Introduce a MAC label reference in 'struct inpcb', which caches

the   MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols.  This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.

This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.

For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks.  Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.

Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.

Reviewed by:	sam, bms
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

9 files changed, 362 insertions, 1 deletions

diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 8cb20ad0c774..81dad5a37ad8 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -110,7 +110,9 @@ struct componentname;
 struct devfs_dirent;
 struct ifnet;
 struct ifreq;
+struct inpcb;
 struct image_params;
+struct inpcb;
 struct ipq;
 struct m_tag;
 struct mbuf;
@@ -137,6 +139,7 @@ void	mac_init_bpfdesc(struct bpf_d *);
 void	mac_init_cred(struct ucred *);
 void	mac_init_devfsdirent(struct devfs_dirent *);
 void	mac_init_ifnet(struct ifnet *);
+int	mac_init_inpcb(struct inpcb *, int flag);
 int	mac_init_ipq(struct ipq *, int flag);
 int	mac_init_socket(struct socket *, int flag);
 void	mac_init_pipe(struct pipe *);
@@ -151,6 +154,7 @@ void	mac_destroy_bpfdesc(struct bpf_d *);
 void	mac_destroy_cred(struct ucred *);
 void	mac_destroy_devfsdirent(struct devfs_dirent *);
 void	mac_destroy_ifnet(struct ifnet *);
+void	mac_destroy_inpcb(struct inpcb *);
 void	mac_destroy_ipq(struct ipq *);
 void	mac_destroy_socket(struct socket *);
 void	mac_destroy_pipe(struct pipe *);
@@ -205,6 +209,7 @@ void	mac_create_pipe(struct ucred *cred, struct pipe *pipe);
  */
 void	mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d);
 void	mac_create_ifnet(struct ifnet *ifp);
+void	mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp);
 void	mac_create_ipq(struct mbuf *fragment, struct ipq *ipq);
 void	mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram);
 void	mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment);
@@ -219,6 +224,7 @@ int	mac_fragment_match(struct mbuf *fragment, struct ipq *ipq);
 void	mac_reflect_mbuf_icmp(struct mbuf *m);
 void	mac_reflect_mbuf_tcp(struct mbuf *m);
 void	mac_update_ipq(struct mbuf *fragment, struct ipq *ipq);
+void	mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
 
 /*
  * Labeling event operations: processes.
@@ -239,6 +245,7 @@ void	mac_thread_userret(struct thread *td);
 int	mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
 int	mac_check_cred_visible(struct ucred *u1, struct ucred *u2);
 int	mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m);
+int	mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m);
 int	mac_check_kenv_dump(struct ucred *cred);
 int	mac_check_kenv_get(struct ucred *cred, char *name);
 int	mac_check_kenv_set(struct ucred *cred, char *name, char *value);
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 7ff0d289d047..8337a19b7cd9 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -50,6 +50,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mount.h>
 #include <sys/file.h>
 #include <sys/namei.h>
+#include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
@@ -61,6 +62,7 @@ __FBSDID("$FreeBSD$");
 #include <net/if_var.h>
 
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
 #include <security/mac/mac_internal.h>
@@ -77,12 +79,14 @@ TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
 
 #ifdef MAC_DEBUG
 static unsigned int nmacmbufs, nmacifnets, nmacbpfdescs, nmacsockets,
-    nmacipqs;
+    nmacinpcbs, nmacipqs;
 
 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD,
     &nmacmbufs, 0, "number of mbufs in use");
 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD,
     &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, inpcbs, CTLFLAG_RD,
+    &nmacinpcbs, 0, "number of inpcbs in use");
 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD,
     &nmacipqs, 0, "number of ipqs in use");
 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD,
@@ -140,6 +144,35 @@ mac_init_ifnet(struct ifnet *ifp)
 }
 
 static struct label *
+mac_inpcb_label_alloc(int flag)
+{
+	struct label *label;
+	int error;
+
+	label = mac_labelzone_alloc(flag);
+	if (label == NULL)
+		return (NULL);
+	MAC_CHECK(init_inpcb_label, label, flag);
+	if (error) {
+		MAC_PERFORM(destroy_inpcb_label, label);
+		mac_labelzone_free(label);
+		return (NULL);
+	}
+	MAC_DEBUG_COUNTER_INC(&nmacinpcbs);
+	return (label);
+}
+
+int
+mac_init_inpcb(struct inpcb *inp, int flag)
+{
+
+	inp->inp_label = mac_inpcb_label_alloc(flag);
+	if (inp->inp_label == NULL)
+		return (ENOMEM);
+	return (0);
+}
+
+static struct label *
 mac_ipq_label_alloc(int flag)
 {
 	struct label *label;
@@ -308,6 +341,23 @@ mac_destroy_ifnet(struct ifnet *ifp)
 }
 
 static void
+mac_inpcb_label_free(struct label *label)
+{
+
+	MAC_PERFORM(destroy_inpcb_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacinpcbs);
+}
+
+void
+mac_destroy_inpcb(struct inpcb *inp)
+{
+
+	mac_inpcb_label_free(inp->inp_label);
+	inp->inp_label = NULL;
+}
+
+static void
 mac_ipq_label_free(struct label *label)
 {
 
