ mbuf Í·²¿£¨mbuf£©Îª½ÓÊÕ ËüµÄ IP ·ÖÆ¬ÖØ×é¶ÓÁУ¨ipq£©µÄ±ê¼Ç½øÐиüС£

6.7.3.4 ½ø³Ì±ê¼Çʼþ²Ù×÷

6.7.3.4.1 mpo_create_cred

void mpo_create_cred(struct ucred *parent_cred, struct ucred *child_cred);

²ÎÊý ˵Ã÷ Ëø¶¨
parent_cred ¸¸Ö÷ÌåÐÅÈÎ×´  
child_cred ×ÓÖ÷ÌåÐÅÈÎ×´  

¡¡¡¡¸ù¾ÝËù´«ÈëµÄÖ÷ÌåÐÅÈÎ×´£¬ÎªÐ½¨µÄÖ÷ÌåÐÅÈÎ×´ÉèÖñê¼Ç¡£ ÿµ±ÎªÒ»¸öн¨µÄ struct ucredµ÷Óà crcopy(9) ʱ£¬½«µ÷Óô˺¯Êý¡£ ¸Ãº¯Êý²»Ó¦Óë½ø³Ì¸´ÖÆ£¨forking£©»òÕß´´½¨Ê¼þ»ìΪһ̸¡£

6.7.3.4.2 mpo_execve_transition

void mpo_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *vnodelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
old ÒÑÓеÄÖ÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
new ½«±»±ê¼ÇµÄÐÂÖ÷ÌåÐÅÈÎ×´  
vp ½«±»Ö´ÐеÄÎļþ Òѱ»Ëø¶¨
vnodelabel vp µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡Ò»¸öÓµÓÐÐÅÈÎ×´oldµÄÖ÷ÌåÓÉÓÚÖ´ÐÐ(vpÎļþ¶øµ¼Ö±ê¼Çת»»Ê±£¬ ¸Ãº¯Êý¸ù¾Ývnode±ê¼ÇΪ¸ÃÖ÷ÌåÖØÐ±ê¼ÇΪnew¡£ ÿµ±Ò»¸ö½ø³ÌÇëÇóÖ´ÐÐvnodeÎļþ£¬¶øÍ¨¹ý Èë¿Úº¯Êýmpo_execve_will_transition Óгɹ¦·µ»ØµÄ²ßÂÔʱ£¬½«µ÷Óøú¯Êý¡£ ²ßÂÔÄ£¿é¿ÉÒÔͨ¹ý´«ÈëÁ½¸öÖ÷ÌåÐÅÈÎ×´ºÍ¼òµ¥µØµ÷Óà mpo_create_cred À´ÊµÏÖ¸ÃÈë¿Úº¯Êý£¬ so as not to implement a transitioning event. Ò»µ©²ßÂÔʵÏÖÁËmpo_create_credº¯Êý£¬¼´Ê¹Ã»ÓÐʵÏÖ mpo_execve_will_transition£¬Ò²Ó¦¸ÃʵÏָú¯Êý¡£

6.7.3.4.3 mpo_execve_will_transition

int mpo_execve_will_transition(struct ucred *old, struct vnode *vp, struct label *vnodelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
old ÔÚÖ´ÐÐexecve(2)֮ǰµÄÖ÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
vp ½«±»Ö´ÐеÄÎļþ  
vnodelabel vp µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡ÓɲßÂÔ¾ö¶¨£¬µ±²ÎÊýÖ÷ÌåÐÅÈÎ×´Ö´ÐвÎÊý vnode ʱ£¬ÊÇ·ñÐèÒª½øÐÐÒ»¸ö±ê¼Çת»»²Ù×÷¡£Èç¹ûÐèÒª£¬·µ»Ø1£» ·ñÔò£¬·µ»Ø0¡£¼´Ê¹Ò»¸ö²ßÂÔ·µ»Ø0£¬ËüÒ²±ØÐëΪ×Ô¼º²»ÆÚÍûµÄ¶Ô mpo_execve_transitionµÄµ÷ÓÃ×÷ºÃ×¼±¸£¬ÒòΪֻҪÓÐÆäËûÈκÎÒ»¸ö²ßÂÔÒªÇóת»»£¬¾Í½«Ö´Ðд˺¯Êý¡£

6.7.3.4.4 mpo_create_proc0

void mpo_create_proc0(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred ½«±»ÌîдµÄÖ÷ÌåÐÅÈÎ×´  

¡¡¡¡Îª½ø³Ì0£¬ËùÓÐÄں˽ø³ÌµÄ׿ÏÈ£¬´´½¨Ö÷ÌåÐÅÈÎ×´¡£

6.7.3.4.5 mpo_create_proc1

void mpo_create_proc1(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred ½«±»ÌîдµÄÖ÷ÌåÐÅÈÎ×´  

¡¡¡¡Îª½ø³Ì1£¬ËùÓÐÓû§½ø³ÌµÄ׿ÏÈ£¬´´½¨Ö÷ÌåÐÅÈÎ×´¡£

6.7.3.4.6 mpo_relabel_cred

void mpo_relabel_cred(struct ucred *cred, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
newlabel ½«±»Ó¦Óõ½ cred ÉϵÄбê¼Ç  

