Assert that appropriate vnodes are locked in mac_execve_will_transition().

Allow transitioning to be twiddled off using the process and fs enforcement
flags, although at some point this should probably be its own flag.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

sys/kern/kern_mac.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_framework.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_internal.h

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_net.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_pipe.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_process.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_syscalls.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_system.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
 

sys/security/mac/mac_vfs.c

@@ -1257,6 +1257,9 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
 
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return;
+
 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
 }
 
@@ -1265,6 +1268,11 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp)
 {
 	int result;
 
+	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
 	result = 0;
 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);