| | 1 | /* |
| | 2 | * Copyright (c) 2007 Apple Inc. All rights reserved. |
| | 3 | * |
| | 4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
| | 5 | * |
| | 6 | * This file contains Original Code and/or Modifications of Original Code |
| | 7 | * as defined in and that are subject to the Apple Public Source License |
| | 8 | * Version 2.0 (the 'License'). You may not use this file except in |
| | 9 | * compliance with the License. The rights granted to you under the License |
| | 10 | * may not be used to create, or enable the creation or redistribution of, |
| | 11 | * unlawful or unlicensed copies of an Apple operating system, or to |
| | 12 | * circumvent, violate, or enable the circumvention or violation of, any |
| | 13 | * terms of an Apple operating system software license agreement. |
| | 14 | * |
| | 15 | * Please obtain a copy of the License at |
| | 16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
| | 17 | * |
| | 18 | * The Original Code and all software distributed under the License are |
| | 19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
| | 20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
| | 21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
| | 22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
| | 23 | * Please see the License for the specific language governing rights and |
| | 24 | * limitations under the License. |
| | 25 | * |
| | 26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
| | 27 | */ |
| | 28 | /*- |
| | 29 | * Copyright (c) 1999-2002 Robert N. M. Watson |
| | 30 | * Copyright (c) 2001-2005 Networks Associates Technology, Inc. |
| | 31 | * Copyright (c) 2005-2007 SPARTA, Inc. |
| | 32 | * All rights reserved. |
| | 33 | * |
| | 34 | * This software was developed by Robert Watson for the TrustedBSD Project. |
| | 35 | * |
| | 36 | * This software was developed for the FreeBSD Project in part by Network |
| | 37 | * Associates Laboratories, the Security Research Division of Network |
| | 38 | * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), |
| | 39 | * as part of the DARPA CHATS research program. |
| | 40 | * |
| | 41 | * This software was enhanced by SPARTA ISSO under SPAWAR contract |
| | 42 | * N66001-04-C-6019 ("SEFOS"). |
| | 43 | * |
| | 44 | * Redistribution and use in source and binary forms, with or without |
| | 45 | * modification, are permitted provided that the following conditions |
| | 46 | * are met: |
| | 47 | * 1. Redistributions of source code must retain the above copyright |
| | 48 | * notice, this list of conditions and the following disclaimer. |
| | 49 | * 2. Redistributions in binary form must reproduce the above copyright |
| | 50 | * notice, this list of conditions and the following disclaimer in the |
| | 51 | * documentation and/or other materials provided with the distribution. |
| | 52 | * |
| | 53 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND |
| | 54 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| | 55 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| | 56 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| | 57 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| | 58 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| | 59 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| | 60 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| | 61 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| | 62 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| | 63 | * SUCH DAMAGE. |
| | 64 | * |
| | 65 | * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $ |
| | 66 | * |
| | 67 | */ |
| | 68 | /* |
| | 69 | * Kernel interface for Mandatory Access Control -- how kernel services |
| | 70 | * interact with the TrustedBSD MAC Framework. |
| | 71 | */ |
| | 72 | |
| | 73 | #ifndef _SECURITY_MAC_FRAMEWORK_H_ |
| | 74 | #define _SECURITY_MAC_FRAMEWORK_H_ |
| | 75 | |
| | 76 | #ifndef KERNEL |
| | 77 | #error "no user-serviceable parts inside" |
| | 78 | #endif |
| | 79 | |
| | 80 | #ifndef PRIVATE |
| | 81 | #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" |
| | 82 | #endif |
| | 83 | |
| | 84 | struct attrlist; |
| | 85 | struct auditinfo; |
| | 86 | struct componentname; |
| | 87 | struct cs_blob; |
| | 88 | struct devnode; |
| | 89 | struct exception_action; |
| | 90 | struct flock; |
| | 91 | struct fdescnode; |
| | 92 | struct fileglob; |