@@ -447,6 +497,14 @@ mac_create_ifnet(struct ifnet *ifnet)
 }
 
 void
+mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp)
+{
+
+	MAC_PERFORM(create_inpcb_from_socket, so, so->so_label, inp,
+	    inp->inp_label);
+}
+
+void
 mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
 {
 
@@ -689,6 +747,24 @@ mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
 }
 
 int
+mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m)
+{
+	struct label *label;
+	int error;
+
+	M_ASSERTPKTHDR(m);
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	label = mbuf_to_label(m);
+
+	MAC_CHECK(check_inpcb_deliver, inp, inp->inp_label, m, label);
+
+	return (error);
+}
+
+int
 mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
     struct sockaddr *sockaddr)
 {
@@ -889,6 +965,15 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 	return (0);
 }
 
+void
+mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp)
+{
+
+	/* XXX: assert socket lock. */
+	INP_LOCK_ASSERT(inp);
+	MAC_PERFORM(inpcb_sosetlabel, so, so->so_label, inp, inp->inp_label);
+}
+
 int
 mac_socket_label_set(struct ucred *cred, struct socket *so,
     struct label *label)
@@ -900,6 +985,16 @@ mac_socket_label_set(struct ucred *cred, struct socket *so,
 		return (error);
 
 	mac_relabel_socket(cred, so, label);
+
+	/*
+	 * If the protocol has expressed interest in socket layer changes,
+	 * such as if it needs to propagate changes to a cached pcb
+	 * label from the socket, notify it of the label change while
+	 * holding the socket lock.
+	 */
+	if (so->so_proto->pr_usrreqs->pru_sosetlabel != NULL)
+		(so->so_proto->pr_usrreqs->pru_sosetlabel)(so);
+
 	return (0);
 }
 
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index 3c72d099337d..518f883c3c12 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -54,6 +54,7 @@
 struct acl;
 struct componentname;
 struct devfs_dirent;
+struct inpcb;
 struct ipq;
 struct label;
 struct mac_policy_conf;
@@ -86,6 +87,7 @@ struct mac_policy_ops {
 	void	(*mpo_init_cred_label)(struct label *label);
 	void	(*mpo_init_devfsdirent_label)(struct label *label);
 	void	(*mpo_init_ifnet_label)(struct label *label);
+	int	(*mpo_init_inpcb_label)(struct label *label, int flag);
 	int	(*mpo_init_ipq_label)(struct label *label, int flag);
 	int	(*mpo_init_mbuf_label)(struct label *label, int flag);
 	void	(*mpo_init_mount_label)(struct label *label);
@@ -99,6 +101,7 @@ struct mac_policy_ops {
 	void	(*mpo_destroy_cred_label)(struct label *label);
 	void	(*mpo_destroy_devfsdirent_label)(struct label *label);
 	void	(*mpo_destroy_ifnet_label)(struct label *label);
+	void	(*mpo_destroy_inpcb_label)(struct label *label);
 	void	(*mpo_destroy_ipq_label)(struct label *label);
 	void	(*mpo_destroy_mbuf_label)(struct label *label);
 	void	(*mpo_destroy_mount_label)(struct label *label);
@@ -212,6 +215,9 @@ struct mac_policy_ops {
 		    struct label *bpflabel);
 	void	(*mpo_create_ifnet)(struct ifnet *ifnet,
 		    struct label *ifnetlabel);
+	void	(*mpo_create_inpcb_from_socket)(struct socket *so,
+		    struct label *solabel, struct inpcb *inp,
+		    struct label *inplabel);
 	void	(*mpo_create_ipq)(struct mbuf *fragment,
 		    struct label *fragmentlabel, struct ipq *ipq,
 		    struct label *ipqlabel);
@@ -251,6 +257,9 @@ struct mac_policy_ops {
 	void	(*mpo_update_ipq)(struct mbuf *fragment,
 		    struct label *fragmentlabel, struct ipq *ipq,
 		    struct label *ipqlabel);
+	void	(*mpo_inpcb_sosetlabel)(struct socket *so,
+		    struct label *label, struct inpcb *inp,
+		    struct label *inplabel);
 