¡¡¡¡¸ù¾Ý´«ÈëµÄбê¼Ç£¬¶ÔÖ÷ÌåÐÅÈÎ×´Éϵıê¼Ç½øÐиüС£

6.7.4 ·ÃÎÊ¿ØÖƼì²é

¡¡¡¡Í¨¹ý·ÃÎÊ¿ØÖÆÈë¿Úº¯Êý£¬²ßÂÔÄ£¿éÄÜÓ°ÏìÄں˵ķÃÎÊ¿ØÖƾö²ß¡£ ͨ³£Çé¿öÏ£¬²»ÊǾø¶Ô£¬Ò»¸ö·ÃÎÊ¿ØÖÆÈë¿Úº¯ÊýµÄ²ÎÊýÓУ¬Ò»¸ö»òÕßÈô¸É¸öÊÚȨÐÅÈÎ×´£¬ºÍÏà¹Ø²Ù×÷Éæ¼°µÄÆäËûÈκζÔÏóµÄÐÅÏ¢£¨ÆäÖпÉÄܰüº¬±ê¼Ç£©¡£ ·ÃÎÊ¿ØÖÆÈë¿Úº¯Êý·µ»Ø0£¬±íʾÔÊÐí¸Ã²Ù×÷£»·ñÔò£¬·µ»ØÒ»¸ö errno(2) ´íÎó±àÂë¡£µ÷ÓøÃÈë¿Úº¯Êý£¬½«±éÀúËùÓÐϵͳע²áµÄ²ßÂÔÄ£¿é£¬ÖðÒ»½øÐÐ ²ßÂÔÏà¹ØµÄ¼ì²éºÍ¾ö²ß£¬Ö®ºó°´ÕÕÏÂÊö·½·¨×éºÏ²»Í¬²ßÂԵķµ»Ø½á¹û£ºÖ»Óе±ËùÓеÄÄ£¿é¾ùÔÊÐí¸Ã²Ù×÷ʱ£¬²Å³É¹¦·µ»Ø¡£ ·ñÔò£¬Èç¹ûÓÐÒ»¸ö»òÕßÈô¸ÉÄ£¿éʧ°Ü·µ»Ø£¬ÔòÕû¸ö¼ì²é²»Í¨¹ý¡£Èç¹ûÓжà¸öÄ£¿éµÄ¼ì²é³ö´í·µ»Ø£¬½«Óɶ¨ÒåÔÚkern_mac.c ÖÐµÄ error_select() º¯Êý´ÓËüÃÇ·µ»ØµÄ´íÎó±àÂëÖУ¬Ñ¡ÔñÒ»¸öºÏÊʵ쬷µ»Ø¸øÓû§¡£

×î¸ßÓÅÏȼ¶ EDEADLK
  EINVAL
  ESRCH
  EACCES
×îµÍÓÅÏȼ¶ EPERM

¡¡¡¡Èç¹ûËùÓвßÂÔÄ£¿é·µ»ØµÄ´íÎó±àÂë¾ùûÓгöÏÖÔÚÉÏÊöÓÅÏȼ¶ÐòÁбíÖУ¬ÔòÈÎÒâÑ¡ÔñÒ»¸ö·µ»Ø¡£ Ñ¡Ôñ´íÎó±àÂëµÄÒ»°ã´ÎÐòΪ£ºÄں˴íÎó£¬ÎÞЧµÄ²ÎÊý£¬¶ÔÏó²»´æÔÚ£¬·ÃÎʱ»¾Ü¾ø£¬ºÍÆäËû´íÎó¡£

6.7.4.1 mpo_check_bpfdesc_receive

int mpo_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, struct ifnet *ifnet, struct label *ifnetlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
bpf_d Ö÷Ì壻BPF ÃèÊö×Ó  
bpflabel bpf_d µÄ²ßÂÔ±ê¼Ç  
ifnet ¿ÍÌå£»ÍøÂç½Ó¿Ú  
ifnetlabel ifnet µÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨ MAC ¿ò¼ÜÊÇ·ñÓ¦¸ÃÔÊÐí½«ÓɲÎÊý½Ó¿Ú½ÓÊÕµ½µÄÊý¾Ý±¨´«µÝ¸øÓÉ BPF ÃèÊö×ÓËù¶ÔÓ¦µÄ»º³åÇø¡£³É¹¦£¬Ôò·µ»Ø0£» ·ñÔò£¬·µ»Ø´íÎó±àÂëÐÅÏ¢errno¡£½¨ÒéʹÓõĴíÎó±àÂëÓУºEACCES£¬ÓÃÓÚ±ê¼Ç²»·ûµÄÇé¿ö£» EPERM£¬ÓÃÓÚȱÉÙÌØÈ¨µÄÇé¿ö¡£

6.7.4.2 mpo_check_kenv_dump

int mpo_check_kenv_dump(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓ¦¸Ã±»ÔÊÐí²éѯÄں˻·¾³×´Ì¬£¨²Î¿¼ kenv(2)£©¡£

6.7.4.3 mpo_check_kenv_get

int mpo_check_kenv_get(struct ucred *cred, char *name);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
name Äں˵Ļ·¾³±äÁ¿Ãû×Ö  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñ¿ÉÒÔ²éѯÄÚºËÖиø¶¨»·¾³±äÁ¿µÄ״̬¡£

6.7.4.4 mpo_check_kenv_set

int mpo_check_kenv_set(struct ucred *cred, char *name);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
name Äں˵Ļ·¾³±äÁ¿Ãû×Ö  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨÉèÖøø¶¨Äں˻·¾³±äÁ¿µÄÖµ¡£

6.7.4.5 mpo_check_kenv_unset

int mpo_check_kenv_unset(struct ucred *cred, char *name);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
name Äں˵Ļ·¾³±äÁ¿Ãû×ÖKernel environment variable name  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨÇå³ý¸ø¶¨µÄÄں˻·¾³±äÁ¿µÄÉèÖá£