| | 93 | struct fileproc; |
| | 94 | struct ifreq; |
| | 95 | struct image_params; |
| | 96 | struct ipc_port; |
| | 97 | struct knote; |
| | 98 | struct mac; |
| | 99 | struct msg; |
| | 100 | struct msqid_kernel; |
| | 101 | struct mount; |
| | 102 | struct pipe; |
| | 103 | struct proc; |
| | 104 | struct pseminfo; |
| | 105 | struct pshminfo; |
| | 106 | struct semid_kernel; |
| | 107 | struct shmid_kernel; |
| | 108 | struct sockaddr; |
| | 109 | struct sockopt; |
| | 110 | struct socket; |
| | 111 | struct task; |
| | 112 | struct thread; |
| | 113 | struct timespec; |
| | 114 | struct tty; |
| | 115 | struct ucred; |
| | 116 | struct uio; |
| | 117 | struct uthread; |
| | 118 | struct vfs_attr; |
| | 119 | struct vfs_context; |
| | 120 | struct vnode; |
| | 121 | struct vnode_attr; |
| | 122 | struct vop_setlabel_args; |
| | 123 | |
| | 124 | #include <stdbool.h> |
| | 125 | #include <sys/kauth.h> |
| | 126 | #include <sys/kernel_types.h> |
| | 127 | |
| | 128 | #if CONFIG_MACF |
| | 129 | |
| | 130 | #ifndef __IOKIT_PORTS_DEFINED__ |
| | 131 | #define __IOKIT_PORTS_DEFINED__ |
| | 132 | #ifdef __cplusplus |
| | 133 | class OSObject; |
| | 134 | typedef OSObject *io_object_t; |
| | 135 | #else |
| | 136 | struct OSObject; |
| | 137 | typedef struct OSObject *io_object_t; |
| | 138 | #endif |
| | 139 | #endif /* __IOKIT_PORTS_DEFINED__ */ |
| | 140 | |
| | 141 | /*@ macros */ |
| | 142 | #define VNODE_LABEL_CREATE 1 |
| | 143 | |
| | 144 | /*@ === */ |
| | 145 | int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode, |
| | 146 | void *args, int error, int retval, int mac_forced) __result_use_check; |
| | 147 | int mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode, |
| | 148 | void *args) __result_use_check; |
| | 149 | int mac_cred_check_label_update(kauth_cred_t cred, |
| | 150 | struct label *newlabel) __result_use_check; |
| | 151 | int mac_cred_check_label_update_execve(vfs_context_t ctx, |
| | 152 | struct vnode *vp, off_t offset, struct vnode *scriptvp, |
| | 153 | struct label *scriptvnodelabel, struct label *execlabel, |
| | 154 | proc_t proc, void *macextensions) __result_use_check; |
| | 155 | int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2) __result_use_check; |
| | 156 | struct label *mac_cred_label_alloc(void); |
| | 157 | void mac_cred_label_associate(kauth_cred_t cred_parent, |
| | 158 | kauth_cred_t cred_child); |
| | 159 | void mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child); |
| | 160 | void mac_cred_label_associate_kernel(kauth_cred_t cred); |
| | 161 | void mac_cred_label_associate_user(kauth_cred_t cred); |
| | 162 | void mac_cred_label_destroy(kauth_cred_t cred); |
| | 163 | int mac_cred_label_externalize_audit(proc_t p, struct mac *mac) __result_use_check; |
| | 164 | void mac_cred_label_free(struct label *label); |
| | 165 | void mac_cred_label_init(kauth_cred_t cred); |
| | 166 | bool mac_cred_label_is_equal(const struct label *a, const struct label *b) __result_use_check; |
| | 167 | uint32_t mac_cred_label_hash_update(const struct label *a, uint32_t hash); |
| | 168 | void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel); |
| | 169 | void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred, |
| | 170 | struct vnode *vp, off_t offset, struct vnode *scriptvp, |
| | 171 | struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags, |
| | 172 | void *macextensions, int *disjoint, int *labelupdateerror); |
| | 173 | void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, |
| | 174 | const char *fullpath); |
| | 175 | void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, |
| | 176 | struct devnode *de, const char *fullpath); |
| | 177 | void mac_devfs_label_copy(struct label *, struct label *label); |
| | 178 | void mac_devfs_label_destroy(struct devnode *de); |
| | 179 | void mac_devfs_label_init(struct devnode *de); |
| | 180 | void mac_devfs_label_update(struct mount *mp, struct devnode *de, |
| | 181 | struct vnode *vp); |
| | 182 | int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp) __result_use_check; |
| | 183 | int mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check; |
| | 184 | int mac_file_check_create(kauth_cred_t cred) __result_use_check; |
| | 185 | int mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd) __result_use_check; |
| | 186 | int mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd, |
