]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * Copyright (c) 2018 Apple Inc. All rights reserved. | |
3 | * | |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ | |
5 | * | |
6 | * This file contains Original Code and/or Modifications of Original Code | |
7 | * as defined in and that are subject to the Apple Public Source License | |
8 | * Version 2.0 (the 'License'). You may not use this file except in | |
9 | * compliance with the License. The rights granted to you under the License | |
10 | * may not be used to create, or enable the creation or redistribution of, | |
11 | * unlawful or unlicensed copies of an Apple operating system, or to | |
12 | * circumvent, violate, or enable the circumvention or violation of, any | |
13 | * terms of an Apple operating system software license agreement. | |
14 | * | |
15 | * Please obtain a copy of the License at | |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. | |
17 | * | |
18 | * The Original Code and all software distributed under the License are | |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER | |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, | |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, | |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. | |
23 | * Please see the License for the specific language governing rights and | |
24 | * limitations under the License. | |
25 | * | |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ | |
27 | */ | |
28 | ||
29 | #ifndef _SYS_GUARDED_H_ | |
30 | #define _SYS_GUARDED_H_ | |
31 | ||
32 | #include <sys/types.h> | |
33 | #include <sys/cdefs.h> | |
34 | ||
35 | #include <sys/_types/_iovec_t.h> | |
36 | #ifdef PRIVATE | |
37 | ||
38 | __BEGIN_DECLS | |
39 | ||
40 | #if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE) | |
41 | ||
42 | #ifndef _GUARDID_T | |
43 | #define _GUARDID_T | |
44 | typedef __uint64_t guardid_t; | |
45 | #endif /* _GUARDID_T */ | |
46 | ||
47 | #if !defined(KERNEL) | |
48 | extern int guarded_open_np(const char *path, | |
49 | const guardid_t *guard, u_int guardflags, int flags, ...); | |
50 | extern int guarded_open_dprotected_np(const char *path, | |
51 | const guardid_t *guard, u_int guardflags, int flags, | |
52 | int dpclass, int dpflags, ...); | |
53 | extern int guarded_kqueue_np(const guardid_t *guard, u_int guardflags); | |
54 | extern int guarded_close_np(int fd, const guardid_t *guard); | |
55 | extern int change_fdguard_np(int fd, const guardid_t *guard, u_int guardflags, | |
56 | const guardid_t *nguard, u_int nguardflags, int *fdflagsp); | |
57 | extern ssize_t guarded_write_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte); | |
58 | extern ssize_t guarded_pwrite_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte, off_t offset); | |
59 | extern ssize_t guarded_writev_np(int fd, const guardid_t *guard, const struct iovec *iovp, int iovcnt); | |
60 | #endif /* KERNEL */ | |
61 | ||
62 | #ifndef GUARD_TYPE_FD | |
63 | /* temporary source compat: use <kern/exc_guard.h> instead */ | |
64 | #define GUARD_TYPE_FD 0x2 | |
65 | #endif | |
66 | ||
67 | /* | |
68 | * File descriptor guard flavors. | |
69 | */ | |
70 | ||
71 | /* | |
72 | * Forbid close(2), and the implicit close() that a dup2(2) may do. | |
73 | * Forces close-on-fork to be set immutably too. | |
74 | */ | |
75 | #define GUARD_CLOSE (1u << 0) | |
76 | ||
77 | /* | |
78 | * Forbid dup(2), dup2(2), and fcntl(2) subcodes F_DUPFD, F_DUPFD_CLOEXEC | |
79 | * on a guarded fd. Also forbids open's of a guarded fd via /dev/fd/ | |