 	/*
 	 * Labeling event operations: processes.
@@ -286,6 +295,9 @@ struct mac_policy_ops {
 	int	(*mpo_check_ifnet_transmit)(struct ifnet *ifnet,
 		    struct label *ifnetlabel, struct mbuf *m,
 		    struct label *mbuflabel);
+	int	(*mpo_check_inpcb_deliver)(struct inpcb *inp,
+		    struct label *inplabel, struct mbuf *m,
+		    struct label *mlabel);
 	int	(*mpo_check_kenv_dump)(struct ucred *cred);
 	int	(*mpo_check_kenv_get)(struct ucred *cred, char *name);
 	int	(*mpo_check_kenv_set)(struct ucred *cred, char *name,
diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c
index 778532c4ef06..365c39776caa 100644
--- a/sys/security/mac_biba/mac_biba.c
+++ b/sys/security/mac_biba/mac_biba.c
@@ -69,6 +69,7 @@
 #include <net/if_var.h>
 
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
 #include <vm/vm.h>
@@ -980,6 +981,18 @@ mac_biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
  * Labeling event operations: IPC object.
  */
 static void
+mac_biba_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+	struct mac_biba *source, *dest;
+
+	source = SLOT(solabel);
+	dest = SLOT(inplabel);
+
+	mac_biba_copy_single(source, dest);
+}
+
+static void
 mac_biba_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
@@ -1299,6 +1312,18 @@ mac_biba_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 	/* NOOP: we only accept matching labels, so no need to update */
 }
 
+static void
+mac_biba_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+	struct mac_biba *source, *dest;
+
+	source = SLOT(solabel);
+	dest = SLOT(inplabel);
+
+	mac_biba_copy(source, dest);
+}
+
 /*
  * Labeling event operations: processes.
  */
@@ -1493,6 +1518,21 @@ mac_biba_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 }
 
 static int
+mac_biba_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+    struct mbuf *m, struct label *mlabel)
+{
+	struct mac_biba *p, *i;
+
+	if (!mac_biba_enabled)
+		return (0);
+
+	p = SLOT(mlabel);
+	i = SLOT(inplabel);
+
+	return (mac_biba_equal_single(p, i) ? 0 : EACCES);
+}
+
+static int
 mac_biba_check_kld_load(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
@@ -2606,6 +2646,7 @@ static struct mac_policy_ops mac_biba_ops =
 	.mpo_init_cred_label = mac_biba_init_label,
 	.mpo_init_devfsdirent_label = mac_biba_init_label,
 	.mpo_init_ifnet_label = mac_biba_init_label,
+	.mpo_init_inpcb_label = mac_biba_init_label_waitcheck,
 	.mpo_init_ipq_label = mac_biba_init_label_waitcheck,
 	.mpo_init_mbuf_label = mac_biba_init_label_waitcheck,
 	.mpo_init_mount_label = mac_biba_init_label,
@@ -2618,6 +2659,7 @@ static struct mac_policy_ops mac_biba_ops =
 	.mpo_destroy_cred_label = mac_biba_destroy_label,
 	.mpo_destroy_devfsdirent_label = mac_biba_destroy_label,
 	.mpo_destroy_ifnet_label = mac_biba_destroy_label,
+	.mpo_destroy_inpcb_label = mac_biba_destroy_label,
 	.mpo_destroy_ipq_label = mac_biba_destroy_label,
 	.mpo_destroy_mbuf_label = mac_biba_destroy_label,
 	.mpo_destroy_mount_label = mac_biba_destroy_label,
@@ -2665,6 +2707,7 @@ static struct mac_policy_ops mac_biba_ops =
 	.mpo_create_datagram_from_ipq = mac_biba_create_datagram_from_ipq,
 	.mpo_create_fragment = mac_biba_create_fragment,
 	.mpo_create_ifnet = mac_biba_create_ifnet,
+	.mpo_create_inpcb_from_socket = mac_biba_create_inpcb_from_socket,
 	.mpo_create_ipq = mac_biba_create_ipq,
 	.mpo_create_mbuf_from_mbuf = mac_biba_create_mbuf_from_mbuf,
 	.mpo_create_mbuf_linklayer = mac_biba_create_mbuf_linklayer,
@@ -2675,6 +2718,7 @@ static struct mac_policy_ops mac_biba_ops =
 	.mpo_fragment_match = mac_biba_fragment_match,
 	.mpo_relabel_ifnet = mac_biba_relabel_ifnet,
 	.mpo_update_ipq = mac_biba_update_ipq,
+	.mpo_inpcb_sosetlabel = mac_biba_inpcb_sosetlabel,
 	.mpo_create_cred = mac_biba_create_cred,
 	.mpo_create_proc0 = mac_biba_create_proc0,
 	.mpo_create_proc1 = mac_biba_create_proc1,
@@ -2684,6 +2728,7 @@ static struct mac_policy_ops mac_biba_ops =
 	.mpo_check_cred_visible = mac_biba_check_cred_visible,
 	.mpo_check_ifnet_relabel = mac_biba_check_ifnet_relabel,
 	.mpo_check_ifnet_transmit = mac_biba_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = mac_biba_check_inpcb_deliver,
 	.mpo_check_kld_load = mac_biba_check_kld_load,
 	.mpo_check_kld_unload = mac_biba_check_kld_unload,
 	.mpo_check_mount_stat = mac_biba_check_mount_stat,
diff --git a/sys/security/mac_ifoff/mac_ifoff.c b/sys/security/mac_ifoff/mac_ifoff.c
index 19bbc79b3330..c3337d4a04d2 100644
--- a/sys/security/mac_ifoff/mac_ifoff.c
+++ b/sys/security/mac_ifoff/mac_ifoff.c
@@ -143,6 +143,18 @@ mac_ifoff_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 }
 