| | 187 | user_long_t arg) __result_use_check; |
| | 188 | int mac_file_check_get(kauth_cred_t cred, struct fileglob *fg, |
| | 189 | char *elements, size_t len) __result_use_check; |
| | 190 | int mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check; |
| | 191 | int mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg) __result_use_check; |
| | 192 | int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg, |
| | 193 | unsigned long cmd) __result_use_check; |
| | 194 | int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op, |
| | 195 | struct flock *fl) __result_use_check; |
| | 196 | int mac_file_check_library_validation(struct proc *proc, |
| | 197 | struct fileglob *fg, off_t slice_offset, |
| | 198 | user_long_t error_message, size_t error_message_size) __result_use_check; |
| | 199 | int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg, |
| | 200 | int prot, int flags, uint64_t file_pos, int *maxprot) __result_use_check; |
| | 201 | void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg, |
| | 202 | int *prot); |
| | 203 | int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg) __result_use_check; |
| | 204 | int mac_file_check_set(kauth_cred_t cred, struct fileglob *fg, |
| | 205 | char *bufp, size_t buflen) __result_use_check; |
| | 206 | void mac_file_notify_close(struct ucred *cred, struct fileglob *fg); |
| | 207 | void mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg); |
| | 208 | void mac_file_label_destroy(struct fileglob *fg); |
| | 209 | void mac_file_label_init(struct fileglob *fg); |
| | 210 | int mac_iokit_check_open_service(kauth_cred_t cred, io_object_t service, unsigned int user_client_type) __result_use_check; |
| | 211 | int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type) __result_use_check; |
| | 212 | int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties) __result_use_check; |
| | 213 | int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry) __result_use_check; |
| | 214 | int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name) __result_use_check; |
| | 215 | #ifdef KERNEL_PRIVATE |
| | 216 | int mac_iokit_check_hid_control(kauth_cred_t cred) __result_use_check; |
| | 217 | #endif |
| | 218 | int mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, |
| | 219 | unsigned long cmd) __result_use_check; |
| | 220 | int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, |
| | 221 | struct vfs_attr *vfa) __result_use_check; |
| | 222 | int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp) __result_use_check; |
| | 223 | int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, |
| | 224 | struct componentname *cnp, const char *vfc_name) __result_use_check; |
| | 225 | int mac_mount_check_mount_late(vfs_context_t ctx, struct mount *mp) __result_use_check; |
| | 226 | int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp, |
| | 227 | const char *name) __result_use_check; |
| | 228 | int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp, |
| | 229 | const char *name) __result_use_check; |
| | 230 | #ifdef KERNEL_PRIVATE |
| | 231 | int mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp, |
| | 232 | struct vnode *vp, struct componentname *cnp, const char *name, |
| | 233 | const char *vfc_name) __result_use_check; |
| | 234 | #endif |
| | 235 | int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp, |
| | 236 | const char *name) __result_use_check; |
| | 237 | int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) __result_use_check; |
| | 238 | int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, |
| | 239 | struct vfs_attr *vfa) __result_use_check; |
| | 240 | int mac_mount_check_stat(vfs_context_t ctx, struct mount *mp) __result_use_check; |
| | 241 | int mac_mount_check_umount(vfs_context_t ctx, struct mount *mp) __result_use_check; |
| | 242 | void mac_mount_label_associate(vfs_context_t ctx, struct mount *mp); |
| | 243 | void mac_mount_label_destroy(struct mount *mp); |
| | 244 | int mac_mount_label_externalize(struct label *label, char *elements, |
| | 245 | char *outbuf, size_t outbuflen) __result_use_check; |
| | 246 | int mac_mount_label_get(struct mount *mp, user_addr_t mac_p) __result_use_check; |
| | 247 | void mac_mount_label_init(struct mount *); |
| | 248 | int mac_mount_label_internalize(struct label *, char *string) __result_use_check; |