6.7.4.6 mpo_check_kld_load

int mpo_check_kld_load(struct ucred *cred, struct vnode *vp, struct label *vlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ÄÚºËÄ£¿éµÄ vnode  
vlabel vpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ¼ÓÔØ¸ø¶¨µÄÄ£¿éÎļþ¡£

6.7.4.7 mpo_check_kld_stat

int mpo_check_kld_stat(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ·ÃÎÊÄں˵ļÓÔØÄ£¿éÎļþÁ´±íÒÔ¼°Ïà¹ØµÄͳ¼ÆÊý¾Ý¡£

6.7.4.8 mpo_check_kld_unload

int mpo_check_kld_unload(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐÈ¨Ð¶ÔØÒ»¸öÄÚºËÄ£¿é¡£

6.7.4.9 mpo_check_pipe_ioctl

int mpo_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, struct label *pipelabel, unsigned long cmd, void *data);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipeµÄ²ßÂÔ±ê¼Ç  
cmd ioctl(2) ÃüÁî  
data ioctl(2) Êý¾Ý  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨµ÷ÓÃÖ¸¶¨µÄ ioctl(2) ϵͳµ÷Óá£

6.7.4.10 mpo_check_pipe_poll

int mpo_check_pipe_poll(struct ucred *cred, struct pipe *pipe, struct label *pipelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipeµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ¶Ô¹ÜµÀpipeÖ´ÐÐpoll²Ù×÷¡£

6.7.4.11 mpo_check_pipe_read

int mpo_check_pipe_read(struct ucred *cred, struct pipe *pipe, struct label *pipelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipeµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨ¶ÁÈ¡pipe¡£

6.7.4.12 mpo_check_pipe_relabel

int mpo_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *pipelabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipeµÄµ±Ç°²ßÂÔ±ê¼Ç  
newlabel ½«ÎªpipelabelÉèÖõÄбê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨΪpipeÖØÐÂÉèÖñê¼Ç¡£

6.7.4.13 mpo_check_pipe_stat

int mpo_check_pipe_stat(struct ucred *cred, struct pipe *pipe, struct label *pipelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipeµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨ²éѯÓëpipeÏà¹ØµÄͳ¼ÆÐÅÏ¢¡£

6.7.4.14 mpo_check_pipe_write

int mpo_check_pipe_write(struct ucred *cred, struct pipe *pipe, struct label *pipelabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
pipe ¹ÜµÀ  
pipelabel pipeµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨдpipe¡£

6.7.4.15 mpo_check_socket_bind

int mpo_check_socket_bind(struct ucred *cred, struct socket *socket, struct label *socketlabel, struct sockaddr *sockaddr);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
socket ½«±»°ó¶¨µÄÌ×½Ó×Ö  
socketlabel socketµÄ²ßÂÔ±ê¼Ç  
sockaddr socketµÄµØÖ·  

6.7.4.16 mpo_check_socket_connect

int mpo_check_socket_connect(struct ucred *cred, struct socket *socket, struct label *socketlabel, struct sockaddr *sockaddr);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
socket ½«±»Á¬½ÓµÄÌ×½Ó×Ö  
socketlabel socketµÄ²ßÂÔ±ê¼Ç  
sockaddr socketµÄµØÖ·  

¡¡¡¡¾ö¶¨¸ÃÖ÷Ì壨cred£©ÊÇ·ñÓÐȨ½«Ì×½Ó×Ö£¨socket£©°ó¶¨µ½µØÖ· sockaddr¡£³É¹¦£¬·µ»Ø0£¬·ñÔò·µ»ØÒ»¸ö´íÎó±àÂëerrno¡£ ½¨Òé²ÉÓõĴíÎó±àÂëÓУºEACCES£¬ÓÃÓÚ±ê¼Ç²»·ûµÄÇé¿ö£»EPERM£¬ÓÃÓÚÌØÈ¨²»×ãµÄÇé¿ö¡£

6.7.4.17 mpo_check_socket_receive

int mpo_check_socket_receive(struct ucred *cred, struct socket *so, struct label *socketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
so Ì×½Ó×Ö  
socketlabel soµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨ²éѯÌ×½Ó×ÖsoµÄÏà¹ØÐÅÏ¢¡£

6.7.4.18 mpo_check_socket_send

int mpo_check_socket_send(struct ucred *cred, struct socket *so, struct label *socketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
so Ì×½Ó×Ö  
socketlabel soµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨͨ¹ýÌ×½Ó×Öso·¢ËÍÐÅÏ¢¡£

6.7.4.19 mpo_check_cred_visible

int mpo_check_cred_visible(struct ucred *u1, struct ucred *u2);

²ÎÊý ˵Ã÷ Ëø¶¨
u1 Ö÷ÌåÐÅÈÎ×´  
u2 ¶ÔÏóÐÅÈÎ×´  

¡¡¡¡È·¶¨¸ÃÖ÷ÌåÐÅÈÎ×´u1ÊÇ·ñÓÐȨ ¡°see¡± ¾ßÓÐÐÅÈÎ×´u2 µÄÆäËûÖ÷Ìå¡£ ³É¹¦£¬·µ»Ø0£»·ñÔò£¬·µ»Ø´íÎó±àÂëerrno¡£½¨Òé²ÉÓõĴíÎó±àÂëÓУº EACCES£¬ÓÃÓÚ±ê¼Ç²»·ûµÄÇé¿ö£»EPERM£¬ÓÃÓÚÌØÈ¨²»×ãµÄÇé¿ö£»ESRCH£¬ ÓÃÀ´Ìṩ²»¿É¼ûÐÔ¡£¸Ãº¯Êý¿ÉÔÚÐí¶à»·¾³ÏÂʹÓ㬰üÀ¨ÃüÁîpsËùʹÓõĽø³Ì¼äµÄ״̬ sysctl£¬ÒÔ¼°Í¨¹ýprocfs µÄ״̬²éѯ²Ù×÷¡£