80 | * (an implicit dup.) | |
81 | */ | |
82 | #define GUARD_DUP (1u << 1) | |
83 | ||
84 | /* | |
85 | * Forbid sending a guarded fd via a socket | |
86 | */ | |
87 | #define GUARD_SOCKET_IPC (1u << 2) | |
88 | ||
89 | /* | |
90 | * Forbid creating a fileport from a guarded fd | |
91 | */ | |
92 | #define GUARD_FILEPORT (1u << 3) | |
93 | ||
94 | /* | |
95 | * Forbid writes on a guarded fd | |
96 | */ | |
97 | #define GUARD_WRITE (1u << 4) | |
98 | ||
99 | /* | |
100 | * Violating a guard results in an error (EPERM), and potentially | |
101 | * an exception with one or more of the following bits set. | |
102 | */ | |
103 | enum guard_fd_exception_codes { | |
104 | kGUARD_EXC_CLOSE = 1u << 0, /* close of a guarded fd */ | |
105 | kGUARD_EXC_DUP = 1u << 1, /* dup of a guarded fd */ | |
106 | kGUARD_EXC_NOCLOEXEC = 1u << 2, /* clear close-on-exec */ | |
107 | kGUARD_EXC_SOCKET_IPC = 1u << 3, /* sendmsg of a guarded fd */ | |
108 | kGUARD_EXC_FILEPORT = 1u << 4, /* fileport_makeport .. */ | |
109 | kGUARD_EXC_MISMATCH = 1u << 5, /* wrong guard for guarded fd */ | |
110 | kGUARD_EXC_WRITE = 1u << 6 /* write on a guarded fd */ | |
111 | }; | |
112 | ||
113 | /* | |
114 | * Experimental guarded vnode support | |
115 | */ | |
116 | #define VNG_RENAME_TO (1u << 0) | |
117 | #define VNG_RENAME_FROM (1u << 1) | |
118 | #define VNG_UNLINK (1u << 2) | |
119 | #define VNG_WRITE_OTHER (1u << 3) | |
120 | #define VNG_TRUNC_OTHER (1u << 4) | |
121 | #define VNG_LINK (1u << 5) | |
122 | #define VNG_EXCHDATA (1u << 6) | |
123 | ||
124 | #define VNG_ALL \ | |
125 | (VNG_RENAME_TO | VNG_RENAME_FROM | VNG_UNLINK | VNG_LINK | \ | |
126 | VNG_WRITE_OTHER | VNG_TRUNC_OTHER | VNG_EXCHDATA) | |
127 | ||
128 | struct vnguard_set { | |
129 | int vns_fd; | |
130 | unsigned vns_attrs; | |
131 | guardid_t vns_guard; | |
132 | }; | |
133 | ||
134 | struct vnguard_getattr { | |
135 | int vga_fd; /* in */ | |
136 | unsigned vga_attrs; /* out */ | |
137 | guardid_t vga_guard; /* in */ | |
138 | }; | |
139 | ||
140 | #define VNG_SYSC_PING 0 | |
141 | #define VNG_SYSC_SET_GUARD 1 | |
142 | #define VNG_SYSC_GET_ATTR 2 | |
143 | ||
144 | #define VNG_POLICY_NAME "vnguard" | |
145 | ||
146 | /* | |
147 | * Violating a guard may result in an error (EPERM), and potentially | |
148 | * an exception with one or more of the following bits set. | |
149 | */ | |
150 | enum guard_vn_exception_codes { | |
151 | kGUARD_EXC_RENAME_TO = VNG_RENAME_TO, | |
152 | kGUARD_EXC_RENAME_FROM = VNG_RENAME_FROM, | |
153 | kGUARD_EXC_UNLINK = VNG_UNLINK, | |
154 | kGUARD_EXC_WRITE_OTHER = VNG_WRITE_OTHER, | |
155 | kGUARD_EXC_TRUNC_OTHER = VNG_TRUNC_OTHER, | |
156 | kGUARD_EXC_LINK = VNG_LINK, | |
157 | kGUARD_EXC_EXCHDATA = VNG_EXCHDATA, | |
158 | }; | |
159 | ||
160 | /* Guard violation behaviors: not all combinations make sense */ | |
161 | ||
162 | #define kVNG_POLICY_LOGMSG (1u << 0) | |
163 | #define kVNG_POLICY_EPERM (1u << 1) | |
164 | #define kVNG_POLICY_EXC (1u << 2) | |
165 | #define kVNG_POLICY_EXC_CORPSE (1u << 3) | |
166 | #define kVNG_POLICY_SIGKILL (1u << 4) | |
167 | #define kVNG_POLICY_UPRINTMSG (1u << 5) | |
168 | ||
169 | #if defined(KERNEL) | |
170 | extern int vnguard_exceptions_active(void); | |
171 | extern void vnguard_policy_init(void); | |
172 | #endif /* KERNEL */ | |
173 | ||
174 | #endif /* (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */ | |
175 | ||
176 | __END_DECLS | |
177 | ||
178 | #endif /* PRIVATE */ | |
179 | ||
180 | #endif /* !_SYS_GUARDED_H_ */ |