| | 249 | int mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe, |
| | 250 | unsigned long cmd) __result_use_check; |
| | 251 | int mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn, |
| | 252 | struct pipe *cpipe) __result_use_check; |
| | 253 | int mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe) __result_use_check; |
| | 254 | int mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe, |
| | 255 | int which) __result_use_check; |
| | 256 | int mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe) __result_use_check; |
| | 257 | int mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe) __result_use_check; |
| | 258 | struct label *mac_pipe_label_alloc(void); |
| | 259 | void mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe); |
| | 260 | void mac_pipe_label_destroy(struct pipe *cpipe); |
| | 261 | void mac_pipe_label_free(struct label *label); |
| | 262 | void mac_pipe_label_init(struct pipe *cpipe); |
| | 263 | void mac_policy_initbsd(void); |
| | 264 | int mac_posixsem_check_create(kauth_cred_t cred, const char *name) __result_use_check; |
| | 265 | int mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem) __result_use_check; |
| | 266 | int mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem) __result_use_check; |
| | 267 | int mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem, |
| | 268 | const char *name) __result_use_check; |
| | 269 | int mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem) __result_use_check; |
| | 270 | void mac_posixsem_vnode_label_associate(kauth_cred_t cred, |
| | 271 | struct pseminfo *psem, struct label *plabel, |
| | 272 | vnode_t vp, struct label *vlabel); |
| | 273 | void mac_posixsem_label_associate(kauth_cred_t cred, |
| | 274 | struct pseminfo *psem, const char *name); |
| | 275 | void mac_posixsem_label_destroy(struct pseminfo *psem); |
| | 276 | void mac_posixsem_label_init(struct pseminfo *psem); |
| | 277 | int mac_posixshm_check_create(kauth_cred_t cred, const char *name) __result_use_check; |
| | 278 | int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm, |
| | 279 | int prot, int flags) __result_use_check; |
| | 280 | int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm, |
| | 281 | int fflags) __result_use_check; |
| | 282 | int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm) __result_use_check; |
| | 283 | int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm, |
| | 284 | off_t s) __result_use_check; |
| | 285 | int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm, |
| | 286 | const char *name) __result_use_check; |
| | 287 | void mac_posixshm_vnode_label_associate(kauth_cred_t cred, |
| | 288 | struct pshminfo *pshm, struct label *plabel, |
| | 289 | vnode_t vp, struct label *vlabel); |
| | 290 | void mac_posixshm_label_associate(kauth_cred_t cred, |
| | 291 | struct pshminfo *pshm, const char *name); |
| | 292 | void mac_posixshm_label_destroy(struct pshminfo *pshm); |
| | 293 | void mac_posixshm_label_init(struct pshminfo *pshm); |
| | 294 | int mac_priv_check(kauth_cred_t cred, int priv) __result_use_check; |
| | 295 | int mac_priv_grant(kauth_cred_t cred, int priv) __result_use_check; |
| | 296 | int mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident) __result_use_check; |
| | 297 | int mac_proc_check_dump_core(proc_t proc) __result_use_check; |
| | 298 | int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor) __result_use_check; |
| | 299 | int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check; |
| | 300 | int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check; |
| | 301 | int mac_proc_check_fork(proc_t proc) __result_use_check; |
| | 302 | int mac_proc_check_suspend_resume(proc_t proc, int sr) __result_use_check; |
| | 303 | int mac_proc_check_get_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check; |
| | 304 | int mac_proc_check_expose_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check; |
| | 305 | int mac_proc_check_get_movable_control_port(void) __result_use_check; |
| | 306 | int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp) __result_use_check; |
| | 307 | int mac_proc_check_getaudit(proc_t proc) __result_use_check; |
| | 308 | int mac_proc_check_getauid(proc_t proc) __result_use_check; |
| | 309 | int mac_proc_check_getlcid(proc_t proc1, proc_t proc2, |
| | 310 | pid_t pid) __result_use_check; |