6.7.4.20 mpo_check_socket_visible

int mpo_check_socket_visible(struct ucred *cred, struct socket *socket, struct label *socketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
socket ¿ÍÌ壻Ì×½Ó×Ö  
socketlabel socketµÄ²ßÂÔ±ê¼Ç  

6.7.4.21 mpo_check_ifnet_relabel

int mpo_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
ifnet ¿ÍÌå£»ÍøÂç½Ó¿Ú  
ifnetlabel ifnetÏÖÓеIJßÂÔ±ê¼Ç  
newlabel ½«±»Ó¦Óõ½ifnetÉϵÄеIJßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨʹÓô«ÈëµÄ±ê¼Ç¸üвÎÊý¶Ô¸ø¶¨µÄÍøÂç½Ó¿ÚµÄ±ê¼Ç½øÐÐÖØÐÂÉèÖá£

6.7.4.22 mpo_check_socket_relabel

int mpo_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *socketlabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
socket ¿ÍÌ壻Ì×½Ó×Ö  
socketlabel socketÏÖÓеIJßÂÔ±ê¼Ç  
newlabel ½«±»Ó¦Óõ½socketlabelÉϵĸüбê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ²ÉÓô«ÈëµÄ±ê¼Ç¶ÔÌ×½Ó×Ö²ÎÊýµÄ±ê¼Ç½øÐÐÖØÐÂÉèÖá£

6.7.4.23 mpo_check_cred_relabel

int mpo_check_cred_relabel(struct ucred *cred, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
newlabel ½«±»Ó¦Óõ½credÉϵĸüбê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ½«×Ô¼ºµÄ±ê¼ÇÖØÐÂÉèÖÃΪ¸ø¶¨µÄ¸üбê¼Ç¡£

6.7.4.24 mpo_check_vnode_relabel

int mpo_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *newlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
vp ¿ÍÌ壻vnode Òѱ»Ëø¶¨
vnodelabel vpÏÖÓеIJßÂÔ±ê¼Ç  
newlabel ½«±»Ó¦Óõ½vpÉϵIJßÂÔ±ê¼Ç  

¡¡¡¡¾ö¶¨¸ÃÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ½«²ÎÊý vnode µÄ±ê¼ÇÖØÐÂÉèÖÃΪָ¶¨±ê¼Ç¡£

6.7.4.25 mpo_check_mount_stat

int mpo_check_mount_stat(struct ucred *cred, struct mount *mp, struct label *mountlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
mp ¿ÍÌ壻Îļþϵͳ¹ÒÔØ  
mountlabel mpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ²é¿´ÔÚ¸ø¶¨ÎļþϵͳÉÏÖ´ÐÐ statfs µÄ½á¹û¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£ ¸Ãº¯Êý¿ÉÄÜÔÚÏÂÁÐÇé¿öϱ»µ÷Ó㺠ÔÚ statfs(2) ºÍÆäËûÏà¹Øµ÷ÓÃÆÚ¼ä£¬»òÕßµ±ÐèÒª´ÓÎļþϵͳÁбíÖÐÑ¡ÔñÅųýÄĸöÎļþϵͳʱ£¬±ÈÈ磬 µ÷Óà getfsstat(2)ʱ¡£

6.7.4.26 mpo_check_proc_debug

int mpo_check_proc_debug(struct ucred *cred, struct proc *proc);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
proc ¿ÍÌ壻½ø³Ì  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ debug ¸ø¶¨½ø³Ì¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»£» ESRCH£¬ÓÃÓÚÒþÂ÷Ä¿±êµÄ´æÔÚ¡£ ptrace(2) ºÍ ktrace(2) API£¬ÒÔ¼°Ä³Ð© procfs ²Ù×÷½«µ÷Óøú¯Êý¡£

6.7.4.27 mpo_check_vnode_access

int mpo_check_vnode_access(struct ucred *cred, struct vnode *vp, struct label *label, int flags);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
flags access(2) ±êÖ¾  

¡¡¡¡¸ù¾ÝÏà¹ØÖ÷ÌåÐÅÈÎ×´¾ö¶¨Æä¶Ô¸ø¶¨ vnode ÒÔ¸ø¶¨·ÃÎʱêÖ¾Ö´ÐÐµÄ access(2) ºÍÆäËûÏà¹Øµ÷Óõķµ»ØÖµ¡£Ò»°ã£¬Ó¦²ÉÓÃÓëmpo_check_vnode_open ÏàͬµÄÓïÒåÀ´ÊµÏָú¯Êý¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.28 mpo_check_vnode_chdir

int mpo_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, struct label *dlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp ¿ÍÌ壻chdir(2) µÄÄ¿µÄ vnode  
dlabel dvpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ½«½ø³Ì¹¤×÷Ŀ¼Çл»µ½¸ø¶¨ vnode¡£³É¹¦£¬Ôò·µ»Ø 0£» ·ñÔò£¬·µ»ØÒ»¸ö errnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.29 mpo_check_vnode_chroot

int mpo_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, struct label *dlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp Ŀ¼ vnode  
dlabel ÓëdvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ chroot(2) µ½ÓÉ (dvp)¸ø¶¨µÄĿ¼¡£