 static int
+mac_ifoff_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+    struct mbuf *m, struct label *mlabel)
+{
+
+	M_ASSERTPKTHDR(m);
+	if (m->m_pkthdr.rcvif != NULL)
+		return (check_ifnet_incoming(m->m_pkthdr.rcvif, 0));
+
+	return (0);
+}
+
+static int
 mac_ifoff_check_socket_deliver(struct socket *so, struct label *socketlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
@@ -158,6 +170,7 @@ static struct mac_policy_ops mac_ifoff_ops =
 {
 	.mpo_check_bpfdesc_receive = mac_ifoff_check_bpfdesc_receive,
 	.mpo_check_ifnet_transmit = mac_ifoff_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = mac_ifoff_check_inpcb_deliver,
 	.mpo_check_socket_deliver = mac_ifoff_check_socket_deliver,
 };
 
diff --git a/sys/security/mac_lomac/mac_lomac.c b/sys/security/mac_lomac/mac_lomac.c
index c3ec772a410e..52eeaa6cffc6 100644
--- a/sys/security/mac_lomac/mac_lomac.c
+++ b/sys/security/mac_lomac/mac_lomac.c
@@ -70,6 +70,7 @@
 #include <net/if_var.h>
 
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
 #include <vm/vm.h>
@@ -1119,6 +1120,18 @@ mac_lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
  * Labeling event operations: IPC object.
  */
 static void
+mac_lomac_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+	struct mac_lomac *source, *dest;
+
+	source = SLOT(solabel);
+	dest = SLOT(inplabel);
+
+	mac_lomac_copy_single(source, dest);
+}
+
+static void
 mac_lomac_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
@@ -1439,6 +1452,18 @@ mac_lomac_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 	/* NOOP: we only accept matching labels, so no need to update */
 }
 
+static void
+mac_lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+	struct mac_lomac *source, *dest;
+
+	source = SLOT(solabel);
+	dest = SLOT(inplabel);
+
+	mac_lomac_copy_single(source, dest);
+}
+
 /*
  * Labeling event operations: processes.
  */
@@ -1721,6 +1746,21 @@ mac_lomac_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 }
 