| | 311 | int mac_proc_check_dyld_process_info_notify_register(void) __result_use_check; |
| | 312 | int mac_proc_check_ledger(proc_t curp, proc_t target, int op) __result_use_check; |
| | 313 | int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr, |
| | 314 | user_size_t u_size, int prot, int flags, int *maxprot) __result_use_check; |
| | 315 | int mac_proc_check_mprotect(proc_t proc, |
| | 316 | user_addr_t addr, user_size_t size, int prot) __result_use_check; |
| | 317 | int mac_proc_check_run_cs_invalid(proc_t proc) __result_use_check; |
| | 318 | void mac_proc_notify_cs_invalidated(proc_t proc); |
| | 319 | int mac_proc_check_sched(proc_t proc, proc_t proc2) __result_use_check; |
| | 320 | int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai) __result_use_check; |
| | 321 | int mac_proc_check_setauid(proc_t proc, uid_t auid) __result_use_check; |
| | 322 | int mac_proc_check_setlcid(proc_t proc1, proc_t proc2, |
| | 323 | pid_t pid1, pid_t pid2) __result_use_check; |
| | 324 | int mac_proc_check_signal(proc_t proc1, proc_t proc2, |
| | 325 | int signum) __result_use_check; |
| | 326 | int mac_proc_check_syscall_unix(proc_t proc, int scnum) __result_use_check; |
| | 327 | int mac_proc_check_wait(proc_t proc1, proc_t proc2) __result_use_check; |
| | 328 | void mac_proc_notify_exit(proc_t proc); |
| | 329 | int mac_socket_check_accept(kauth_cred_t cred, struct socket *so) __result_use_check; |
| | 330 | int mac_socket_check_accepted(kauth_cred_t cred, struct socket *so) __result_use_check; |
| | 331 | int mac_socket_check_bind(kauth_cred_t cred, struct socket *so, |
| | 332 | struct sockaddr *addr) __result_use_check; |
| | 333 | int mac_socket_check_connect(kauth_cred_t cred, struct socket *so, |
| | 334 | struct sockaddr *addr) __result_use_check; |
| | 335 | int mac_socket_check_create(kauth_cred_t cred, int domain, |
| | 336 | int type, int protocol) __result_use_check; |
| | 337 | int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so, |
| | 338 | unsigned long cmd) __result_use_check; |
| | 339 | int mac_socket_check_listen(kauth_cred_t cred, struct socket *so) __result_use_check; |
| | 340 | int mac_socket_check_receive(kauth_cred_t cred, struct socket *so) __result_use_check; |
| | 341 | int mac_socket_check_received(kauth_cred_t cred, struct socket *so, |
| | 342 | struct sockaddr *saddr) __result_use_check; |
| | 343 | int mac_socket_check_send(kauth_cred_t cred, struct socket *so, |
| | 344 | struct sockaddr *addr) __result_use_check; |
| | 345 | int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so, |
| | 346 | struct sockopt *sopt) __result_use_check; |
| | 347 | int mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so, |
| | 348 | struct sockopt *sopt) __result_use_check; |
| | 349 | int mac_socket_check_stat(kauth_cred_t cred, struct socket *so) __result_use_check; |
| | 350 | void mac_socket_label_associate(kauth_cred_t cred, struct socket *so); |
| | 351 | void mac_socket_label_associate_accept(struct socket *oldsocket, |
| | 352 | struct socket *newsocket); |
| | 353 | void mac_socket_label_copy(struct label *from, struct label *to); |
| | 354 | void mac_socket_label_destroy(struct socket *); |
| | 355 | int mac_socket_label_get(kauth_cred_t cred, struct socket *so, |
| | 356 | struct mac *extmac) __result_use_check; |
| | 357 | int mac_socket_label_init(struct socket *, int waitok) __result_use_check; |
| | 358 | void mac_socketpeer_label_associate_socket(struct socket *peersocket, |
| | 359 | struct socket *socket_to_modify); |
| | 360 | int mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so, |
| | 361 | struct mac *extmac) __result_use_check; |
| | 362 | int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp) __result_use_check; |
| | 363 | int mac_system_check_audit(kauth_cred_t cred, void *record, int length) __result_use_check; |
| | 364 | int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp) __result_use_check; |
| | 365 | int mac_system_check_auditon(kauth_cred_t cred, int cmd) __result_use_check; |
| | 366 | int mac_system_check_host_priv(kauth_cred_t cred) __result_use_check; |
| | 367 | int mac_system_check_info(kauth_cred_t, const char *info_type) __result_use_check; |
| | 368 | int mac_system_check_nfsd(kauth_cred_t cred) __result_use_check; |
| | 369 | int mac_system_check_reboot(kauth_cred_t cred, int howto) __result_use_check; |