6.7.4.30 mpo_check_vnode_create

int mpo_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp, struct vattr *vap);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp ¿ÍÌ壻vnode  
dlabel dvpµÄ²ßÂÔ±ê¼Ç  
cnp dvpÖеijÉÔ±Ãû  
vap vapµÄ vnode ÊôÐÔ  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÔÚ¸ø¶¨¸¸Ä¿Â¼£¬ÒÔ¸ø¶¨µÄÃû×ÖºÍÊôÐÔ£¬ ³£¼ûÒ»¸ö vnode¡£³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬ ·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES À´±íʾÓÃÓÚ±ê¼Ç²»Æ¥Å䣬 ¶øÓà EPERM£¬ÓÃÓÚȨÏÞ²»×ã¡£ ÒÔO_CREATΪ²ÎÊýµ÷Óà open(2)£¬»ò¶Ô mknod(2)£¬mkfifo(2) µÈµÄµ÷Óý«µ¼Ö¸ú¯Êý±»µ÷Óá£

6.7.4.31 mpo_check_vnode_delete

int mpo_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, void *label, struct componentname *cnp);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp ¸¸Ä¿Â¼ vnode  
dlabel dvpµÄ²ßÂÔ±ê¼Ç  
vp ¿ÍÌ壻½«±»É¾³ýµÄ vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
cnp vpÖеijÉÔ±Ãû  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ´Ó¸ø¶¨µÄ¸¸Ä¿Â¼ÖУ¬É¾³ý¸ø¶¨Ãû×ÖµÄ vnode¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£ ʹÓà unlink(2) ºÍ rmdir(2)£¬½«µ¼Ö¸ú¯Êý±»µ÷ÓᣠÌṩ¸ÃÈë¿Úº¯ÊýµÄ²ßÂÔ»¹±ØÐëʵÏÖÒ»¸ö mpo_check_rename_to£¬ ÓÃÀ´ÊÚȨÓÉÓÚÖØÃüÃû²Ù×÷µ¼ÖµÄÄ¿±êÎļþµÄɾ³ý¡£

6.7.4.32 mpo_check_vnode_deleteacl

int mpo_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
vp ¿ÍÌ壻vnode ±»Ëø¶¨
label vpµÄ²ßÂÔ±ê¼Ç  
type ACL ÀàÐÍ  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨɾ³ý¸ø¶¨ vnode µÄ¸ø¶¨ÀàÐ굀 ACL¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.33 mpo_check_vnode_exec

int mpo_check_vnode_exec(struct ucred *cred, struct vnode *vp, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻½«±»Ö´ÐÐµÄ vnode  
label vpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨִÐиø¶¨ vnode¡£ ¶ÔÓÚÖ´ÐÐÌØÈ¨µÄ¾ö²ßÓëÈκÎ˲ʱʼþµÄ¾ö²ßÊÇÑϸñ·Ö¿ªµÄ¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.34 mpo_check_vnode_getacl

int mpo_check_vnode_getacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
type ACL ÀàÐÍ  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ²éѯ¸ø¶¨ vnode Éϵĸø¶¨ÀàÐ굀 ACL¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.35 mpo_check_vnode_getextattr

int mpo_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
attrnamespace À©Õ¹ÊôÐÔÃû×Ö¿Õ¼ä  
name À©Õ¹ÊôÐÔÃû  
uio I/O ½á¹¹Ö¸Õ룻²Î¼û uio(9)  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ²éѯ¸ø¶¨ vnode Éϸø¶¨Ãû×Ö¿Õ¼äºÍÃû×ÖµÄÀ©Õ¹ÊôÐÔ¡£ ʹÓÃÀ©Õ¹ÊôÐÔʵÏÖ±ê¼Ç´æ´¢µÄ²ßÂÔÄ£¿é¿ÉÄÜ»áÐèÒª¶ÔÕâЩÀ©Õ¹ÊôÐԵIJÙ×÷½øÐÐÌØÊâ´¦Àí¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.36 mpo_check_vnode_link

int mpo_check_vnode_link(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp Ŀ¼ vnode  
dlabel ÓëdvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
vp Á´½ÓÄ¿µÄ vnode  
label ÓëvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
cnp ½«±»´´½¨µÄÁ´½Ó¶ÔÓ¦µÄ³ÉÔ±Ãû  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨΪ²ÎÊývp¸ø¶¨µÄ vnode ´´½¨Ò»¸öÓɲÎÊýcnp¸ø¶¨Ãû×ÖµÄÁ´½Ó¡£

6.7.4.37 mpo_check_vnode_mmap

int mpo_check_vnode_mmap(struct ucred *cred, struct vnode *vp, struct label *label, int prot);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ½«±»Ó³ÉäµÄ vnode  
label ÓëvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
prot mmap ±£»¤ (²Î¼û mmap(2))  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ½«¸ø¶¨ vnode vp ÒÔ protÖ¸¶¨µÄ±£»¤·½Ê½½øÐÐÓ³Éä.

