security/mac_framework.h

   1 /*
   2  * Copyright (c) 2007 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*-
  29  * Copyright (c) 1999-2002 Robert N. M. Watson
  30  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
  31  * Copyright (c) 2005-2007 SPARTA, Inc.
  32  * All rights reserved.
  33  *
  34  * This software was developed by Robert Watson for the TrustedBSD Project.
  35  *
  36  * This software was developed for the FreeBSD Project in part by Network
  37  * Associates Laboratories, the Security Research Division of Network
  38  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  39  * as part of the DARPA CHATS research program.
  40  *
  41  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  42  * N66001-04-C-6019 ("SEFOS").
  43  *
  44  * Redistribution and use in source and binary forms, with or without
  45  * modification, are permitted provided that the following conditions
  46  * are met:
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  * 2. Redistributions in binary form must reproduce the above copyright
  50  *    notice, this list of conditions and the following disclaimer in the
  51  *    documentation and/or other materials provided with the distribution.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  63  * SUCH DAMAGE.
  64  *
  65  * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $
  66  *
  67  */
  68 /*
  69  * Kernel interface for Mandatory Access Control -- how kernel services
  70  * interact with the TrustedBSD MAC Framework.
  71  */
  72
  73 #ifndef _SECURITY_MAC_FRAMEWORK_H_
  74 #define _SECURITY_MAC_FRAMEWORK_H_
  75
  76 #ifndef KERNEL
  77 #error "no user-serviceable parts inside"
  78 #endif
  79
  80 #ifndef PRIVATE
  81 #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
  82 #endif
  83
  84 struct attrlist;
  85 struct auditinfo;
  86 struct bpf_d;
  87 struct componentname;
  88 struct devnode;
  89 struct flock;
  90 struct fdescnode;
  91 struct fileglob;
  92 struct fileproc;
  93 struct ifnet;
  94 struct ifreq;
  95 struct image_params;
  96 struct inpcb;
  97 struct ipq;
  98 struct knote;
  99 struct lctx;
 100 struct m_tag;
 101 struct mac;
 102 struct mac_module_data;
 103 struct mbuf;
 104 struct msg;
 105 struct msqid_kernel;
 106 struct mount;
 107 struct pipe;
 108 struct proc;
 109 struct pseminfo;
 110 struct pshminfo;
 111 struct semid_kernel;
 112 struct shmid_kernel;
 113 struct sockaddr;
 114 struct sockopt;
 115 struct socket;
 116 struct task;
 117 struct thread;
 118 struct timespec;
 119 struct tty;
 120 struct ucred;
 121 struct uio;
 122 struct uthread;
 123 struct vfs_attr;
 124 struct vfs_context;
 125 struct vnode;
 126 struct vnode_attr;
 127 struct vop_setlabel_args;
 128
 129 #if CONFIG_MACF
 130
 131 #ifndef __IOKIT_PORTS_DEFINED__
 132 #define __IOKIT_PORTS_DEFINED__
 133 #ifdef __cplusplus
 134 class OSObject;
 135 typedef OSObject *io_object_t;
 136 #else
 137 struct OSObject;
 138 typedef struct OSObject *io_object_t;
 139 #endif
 140 #endif /* __IOKIT_PORTS_DEFINED__ */
 141
 142 /*@ macros */
 143 #define VNODE_LABEL_CREATE      1
 144
 145 /*@ === */
 146 int     mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode,
 147             void *args, int error, int retval, int mac_forced);
 148 int     mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode,
 149             void *args);
 150 int     mac_bpfdesc_check_receive(struct bpf_d *bpf_d, struct ifnet *ifp);
 151 void    mac_bpfdesc_label_destroy(struct bpf_d *bpf_d);
 152 void    mac_bpfdesc_label_init(struct bpf_d *bpf_d);
 153 void    mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d);
 154 int     mac_cred_check_label_update(kauth_cred_t cred,
 155             struct label *newlabel);
 156 int     mac_cred_check_label_update_execve(vfs_context_t ctx,
 157             struct vnode *vp, off_t offset, struct vnode *scriptvp,
 158             struct label *scriptvnodelabel, struct label *execlabel,
 159             proc_t proc, void *macextensions);
 160 int     mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2);
 161 struct label    *mac_cred_label_alloc(void);
 162 void    mac_cred_label_associate(kauth_cred_t cred_parent,
 163             kauth_cred_t cred_child);
 164 void    mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child);
 165 void    mac_cred_label_associate_kernel(kauth_cred_t cred);
 166 void    mac_cred_label_associate_user(kauth_cred_t cred);
 167 void    mac_cred_label_destroy(kauth_cred_t cred);
 168 int     mac_cred_label_externalize_audit(proc_t p, struct mac *mac);
 169 void    mac_cred_label_free(struct label *label);
 170 void    mac_cred_label_init(kauth_cred_t cred);
 171 int     mac_cred_label_compare(struct label *a, struct label *b);
 172 void    mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
 173 void    mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
 174             struct vnode *vp, off_t offset, struct vnode *scriptvp,
 175             struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags,
 176             void *macextensions, int *disjoint, int *labelupdateerror);
 177 void    mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
 178             const char *fullpath);
 179 void    mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
 180             struct devnode *de, const char *fullpath);
 181 void    mac_devfs_label_copy(struct label *, struct label *label);
 182 void    mac_devfs_label_destroy(struct devnode *de);
 183 void    mac_devfs_label_init(struct devnode *de);
 184 void    mac_devfs_label_update(struct mount *mp, struct devnode *de,
 185             struct vnode *vp);
 186 int     mac_execve_enter(user_addr_t mac_p, struct image_params *imgp);
 187 int     mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg);
 188 int     mac_file_check_create(kauth_cred_t cred);