| | 370 | int mac_system_check_settime(kauth_cred_t cred) __result_use_check; |
| | 371 | int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp) __result_use_check; |
| | 372 | int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp) __result_use_check; |
| | 373 | int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name, |
| | 374 | size_t namelen, user_addr_t oldctl, size_t oldlen, |
| | 375 | user_addr_t newctl, size_t newlen) __result_use_check; |
| | 376 | int mac_system_check_kas_info(kauth_cred_t cred, int selector) __result_use_check; |
| | 377 | void mac_sysvmsg_label_associate(kauth_cred_t cred, |
| | 378 | struct msqid_kernel *msqptr, struct msg *msgptr); |
| | 379 | void mac_sysvmsg_label_init(struct msg *msgptr); |
| | 380 | void mac_sysvmsg_label_recycle(struct msg *msgptr); |
| | 381 | int mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr, |
| | 382 | struct msqid_kernel *msqptr) __result_use_check; |
| | 383 | int mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr) __result_use_check; |
| | 384 | int mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr) __result_use_check; |
| | 385 | int mac_sysvmsq_check_msqctl(kauth_cred_t cred, |
| | 386 | struct msqid_kernel *msqptr, int cmd) __result_use_check; |
| | 387 | int mac_sysvmsq_check_msqget(kauth_cred_t cred, |
| | 388 | struct msqid_kernel *msqptr) __result_use_check; |
| | 389 | int mac_sysvmsq_check_msqrcv(kauth_cred_t cred, |
| | 390 | struct msqid_kernel *msqptr) __result_use_check; |
| | 391 | int mac_sysvmsq_check_msqsnd(kauth_cred_t cred, |
| | 392 | struct msqid_kernel *msqptr) __result_use_check; |
| | 393 | void mac_sysvmsq_label_associate(kauth_cred_t cred, |
| | 394 | struct msqid_kernel *msqptr); |
| | 395 | void mac_sysvmsq_label_init(struct msqid_kernel *msqptr); |
| | 396 | void mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr); |
| | 397 | int mac_sysvsem_check_semctl(kauth_cred_t cred, |
| | 398 | struct semid_kernel *semakptr, int cmd) __result_use_check; |
| | 399 | int mac_sysvsem_check_semget(kauth_cred_t cred, |
| | 400 | struct semid_kernel *semakptr) __result_use_check; |
| | 401 | int mac_sysvsem_check_semop(kauth_cred_t cred, |
| | 402 | struct semid_kernel *semakptr, size_t accesstype) __result_use_check; |
| | 403 | void mac_sysvsem_label_associate(kauth_cred_t cred, |
| | 404 | struct semid_kernel *semakptr); |
| | 405 | void mac_sysvsem_label_destroy(struct semid_kernel *semakptr); |
| | 406 | void mac_sysvsem_label_init(struct semid_kernel *semakptr); |
| | 407 | void mac_sysvsem_label_recycle(struct semid_kernel *semakptr); |
| | 408 | int mac_sysvshm_check_shmat(kauth_cred_t cred, |
| | 409 | struct shmid_kernel *shmsegptr, int shmflg) __result_use_check; |
| | 410 | int mac_sysvshm_check_shmctl(kauth_cred_t cred, |
| | 411 | struct shmid_kernel *shmsegptr, int cmd) __result_use_check; |
| | 412 | int mac_sysvshm_check_shmdt(kauth_cred_t cred, |
| | 413 | struct shmid_kernel *shmsegptr) __result_use_check; |
| | 414 | int mac_sysvshm_check_shmget(kauth_cred_t cred, |
| | 415 | struct shmid_kernel *shmsegptr, int shmflg) __result_use_check; |
| | 416 | void mac_sysvshm_label_associate(kauth_cred_t cred, |
| | 417 | struct shmid_kernel *shmsegptr); |
| | 418 | void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr); |
| | 419 | void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr); |
| | 420 | void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr); |
| | 421 | int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, |
| | 422 | int acc_mode) __result_use_check; |
| | 423 | int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) __result_use_check; |
| | 424 | int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, |
| | 425 | struct componentname *cnp) __result_use_check; |
| | 426 | int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp, |
| | 427 | struct vnode *vp, struct componentname *cnp) __result_use_check; |
| | 428 | int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, |
| | 429 | struct componentname *cnp, struct vnode_attr *vap) __result_use_check; |
| | 430 | int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, |
| | 431 | const char *name) __result_use_check; |
| | 432 | int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, |
| | 433 | struct vnode *v2) __result_use_check; |