6.7.4.38 mpo_check_vnode_mmap_downgrade

void mpo_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, struct label *label, int *prot);

²ÎÊý ˵Ã÷ Ëø¶¨
cred See µÚ 6.7.4.37 ½Ú.  
vp  
label  
prot ½«±»½µ¼¶µÄ mmap protections  

¡¡¡¡¸ù¾ÝÖ÷ÌåºÍ¿ÍÌå±ê¼Ç£¬½µµÍ mmap protections¡£

6.7.4.39 mpo_check_vnode_mprotect

int mpo_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, struct label *label, int prot);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp Ó³ÉäµÄ vnode  
prot ´æ´¢±£»¤  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ½«¸ø¶¨ vnodevp Ó³ÉäÄÚ´æ¿Õ¼äµÄ´æ´¢±£»¤²ÎÊýÉèÖÃΪָ¶¨Öµ¡£

6.7.4.40 mpo_check_vnode_poll

int mpo_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
active_cred Ö÷ÌåÐÅÈÎ×´  
file_cred Óëstruct fileÏà¹ØÁªµÄÐÅÈÎ×´  
vp ½«±»Ö´ÐÐ poll ²Ù×÷µÄ vnode  
label ÓëvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ¶Ô¸ø¶¨ vnode vpÖ´ÐÐ poll ²Ù×÷¡£

6.7.4.41 mpo_check_vnode_rename_from

int mpo_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp Ŀ¼ vnode  
dlabel ÓëdvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
vp ½«±»ÖØÃüÃûµÄ vnode  
label ÓëvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
cnp vpÖеijÉÔ±Ãû  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐÈ¨ÖØÃüÃû¸ø¶¨vnode£¬vp¡£

6.7.4.42 mpo_check_vnode_rename_to

int mpo_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, int samedir, struct componentname *cnp);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp Ŀ¼ vnode  
dlabel ÓëdvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
vp ±»¸²¸ÇµÄ vnode  
label ÓëvpÏà¹ØÁªµÄ²ßÂÔ±ê¼Ç  
samedir ²¼¶ûÐͱäÁ¿£»Èç¹ûÔ´ºÍÄ¿µÄĿ¼ÊÇÏàͬµÄ£¬Ôò±»ÖÃΪ1  
cnp Ä¿±êcomponentÃû  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐÈ¨ÖØÃüÃû¸ø¶¨ vnode vp£¬ÖÁÖ¸¶¨Ä¿Â¼ dvp£¬»ò¸üÃûΪcnp¡£Èç¹ûÎÞÐ踲¸ÇÒÑÓÐÎļþ£¬ Ôòvp ºÍ label µÄÖµ½«Îª NULL.

6.7.4.43 mpo_check_socket_listen

int mpo_check_socket_listen(struct ucred *cred, struct socket *socket, struct label *socketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
socket ¿ÍÌ壻Ì×½Ó×Ö  
socketlabel socketµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨ¼àÌý¸ø¶¨Ì×½Ó×Ö¡£ ³É¹¦£¬Ôò·µ»Ø0£»·ñÔò£¬·µ»Ø´íÎó±àÂëÖµerrno¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.44 mpo_check_vnode_lookup

int mpo_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp ¿ÍÌ壻vnode  
dlabel dvpµÄ²ßÂÔ±ê¼Ç  
cnp ±»¼ì²éµÄ³ÉÔ±Ãû  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÔÚ¸ø¶¨µÄĿ¼ vnode ÖÐΪ²éÕÒ¸ø¶¨Ãû×ÖÖ´ÐÐlookup²Ù×÷¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸ö errnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.45 mpo_check_vnode_open

int mpo_check_vnode_open(struct ucred *cred, struct vnode *vp, struct label *label, int acc_mode);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
acc_mode open(2) ·ÃÎÊģʽ  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÔÚ¸ø¶¨ vnode ÉÏÒÔ¸ø¶¨µÄ·ÃÎÊģʽִÐÐ open ²Ù×÷¡£ Èç¹û³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸ö´íÎó±àÂë¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.46 mpo_check_vnode_readdir

int mpo_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, struct label *dlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
dvp ¿ÍÌ壻Ŀ¼ vnode  
dlabel dvpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÔÚ¸ø¶¨µÄĿ¼ vnode ÉÏÖ´ÐÐ readdir ²Ù×÷¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸ö´íÎó±àÂë errno¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.47 mpo_check_vnode_readlink

int mpo_check_vnode_readlink(struct ucred *cred, struct vnode *vp, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÔÚ¸ø¶¨·ûºÅÁ´½Ó vnode ÉÏÖ´ÐÐ readlink ²Ù×÷¡£³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£ ¸Ãº¯Êý¿ÉÄÜÔÚÈô¸É»·¾³Ï±»µ÷Ó㬰üÀ¨ÓÉÓû§½ø³ÌÏÔʽִÐÐµÄ readlink µ÷Ó㬠»òÕßÊÇÔÚ½ø³ÌÖ´ÐÐÃû×Ö²éѯʱÒþʽִÐÐµÄ readlink ¡£

6.7.4.48 mpo_check_vnode_revoke

int mpo_check_vnode_revoke(struct ucred *cred, struct vnode *vp, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ³·Ïú¶Ô¸ø¶¨ vnode µÄ·ÃÎÊ¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.49 mpo_check_vnode_setacl

int mpo_check_vnode_setacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type, struct acl *acl);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
type ACL ÀàÐÍ  
acl ACL  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÉèÖøø¶¨ vnode µÄ¸ø¶¨ÀàÐ굀 ACL¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.50 mpo_check_vnode_setextattr