 static int
+mac_lomac_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+    struct mbuf *m, struct label *mlabel)
+{
+	struct mac_lomac *p, *i;
+
+	if (!mac_lomac_enabled)
+		return (0);
+
+	p = SLOT(mlabel);
+	i = SLOT(inplabel);
+
+	return (mac_lomac_equal_single(p, i) ? 0 : EACCES);
+}
+
+static int
 mac_lomac_check_kld_load(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
@@ -2584,6 +2624,7 @@ static struct mac_policy_ops mac_lomac_ops =
 	.mpo_init_cred_label = mac_lomac_init_label,
 	.mpo_init_devfsdirent_label = mac_lomac_init_label,
 	.mpo_init_ifnet_label = mac_lomac_init_label,
+	.mpo_init_inpcb_label = mac_lomac_init_label_waitcheck,
 	.mpo_init_ipq_label = mac_lomac_init_label_waitcheck,
 	.mpo_init_mbuf_label = mac_lomac_init_label_waitcheck,
 	.mpo_init_mount_label = mac_lomac_init_label,
@@ -2597,6 +2638,7 @@ static struct mac_policy_ops mac_lomac_ops =
 	.mpo_destroy_cred_label = mac_lomac_destroy_label,
 	.mpo_destroy_devfsdirent_label = mac_lomac_destroy_label,
 	.mpo_destroy_ifnet_label = mac_lomac_destroy_label,
+	.mpo_destroy_inpcb_label = mac_lomac_destroy_label,
 	.mpo_destroy_ipq_label = mac_lomac_destroy_label,
 	.mpo_destroy_mbuf_label = mac_lomac_destroy_label,
 	.mpo_destroy_mount_label = mac_lomac_destroy_label,
@@ -2647,6 +2689,7 @@ static struct mac_policy_ops mac_lomac_ops =
 	.mpo_create_datagram_from_ipq = mac_lomac_create_datagram_from_ipq,
 	.mpo_create_fragment = mac_lomac_create_fragment,
 	.mpo_create_ifnet = mac_lomac_create_ifnet,
+	.mpo_create_inpcb_from_socket = mac_lomac_create_inpcb_from_socket,
 	.mpo_create_ipq = mac_lomac_create_ipq,
 	.mpo_create_mbuf_from_mbuf = mac_lomac_create_mbuf_from_mbuf,
 	.mpo_create_mbuf_linklayer = mac_lomac_create_mbuf_linklayer,
@@ -2658,6 +2701,7 @@ static struct mac_policy_ops mac_lomac_ops =
 	.mpo_fragment_match = mac_lomac_fragment_match,
 	.mpo_relabel_ifnet = mac_lomac_relabel_ifnet,
 	.mpo_update_ipq = mac_lomac_update_ipq,
+	.mpo_inpcb_sosetlabel = mac_lomac_inpcb_sosetlabel,
 	.mpo_create_cred = mac_lomac_create_cred,
 	.mpo_execve_transition = mac_lomac_execve_transition,
 	.mpo_execve_will_transition = mac_lomac_execve_will_transition,
@@ -2669,6 +2713,7 @@ static struct mac_policy_ops mac_lomac_ops =
 	.mpo_check_cred_visible = mac_lomac_check_cred_visible,
 	.mpo_check_ifnet_relabel = mac_lomac_check_ifnet_relabel,
 	.mpo_check_ifnet_transmit = mac_lomac_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = mac_lomac_check_inpcb_deliver,
 	.mpo_check_kld_load = mac_lomac_check_kld_load,
 	.mpo_check_kld_unload = mac_lomac_check_kld_unload,
 	.mpo_check_pipe_ioctl = mac_lomac_check_pipe_ioctl,
diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c
index cdf92bedb476..d4e763470849 100644
--- a/sys/security/mac_mls/mac_mls.c
+++ b/sys/security/mac_mls/mac_mls.c
@@ -69,6 +69,7 @@
 #include <net/if_var.h>
 
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
 #include <vm/vm.h>
@@ -950,6 +951,18 @@ mac_mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
  * Labeling event operations: IPC object.
  */
 static void
+mac_mls_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+	struct mac_mls *source, *dest;
+
+	source = SLOT(solabel);
+	dest = SLOT(inplabel);
+
+	mac_mls_copy_single(source, dest);
+}
+
+static void
 mac_mls_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
@@ -1229,6 +1242,18 @@ mac_mls_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 	/* NOOP: we only accept matching labels, so no need to update */
 }
 
+static void
+mac_mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+	struct mac_mls *source, *dest;
+
+	source = SLOT(solabel);
+	dest = SLOT(inplabel);
+
+	mac_mls_copy(source, dest);
+}
+
 /*
  * Labeling event operations: processes.
  */
@@ -1421,6 +1446,21 @@ mac_mls_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 }
 
