Add mac_grantbylabel

[sjg]

Summary

This module allows controlled privilege escallation via mac labels
securely associated with a process via mac_veriexec.

There are over 700 PRIV_* but we can compress many of them into
a single GBL_* thus constraining the size of gbl labels.

The goal is to allow a daemon to run as an unprivileged process while
still being able a set of privileged operations needed.

We add APIs to libveriexec so that userland processes can check labels
and an exec_script API that allows a suitably labeled process to run
something like a python interpreter directly if necessary;
overcomming the 'indirect' flag applied to the interpreter.

[sjg]

Missed two files

[sjg]

Use SPDX

[sjg]

Use correct MAC_VERIEXEC_VERSION in MODULE_DEPEND

[sjg]

Add veriexec_get_{path,pid}_label

[sjg]

Add -l option to veriexec

[sjg]

Update copyright year

[stevek]

sys/security/mac_grantbylabel/mac_grantbylabel.c

59

This sysctl and variable used by it should be under #ifdef MAC_DEBUG since the MAC_GRANTBYLABEL_DBG is only filled out when MAC_DEBUG is defined.

65

This line looks like it ran a bit long?

500

Either drop this bit entirely and use MPC_LOADTIME_FLAG_NOTLATE or add MAC_GRANTBYLABEL_DEBUG to the "options"

[sjg]

Cleanup per feedback

[sjg]

Update more copyright years

[sjg]

rebase and remove $FreeBSD$

[sjg]

If someone could explain the rubbish about libveriexc.h being copied to mac_grantbylabel.h