int mpo_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
attrnamespace À©Õ¹ÊôÐÔÃû×Ö¿Õ¼ä  
name À©Õ¹ÊôÐÔÃû  
uio I/O ½á¹¹Ö¸Õ룻²Î¼û uio(9)  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÉèÖøø¶¨ vnode Éϸø¶¨Ãû×Ö¿Õ¼äÖиø¶¨Ãû×ÖµÄÀ©Õ¹ÊôÐÔµÄÖµ¡£ ʹÓÃÀ©Õ¹ÊôÐÔ±¸·Ý°²È«±ê¼ÇµÄ²ßÂÔÄ£¿é¿ÉÄÜÐèÒª¶ÔÆäʹÓõÄÊôÐÔʵʩ¶îÍâµÄ±£»¤¡£ÁíÍ⣬ ÓÉÓÚÔÚ¼ì²éºÍʵ¼Ê²Ù×÷ʱ¼ä¿ÉÄÜ´æÔڵľºÕù£¬ ²ßÂÔÄ£¿éÓ¦¸Ã±ÜÃâ¸ù¾ÝÀ´×ÔuioÖеÄÊý¾Ý×ö³ö¾ö²ß¡£ Èç¹ûÕýÔÚÖ´ÐÐÒ»¸öɾ³ý²Ù×÷£¬Ôò²ÎÊý uio µÄÖµÒ²¿ÉÄÜΪ NULL¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.51 mpo_check_vnode_setflags

int mpo_check_vnode_setflags(struct ucred *cred, struct vnode *vp, struct label *label, u_long flags);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
flags Îļþ±êÖ¾£»²Î¼û chflags(2)  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨΪ¸ø¶¨µÄ vnode ÉèÖøø¶¨µÄ±êÖ¾¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.52 mpo_check_vnode_setmode

int mpo_check_vnode_setmode(struct ucred *cred, struct vnode *vp, struct label *label, mode_t mode);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
mode Îļþģʽ£»²Î¼û chmod(2)  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ½«¸ø¶¨ vnode µÄģʽÉèÖÃΪ¸ø¶¨Öµ¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.53 mpo_check_vnode_setowner

int mpo_check_vnode_setowner(struct ucred *cred, struct vnode *vp, struct label *label, uid_t uid, gid_t gid);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  
uid Óû§ID  
gid ×éID  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ½«¸ø¶¨ vnode µÄÎļþ uid ºÍÎļþ gid ÉèÖÃΪ¸ø¶¨Öµ¡£Èç¹ûÎÞÐè¸üУ¬ Ïà¹Ø²ÎÊýÖµ¿ÉÄܱ»ÉèÖÃΪ(-1)¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.54 mpo_check_vnode_setutimes

int mpo_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct label *label, struct timespec atime, struct timespec mtime);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vp  
label vpµÄ²ßÂÔ±ê¼Ç  
atime ·ÃÎÊʱ¼ä£»²Î¼û utimes(2)  
mtime ÐÞ¸Äʱ¼ä£»²Î¼û utimes(2)  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ½«¸ø¶¨ vnode µÄ·ÃÎÊʱ¼ä±êÇ©ÉèÖÃΪ¸ø¶¨Öµ¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.55 mpo_check_proc_sched

int mpo_check_proc_sched(struct ucred *ucred, struct proc *proc);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
proc ¿ÍÌ壻½ø³Ì  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨ¸Ä±ä¸ø¶¨½ø³ÌµÄµ÷¶È²ÎÊý¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»£» ESRCH£¬ÓÃÓÚÌṩ²»¿É¼ûÐÔÖÊ¡£

¡¡¡¡See setpriority(2) for more information.

6.7.4.56 mpo_check_proc_signal

int mpo_check_proc_signal(struct ucred *cred, struct proc *proc, int signal);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
proc ¿ÍÌ壻½ø³Ì  
signal Ðźţ»²Î¼û kill(2)  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÏò¸ø¶¨½ø³Ì·¢Ë͸ø¶¨Ðźš£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻EPERM£¬ÓÃÓÚȨÏÞ²»¹»£» ESRCH£¬ÓÃÓÚÌṩ²»¿É¼ûÐÔÖÊ¡£

6.7.4.57 mpo_check_vnode_stat

int mpo_check_vnode_stat(struct ucred *cred, struct vnode *vp, struct label *label);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp ¿ÍÌ壻vnode  
label vpµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´ÊÇ·ñÓÐȨÔÚ¸ø¶¨ vnode ÉÏÖ´ÐÐ stat ²Ù×÷¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

¡¡¡¡See stat(2) for more information.

6.7.4.58 mpo_check_ifnet_transmit

int mpo_check_ifnet_transmit(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
ifnet ÍøÂç½Ó¿Ú  
ifnetlabel ifnetµÄ²ßÂÔ±ê¼Ç  
mbuf ¿ÍÌ壻½«±»·¢Ë굀 mbuf  
mbuflabel mbufµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÍøÂç½Ó¿ÚÊÇ·ñÓÐȨ´«Ë͸ø¶¨µÄ mbuf¡£³É¹¦£¬Ôò·µ»Ø 0£» ·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.59 mpo_check_socket_deliver

int mpo_check_socket_deliver(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
ifnet ÍøÂç½Ó¿Ú  
ifnetlabel ifnetµÄ²ßÂÔ±ê¼Ç  
mbuf ¿ÍÌ壻½«±»´«Ë굀 mbuf  
mbuflabel mbufµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÌ×½Ó×ÖÊÇ·ñÓÐȨ´Ó¸ø¶¨µÄ mbuf ÖнÓÊÕÊý¾Ý±¨¡£ ³É¹¦£¬Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»¡£

