kern: mac: add various jail MAC hooks
This adds the following hooks:
- mpo_prison_check_attach: check for subject capability to attach to a given jail
- mpo_prison_check_create: check for subject capability to create a jail with the given option set
- mpo_prison_check_get: check for subject capability to fetch the given parameters for a jail
- mpo_prison_check_set: check for subject capability to set the given parameters for a jail
- mpo_prison_check_remove: check for subject capability to remove the jail
check_get wouldn't typically be a privileged operation, but is included
to give MAC policies a wider range of capabilities at a relatively low
cost. We also add two more for the purpose of label propagation:
- mpo_prison_created: surface the creation of a jail so that one can do propagation to, e.g., the root vnode or any mounts
- mpo_prison_attached: attach an existing process to the jail so that one can propagate the jail label to the process, as appropriate.
It is unclear if this is preferred vs. having separate associate entry
points for each type of object we might associate. That would split
these up like so:
- prison_created -> prison_associate_vnode
- prison_attached -> prison_associate_proc
Some sample policy ideas that should be feasible to implement with this
set of hooks, in case it's inspiring:
- mac_bomb: policy that allows a poudriere user to construct jails without root privilege, given a restricted set of jail parameters. Slap a warning label on it.
- mac_capsule: policy that realizes the capsule idea that I pitched[0] on -jail@ to create jails that are effectively immutable once sealed, using these hooks and a label.
Perhaps a silly idea, but a downstream could consider a scenario where
it can implement special jail enumeration using a MAC policy and a
cooperating application that specifies non-parameter options to filter
the results.
[0] https://lists.freebsd.org/archives/freebsd-jail/2025-September/000550.html
Reviewed by: olce (slightly earlier version)
Differential Revision: https://reviews.freebsd.org/D53954