| | 434 | int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, |
| | 435 | struct image_params *imgp) __result_use_check; |
| | 436 | int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp) __result_use_check; |
| | 437 | int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred, |
| | 438 | struct vnode *vp, struct vnode_attr *va) __result_use_check; |
| | 439 | int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, |
| | 440 | struct attrlist *alist) __result_use_check; |
| | 441 | int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, |
| | 442 | const char *name, struct uio *uio) __result_use_check; |
| | 443 | int mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, |
| | 444 | unsigned long cmd) __result_use_check; |
| | 445 | int mac_vnode_check_kqfilter(vfs_context_t ctx, |
| | 446 | kauth_cred_t file_cred, struct knote *kn, struct vnode *vp) __result_use_check; |
| | 447 | int mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp, |
| | 448 | struct label *newlabel); __result_use_check |
| | 449 | int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, |
| | 450 | struct vnode *vp, struct componentname *cnp) __result_use_check; |
| | 451 | int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp) __result_use_check; |
| | 452 | int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, |
| | 453 | struct componentname *cnp) __result_use_check; |
| | 454 | int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp, |
| | 455 | const char *path, size_t pathlen) __result_use_check; |
| | 456 | int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, |
| | 457 | int acc_mode) __result_use_check; |
| | 458 | int mac_vnode_check_read(vfs_context_t ctx, |
| | 459 | kauth_cred_t file_cred, struct vnode *vp) __result_use_check; |
| | 460 | int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp) __result_use_check; |
| | 461 | int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp) __result_use_check; |
| | 462 | int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp, |
| | 463 | struct vnode *vp, struct componentname *cnp, struct vnode *tdvp, |
| | 464 | struct vnode *tvp, struct componentname *tcnp) __result_use_check; |
| | 465 | int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp) __result_use_check; |
| | 466 | int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, |
| | 467 | struct attrlist *alist) __result_use_check; |
| | 468 | int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, |
| | 469 | int which) __result_use_check; |
| | 470 | int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, |
| | 471 | struct kauth_acl *acl) __result_use_check; |
| | 472 | int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp, |
| | 473 | struct attrlist *alist) __result_use_check; |
| | 474 | int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, |
| | 475 | const char *name, struct uio *uio) __result_use_check; |
| | 476 | int mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, |
| | 477 | u_long flags) __result_use_check; |
| | 478 | int mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, |
| | 479 | mode_t mode) __result_use_check; |
| | 480 | int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, |
| | 481 | uid_t uid, gid_t gid) __result_use_check; |
| | 482 | int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, |
| | 483 | struct timespec atime, struct timespec mtime) __result_use_check; |
| | 484 | int mac_vnode_check_signature(struct vnode *vp, |
| | 485 | struct cs_blob *cs_blob, struct image_params *imgp, |
| | 486 | unsigned int *cs_flags, unsigned int *signer_type, |
| | 487 | int flags, unsigned int platform) __result_use_check; |
| | 488 | int mac_vnode_check_supplemental_signature(struct vnode *vp, |
| | 489 | struct cs_blob *cs_blob, struct vnode *linked_vp, |
| | 490 | struct cs_blob *linked_cs_blob, unsigned int *signer_type) __result_use_check; |
| | 491 | int mac_vnode_check_stat(vfs_context_t ctx, |
| | 492 | kauth_cred_t file_cred, struct vnode *vp) __result_use_check; |
| | 493 | #ifdef KERNEL_PRIVATE |
| | 494 | int mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp, |
| | 495 | struct componentname *cnp) __result_use_check; |
| | 496 | #endif |
| | 497 | int mac_vnode_check_truncate(vfs_context_t ctx, |
| | 498 | kauth_cred_t file_cred, struct vnode *vp) __result_use_check; |