 static int
+mac_mls_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+    struct mbuf *m, struct label *mlabel)
+{
+	struct mac_mls *p, *i;
+
+	if (!mac_mls_enabled)
+		return (0);
+
+	p = SLOT(mlabel);
+	i = SLOT(inplabel);
+
+	return (mac_mls_equal_single(p, i) ? 0 : EACCES);
+}
+
+static int
 mac_mls_check_mount_stat(struct ucred *cred, struct mount *mp,
     struct label *mntlabel)
 {
@@ -2378,6 +2418,7 @@ static struct mac_policy_ops mac_mls_ops =
 	.mpo_init_cred_label = mac_mls_init_label,
 	.mpo_init_devfsdirent_label = mac_mls_init_label,
 	.mpo_init_ifnet_label = mac_mls_init_label,
+	.mpo_init_inpcb_label = mac_mls_init_label_waitcheck,
 	.mpo_init_ipq_label = mac_mls_init_label_waitcheck,
 	.mpo_init_mbuf_label = mac_mls_init_label_waitcheck,
 	.mpo_init_mount_label = mac_mls_init_label,
@@ -2390,6 +2431,7 @@ static struct mac_policy_ops mac_mls_ops =
 	.mpo_destroy_cred_label = mac_mls_destroy_label,
 	.mpo_destroy_devfsdirent_label = mac_mls_destroy_label,
 	.mpo_destroy_ifnet_label = mac_mls_destroy_label,
+	.mpo_destroy_inpcb_label = mac_mls_destroy_label,
 	.mpo_destroy_ipq_label = mac_mls_destroy_label,
 	.mpo_destroy_mbuf_label = mac_mls_destroy_label,
 	.mpo_destroy_mount_label = mac_mls_destroy_label,
@@ -2437,6 +2479,7 @@ static struct mac_policy_ops mac_mls_ops =
 	.mpo_create_datagram_from_ipq = mac_mls_create_datagram_from_ipq,
 	.mpo_create_fragment = mac_mls_create_fragment,
 	.mpo_create_ifnet = mac_mls_create_ifnet,
+	.mpo_create_inpcb_from_socket = mac_mls_create_inpcb_from_socket,
 	.mpo_create_ipq = mac_mls_create_ipq,
 	.mpo_create_mbuf_from_mbuf = mac_mls_create_mbuf_from_mbuf,
 	.mpo_create_mbuf_linklayer = mac_mls_create_mbuf_linklayer,
@@ -2447,6 +2490,7 @@ static struct mac_policy_ops mac_mls_ops =
 	.mpo_fragment_match = mac_mls_fragment_match,
 	.mpo_relabel_ifnet = mac_mls_relabel_ifnet,
 	.mpo_update_ipq = mac_mls_update_ipq,
+	.mpo_inpcb_sosetlabel = mac_mls_inpcb_sosetlabel,
 	.mpo_create_cred = mac_mls_create_cred,
 	.mpo_create_proc0 = mac_mls_create_proc0,
 	.mpo_create_proc1 = mac_mls_create_proc1,
@@ -2456,6 +2500,7 @@ static struct mac_policy_ops mac_mls_ops =
 	.mpo_check_cred_visible = mac_mls_check_cred_visible,
 	.mpo_check_ifnet_relabel = mac_mls_check_ifnet_relabel,
 	.mpo_check_ifnet_transmit = mac_mls_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = mac_mls_check_inpcb_deliver,
 	.mpo_check_mount_stat = mac_mls_check_mount_stat,
 	.mpo_check_pipe_ioctl = mac_mls_check_pipe_ioctl,
 	.mpo_check_pipe_poll = mac_mls_check_pipe_poll,
diff --git a/sys/security/mac_stub/mac_stub.c b/sys/security/mac_stub/mac_stub.c
index 1d4821086a6f..1b6ad02beb6f 100644
--- a/sys/security/mac_stub/mac_stub.c
+++ b/sys/security/mac_stub/mac_stub.c
@@ -68,6 +68,7 @@
 #include <net/if_var.h>
 
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
 #include <vm/vm.h>
@@ -336,6 +337,13 @@ stub_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
 }
 
 static void
+stub_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+
+}
+
+static void
 stub_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
@@ -420,6 +428,13 @@ stub_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 
 }
 
+static void
+stub_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+
+}
+
 /*
  * Labeling event operations: processes.
  */
@@ -513,6 +528,14 @@ stub_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 }
 
 static int
+stub_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+    struct mbuf *m, struct label *mlabel)
+{
+
+	return (0);
+}
+
+static int
 stub_check_kenv_dump(struct ucred *cred)
 {
 