6.7.4.60 mpo_check_socket_visible

int mpo_check_socket_visible(struct ucred *cred, struct socket *so, struct label *socketlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´ ²»¿É¸Ä±ä
so ¿ÍÌ壻Ì×½Ó×Ö  
socketlabel soµÄ²ßÂÔ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÐÅÈÎ×´cred ÊÇ·ñÓÐȨʹÓÃϵͳ¼à¿Øº¯Êý£¬±ÈÈ磬 ÓÉnetstat(8) ºÍ sockstat(1)ʹÓõijÌÐòÀ´¹Û²ì ¸ø¶¨µÄÌ×½Ó×Ö(socket)¡£³É¹¦£¬ Ôò·µ»Ø 0£»·ñÔò£¬·µ»ØÒ»¸öerrnoÖµ¡£ ½¨ÒéʹÓõĴíÎó±àÂ룺EACCES£¬ÓÃÓÚ±ê¼Ç²»Æ¥Å䣻 EPERM£¬ÓÃÓÚȨÏÞ²»¹»£» ESRCH£¬ÓÃÓÚÌṩ²»¿É¼ûÐÔÖÊ¡£

6.7.4.61 mpo_check_system_acct

int mpo_check_system_acct(struct ucred *ucred, struct vnode *vp, struct label *vlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
ucred Ö÷ÌåÐÅÈÎ×´  
vp Éó¼ÆÎļþ£»acct(5)  
vlabel ÓëvpÏà¹ØÁªµÄ±ê¼Ç  

¡¡¡¡¸ù¾ÝÖ÷Ìå±ê¼ÇºÍÉó¼ÆÈÕÖ¾ÎļþµÄ±ê¼Ç£¬È·¶¨¸ÃÖ÷ÌåÊÇ·ñÓÐȨÆô¶¯É󼯡£

6.7.4.62 mpo_check_system_nfsd

int mpo_check_system_nfsd(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨµ÷Óà nfssvc(2)¡£

6.7.4.63 mpo_check_system_reboot

int mpo_check_system_reboot(struct ucred *cred, int howto);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
howto À´×Ô reboot(2)µÄhowto ²ÎÊý  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨÒÔÖ¸¶¨·½Ê½ÖØÆôϵͳ¡£

6.7.4.64 mpo_check_system_settime

int mpo_check_system_settime(struct ucred *cred);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  

¡¡¡¡È·¶¨Ïà¹ØÓû§ÊÇ·ñÓÐȨÉèÖÃϵͳʱÖÓ¡£

6.7.4.65 mpo_check_system_swapon

int mpo_check_system_swapon(struct ucred *cred, struct vnode *vp, struct label *vlabel);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
vp swapÉ豸  
vlabel ÓëvpÏà¹ØÁªµÄ±ê¼Ç  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓÐȨÔö¼ÓÒ»¸ö×÷ΪswapÉ豸µÄ vp ¡£

6.7.4.66 mpo_check_system_sysctl

int mpo_check_system_sysctl(struct ucred *cred, int *name, u_int *namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen);

²ÎÊý ˵Ã÷ Ëø¶¨
cred Ö÷ÌåÐÅÈÎ×´  
name ²Î¼û sysctl(3)  
namelen  
old  
oldlenp  
inkernel ²¼¶ûÐͱäÁ¿£»Èç¹û´ÓÄں˱»µ÷Óã¬ÆäÖµ±»ÖÃΪ1  
new ²Î¼û sysctl(3)  
newlen  

¡¡¡¡È·¶¨Ïà¹ØÖ÷ÌåÊÇ·ñÓ¦¸Ã±»ÔÊÐíÖ´ÐÐÖ¸¶¨µÄ sysctl(3) ÊÂÎñ¡£

6.7.5 ±ê¼Ç¹ÜÀíµ÷ÓÃ

¡¡¡¡µ±Óû§½ø³ÌÇëÇó¶Ôij¸ö¶ÔÏóµÄ±ê¼Ç½øÐÐÐÞ¸Äʱ£¬½«Òý·¢ÖØÐ±ê¼Çʼþ¡£¶ÔÓ¦µÄ¸üвÙ×÷·ÖÁ½²½½øÐУº Ê×ÏÈ£¬½øÐзÃÎÊ¿ØÖƼì²é£¬È·Èϴ˴θüвÙ×÷ÊÇÓÐЧÇÒ±»ÔÊÐíµÄ£»È»ºó£¬µ÷ÓÃÁíÒ»¸ö¶ÀÁ¢µÄÈë¿Úº¯Êý¶Ô±ê¼Ç½øÐÐÐ޸ġ£ ÖØÐ±ê¼ÇÈë¿Úº¯Êýͨ³£½ÓÊÕÓÉÇëÇó½ø³ÌÌá½»µÄ¶ÔÏó¡¢¶ÔÏó±ê¼ÇÖ¸ÕëºÍÇëÇóбê¼Ç£¬×÷ΪÊäÈë²ÎÊý¡£ ¶ÔÏóÖØÐ±ê¼Ç²Ù×÷µÄʧ°Ü½«ÓÉÏÈÆÚµÄ±ê¼Ç¼ì²é±¨¸æ£¬ËùÒÔ£¬²»ÔÊÐíÔÚ½ÓÏÂÀ´µÄ±ê¼ÇÐ޸Ĺý³ÌÖб¨¸æÊ§°Ü£¬¹Ê¶ø²»ÌᳫÔڴ˹ý³ÌÖÐзÖÅäÄÚ´æ¡£

±¾ÎĵµºÍÆäËüÎĵµ¿É´ÓÕâÀïÏÂÔØ£ºftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

Èç¹û¶ÔÓÚFreeBSDÓÐÎÊÌ⣬ÇëÏÈÔĶÁÎĵµ£¬Èç²»Äܽâ¾öÔÙÁªÏµ<questions@FreeBSD.org>.
¹ØÓÚ±¾ÎĵµµÄÎÊÌâÇë·¢ÐÅÁªÏµ <doc@FreeBSD.org>.