| | 499 | int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, |
| | 500 | struct componentname *cnp, struct vnode_attr *vap) __result_use_check; |
| | 501 | int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so) __result_use_check; |
| | 502 | int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, |
| | 503 | struct vnode *vp, struct componentname *cnp) __result_use_check; |
| | 504 | int mac_vnode_check_write(vfs_context_t ctx, |
| | 505 | kauth_cred_t file_cred, struct vnode *vp) __result_use_check; |
| | 506 | struct label *mac_vnode_label_alloc(void); |
| | 507 | int mac_vnode_label_associate(struct mount *mp, struct vnode *vp, |
| | 508 | vfs_context_t ctx) __result_use_check; |
| | 509 | void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de, |
| | 510 | struct vnode *vp); |
| | 511 | int mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp) __result_use_check; |
| | 512 | int mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, |
| | 513 | struct vnode *vp, vfs_context_t ctx) __result_use_check; |
| | 514 | void mac_vnode_label_associate_singlelabel(struct mount *mp, |
| | 515 | struct vnode *vp); |
| | 516 | void mac_vnode_label_copy(struct label *l1, struct label *l2); |
| | 517 | void mac_vnode_label_destroy(struct vnode *vp); |
| | 518 | int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac) __result_use_check; |
| | 519 | void mac_vnode_label_free(struct label *label); |
| | 520 | void mac_vnode_label_init(struct vnode *vp); |
| | 521 | int mac_vnode_label_init_needed(struct vnode *vp) __result_use_check; |
| | 522 | #ifdef KERNEL_PRIVATE |
| | 523 | struct label *mac_vnode_label_allocate(vnode_t vp); |
| | 524 | #endif |
| | 525 | void mac_vnode_label_recycle(struct vnode *vp); |
| | 526 | void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, |
| | 527 | struct label *newlabel); |
| | 528 | void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, |
| | 529 | const char *name); |
| | 530 | int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, |
| | 531 | struct vnode *dvp, struct vnode *vp, struct componentname *cnp) __result_use_check; |
| | 532 | void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name); |
| | 533 | void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, |
| | 534 | struct vnode *dvp, struct componentname *cnp); |
| | 535 | void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); |
| | 536 | void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, |
| | 537 | struct vnode *dvp, struct componentname *cnp); |
| | 538 | void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl); |
| | 539 | void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); |
| | 540 | void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio); |
| | 541 | void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags); |
| | 542 | void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode); |
| | 543 | void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid); |
| | 544 | void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime); |
| | 545 | void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); |
| | 546 | int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho) __result_use_check; |
| | 547 | int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, |
| | 548 | struct componentname *cnp, int flags, vfs_context_t ctx) __result_use_check; |
| | 549 | void vnode_relabel(struct vnode *vp); |
| | 550 | void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label); |
| | 551 | void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label); |
| | 552 | int mac_kext_check_load(kauth_cred_t cred, const char *identifier) __result_use_check; |
| | 553 | int mac_kext_check_unload(kauth_cred_t cred, const char *identifier) __result_use_check; |
| | 554 | int mac_kext_check_query(kauth_cred_t cred) __result_use_check; |
| | 555 | int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check; |
| | 556 | int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check; |
| | 557 | void mac_vnode_notify_reclaim(vnode_t vp); |
| | 558 | |
| | 559 | void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); |
| | 560 | void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); |
| | 561 | |
| | 562 | #endif /* CONFIG_MACF */ |
| | 563 | |
| | 564 | #endif /* !_SECURITY_MAC_FRAMEWORK_H_ */ |
projects / apple / xnu.git / blame_incremental