@@ -1010,6 +1033,7 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_init_cred_label = stub_init_label,
 	.mpo_init_devfsdirent_label = stub_init_label,
 	.mpo_init_ifnet_label = stub_init_label,
+	.mpo_init_inpcb_label = stub_init_label_waitcheck,
 	.mpo_init_ipq_label = stub_init_label_waitcheck,
 	.mpo_init_mbuf_label = stub_init_label_waitcheck,
 	.mpo_init_mount_label = stub_init_label,
@@ -1022,6 +1046,7 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_destroy_cred_label = stub_destroy_label,
 	.mpo_destroy_devfsdirent_label = stub_destroy_label,
 	.mpo_destroy_ifnet_label = stub_destroy_label,
+	.mpo_destroy_inpcb_label = stub_destroy_label,
 	.mpo_destroy_ipq_label = stub_destroy_label,
 	.mpo_destroy_mbuf_label = stub_destroy_label,
 	.mpo_destroy_mount_label = stub_destroy_label,
@@ -1067,6 +1092,7 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_set_socket_peer_from_socket = stub_set_socket_peer_from_socket,
 	.mpo_create_bpfdesc = stub_create_bpfdesc,
 	.mpo_create_ifnet = stub_create_ifnet,
+	.mpo_create_inpcb_from_socket = stub_create_inpcb_from_socket,
 	.mpo_create_ipq = stub_create_ipq,
 	.mpo_create_datagram_from_ipq = stub_create_datagram_from_ipq,
 	.mpo_create_fragment = stub_create_fragment,
@@ -1082,6 +1108,7 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_reflect_mbuf_tcp = stub_reflect_mbuf_tcp,
 	.mpo_relabel_ifnet = stub_relabel_ifnet,
 	.mpo_update_ipq = stub_update_ipq,
+	.mpo_inpcb_sosetlabel = stub_inpcb_sosetlabel,
 	.mpo_create_cred = stub_create_cred,
 	.mpo_execve_transition = stub_execve_transition,
 	.mpo_execve_will_transition = stub_execve_will_transition,
@@ -1094,6 +1121,7 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_check_cred_visible = stub_check_cred_visible,
 	.mpo_check_ifnet_relabel = stub_check_ifnet_relabel,
 	.mpo_check_ifnet_transmit = stub_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = stub_check_inpcb_deliver,
 	.mpo_check_kenv_dump = stub_check_kenv_dump,
 	.mpo_check_kenv_get = stub_check_kenv_get,
 	.mpo_check_kenv_set = stub_check_kenv_set,
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c
index 8b59190219d1..847c9e9044a5 100644
--- a/sys/security/mac_test/mac_test.c
+++ b/sys/security/mac_test/mac_test.c
@@ -81,6 +81,7 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW,
 #define	BPFMAGIC	0xfe1ad1b6
 #define	DEVFSMAGIC	0x9ee79c32
 #define	IFNETMAGIC	0xc218b120
+#define	INPCBMAGIC	0x4440f7bb
 #define	IPQMAGIC	0x206188ef
 #define	MBUFMAGIC	0xbbefa5bb
 #define	MOUNTMAGIC	0xc7c46e47
@@ -99,6 +100,8 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW,
 	SLOT(x) == 0, ("%s: Bad DEVFS label", __func__ ))
 #define	ASSERT_IFNET_LABEL(x)	KASSERT(SLOT(x) == IFNETMAGIC ||	\
 	SLOT(x) == 0, ("%s: Bad IFNET label", __func__ ))
+#define	ASSERT_INPCB_LABEL(x)	KASSERT(SLOT(x) == INPCBMAGIC ||	\
+	SLOT(x) == 0, ("%s: Bad INPCB label", __func__ ))
 #define	ASSERT_IPQ_LABEL(x)	KASSERT(SLOT(x) == IPQMAGIC ||	\
 	SLOT(x) == 0, ("%s: Bad IPQ label", __func__ ))
 #define	ASSERT_MBUF_LABEL(x)	KASSERT(SLOT(x) == MBUFMAGIC ||		\
@@ -132,6 +135,9 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD,
 static int	init_count_ifnet;
 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD,
     &init_count_ifnet, 0, "ifnet init calls");
+static int	init_count_inpcb;
+SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_inpcb, CTLFLAG_RD,
+    &init_count_inpcb, 0, "inpcb init calls");
 static int	init_count_ipq;
 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD,
     &init_count_ipq, 0, "ipq init calls");
@@ -173,6 +179,9 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD,
 static int	destroy_count_ifnet;
 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD,
     &destroy_count_ifnet, 0, "ifnet destroy calls");
+static int	destroy_count_inpcb;
+SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_inpcb, CTLFLAG_RD,
+    &destroy_count_inpcb, 0, "inpcb destroy calls");
 static int	destroy_count_ipq;
 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD,
     &destroy_count_ipq, 0, "ipq destroy calls");
@@ -268,6 +277,20 @@ mac_test_init_ifnet_label(struct label *label)
 }
 
 static int
+mac_test_init_inpcb_label(struct label *label, int flag)
+{
+
+	if (flag & M_WAITOK)
+		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
+		    "mac_test_init_inpcb_label() at %s:%d", __FILE__,
+		    __LINE__);
+
+	SLOT(label) = INPCBMAGIC;
+	atomic_add_int(&init_count_inpcb, 1);
+	return (0);
+}
+
+static int
 mac_test_init_ipq_label(struct label *label, int flag)
 {
 
@@ -420,6 +443,20 @@ mac_test_destroy_ifnet_label(struct label *label)
 }
 
 static void
+mac_test_destroy_inpcb_label(struct label *label)
+{
+
+	if (SLOT(label) == INPCBMAGIC || SLOT(label) == 0) {
+		atomic_add_int(&destroy_count_inpcb, 1);
+		SLOT(label) = EXMAGIC;
+	} else if (SLOT(label) == EXMAGIC) {
+		Debugger("mac_test_destroy_inpcb: dup destroy");
+	} else {
+		Debugger("mac_test_destroy_inpcb: corrupted label");
+	}
+}
+
+static void
 mac_test_destroy_ipq_label(struct label *label)
 {
 
@@ -852,6 +889,15 @@ mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
 }
 
 static void
+mac_test_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+
+	ASSERT_SOCKET_LABEL(solabel);
+	ASSERT_INPCB_LABEL(inplabel);
+}
+
+static void
 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
@@ -962,6 +1008,15 @@ mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 	ASSERT_IPQ_LABEL(ipqlabel);
 }
 
+static void
+mac_test_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+    struct inpcb *inp, struct label *inplabel)
+{
+
+	ASSERT_SOCKET_LABEL(solabel);
+	ASSERT_INPCB_LABEL(inplabel);
+}
+
 /*
  * Labeling event operations: processes.
  */
@@ -1094,6 +1149,17 @@ mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 }
 
 static int
+mac_test_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+    struct mbuf *m, struct label *mlabel)
+{
+
+	ASSERT_INPCB_LABEL(inplabel);
+	ASSERT_MBUF_LABEL(mlabel);
+
+	return (0);
+}
+
+static int
 mac_test_check_kenv_dump(struct ucred *cred)
 {
 
@@ -1789,6 +1855,7 @@ static struct mac_policy_ops mac_test_ops =
 	.mpo_init_cred_label = mac_test_init_cred_label,
 	.mpo_init_devfsdirent_label = mac_test_init_devfsdirent_label,
 	.mpo_init_ifnet_label = mac_test_init_ifnet_label,
+	.mpo_init_inpcb_label = mac_test_init_inpcb_label,
 	.mpo_init_ipq_label = mac_test_init_ipq_label,
 	.mpo_init_mbuf_label = mac_test_init_mbuf_label,
 	.mpo_init_mount_label = mac_test_init_mount_label,
@@ -1802,6 +1869,7 @@ static struct mac_policy_ops mac_test_ops =
 	.mpo_destroy_cred_label = mac_test_destroy_cred_label,
 	.mpo_destroy_devfsdirent_label = mac_test_destroy_devfsdirent_label,
 	.mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label,
+	.mpo_destroy_inpcb_label = mac_test_destroy_inpcb_label,
 	.mpo_destroy_ipq_label = mac_test_destroy_ipq_label,
 	.mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label,
 	.mpo_destroy_mount_label = mac_test_destroy_mount_label,
@@ -1848,6 +1916,7 @@ static struct mac_policy_ops mac_test_ops =
 	.mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket,
 	.mpo_create_bpfdesc = mac_test_create_bpfdesc,
 	.mpo_create_ifnet = mac_test_create_ifnet,
+	.mpo_create_inpcb_from_socket = mac_test_create_inpcb_from_socket,
 	.mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq,
 	.mpo_create_fragment = mac_test_create_fragment,
 	.mpo_create_ipq = mac_test_create_ipq,
@@ -1862,6 +1931,7 @@ static struct mac_policy_ops mac_test_ops =
 	.mpo_reflect_mbuf_tcp = mac_test_reflect_mbuf_tcp,
 	.mpo_relabel_ifnet = mac_test_relabel_ifnet,
 	.mpo_update_ipq = mac_test_update_ipq,
+	.mpo_inpcb_sosetlabel = mac_test_inpcb_sosetlabel,
 	.mpo_create_cred = mac_test_create_cred,
 	.mpo_execve_transition = mac_test_execve_transition,
 	.mpo_execve_will_transition = mac_test_execve_will_transition,
@@ -1874,6 +1944,7 @@ static struct mac_policy_ops mac_test_ops =
 	.mpo_check_cred_visible = mac_test_check_cred_visible,
 	.mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel,
 	.mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = mac_test_check_inpcb_deliver,
 	.mpo_check_kenv_dump = mac_test_check_kenv_dump,
 	.mpo_check_kenv_get = mac_test_check_kenv_get,
 	.mpo_check_kenv_set = mac_test_check_kenv_set,