 189 int     mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd);
 190 int     mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd,
 191             user_long_t arg);
 192 int     mac_file_check_get(kauth_cred_t cred, struct fileglob *fg,
 193             char *elements, int len);
 194 int     mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg);
 195 int     mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg);
 196 int     mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg,
 197             unsigned int cmd);
 198 int     mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op,
 199             struct flock *fl);
 200 int     mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg,
 201             int prot, int flags, int *maxprot);
 202 void    mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg,
 203             int *prot);
 204 int     mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg);
 205 int     mac_file_check_set(kauth_cred_t cred, struct fileglob *fg,
 206             char *bufp, int buflen);
 207 void    mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg);
 208 void    mac_file_label_destroy(struct fileglob *fg);
 209 void    mac_file_label_init(struct fileglob *fg);
 210 int     mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf,
 211             int family, int type);
 212 void    mac_ifnet_label_associate(struct ifnet *ifp);
 213 void    mac_ifnet_label_destroy(struct ifnet *ifp);
 214 int     mac_ifnet_label_get(kauth_cred_t cred, struct ifreq *ifr,
 215             struct ifnet *ifp);
 216 void    mac_ifnet_label_init(struct ifnet *ifp);
 217 void    mac_ifnet_label_recycle(struct ifnet *ifp);
 218 int     mac_ifnet_label_set(kauth_cred_t cred, struct ifreq *ifr,
 219             struct ifnet *ifp);
 220 int     mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf,
 221             int family, int type);
 222 void    mac_inpcb_label_associate(struct socket *so, struct inpcb *inp);
 223 void    mac_inpcb_label_destroy(struct inpcb *inp);
 224 int     mac_inpcb_label_init(struct inpcb *inp, int flag);
 225 void    mac_inpcb_label_recycle(struct inpcb *inp);
 226 void    mac_inpcb_label_update(struct socket *so);
 227 int     mac_iokit_check_device(char *devtype, struct mac_module_data *mdata);
 228 int     mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type);
 229 int     mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties);
 230 int     mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry);
 231 int     mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name);
 232 int     mac_iokit_check_hid_control(kauth_cred_t cred);
 233 void    mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq);
 234 int     mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq);
 235 void    mac_ipq_label_destroy(struct ipq *ipq);
 236 int     mac_ipq_label_init(struct ipq *ipq, int flag);
 237 void    mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq);
 238 struct label    *mac_lctx_label_alloc(void);
 239 void    mac_lctx_label_free(struct label *label);
 240 void    mac_lctx_label_update(struct lctx *l, struct label *newlabel);
 241 int     mac_lctx_check_label_update(struct lctx *l, struct label *newlabel);
 242 void    mac_lctx_notify_create(proc_t proc, struct lctx *l);
 243 void    mac_lctx_notify_join(proc_t proc, struct lctx *l);
 244 void    mac_lctx_notify_leave(proc_t proc, struct lctx *l);
 245 void    mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m);
 246 void    mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m);
 247 void    mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m);
 248 void    mac_mbuf_label_associate_ipq(struct ipq *ipq, struct mbuf *mbuf);
 249 void    mac_mbuf_label_associate_linklayer(struct ifnet *ifp, struct mbuf *m);
 250 void    mac_mbuf_label_associate_multicast_encap(struct mbuf *oldmbuf,
 251             struct ifnet *ifp, struct mbuf *newmbuf);
 252 void    mac_mbuf_label_associate_netlayer(struct mbuf *oldmbuf,
 253             struct mbuf *newmbuf);
 254 void    mac_mbuf_label_associate_socket(struct socket *so, struct mbuf *m);
 255 void    mac_mbuf_label_copy(struct mbuf *m_from, struct mbuf *m_to);
 256 void    mac_mbuf_label_destroy(struct mbuf *m);
 257 int     mac_mbuf_label_init(struct mbuf *m, int flag);
 258 void    mac_mbuf_tag_copy(struct m_tag *m, struct m_tag *mtag);
 259 void    mac_mbuf_tag_destroy(struct m_tag *mtag);
 260 int     mac_mbuf_tag_init(struct m_tag *, int how);
 261 int     mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp,
 262             unsigned int cmd);
 263 int     mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp,
 264             struct vfs_attr *vfa);
 265 int     mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp);
 266 int     mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp,
 267             struct componentname *cnp, const char *vfc_name);
 268 int     mac_mount_check_remount(vfs_context_t ctx, struct mount *mp);
 269 int     mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp,
 270             struct vfs_attr *vfa);
 271 int     mac_mount_check_stat(vfs_context_t ctx, struct mount *mp);
 272 int     mac_mount_check_umount(vfs_context_t ctx, struct mount *mp);
 273 void    mac_mount_label_associate(vfs_context_t ctx, struct mount *mp);
 274 void    mac_mount_label_destroy(struct mount *mp);
 275 int     mac_mount_label_externalize(struct label *label, char *elements,
 276             char *outbuf, size_t outbuflen);
 277 int     mac_mount_label_get(struct mount *mp, user_addr_t mac_p);
 278 void    mac_mount_label_init(struct mount *);
 279 int     mac_mount_label_internalize(struct label *, char *string);
 280 void    mac_netinet_fragment(struct mbuf *datagram, struct mbuf *fragment);
 281 void    mac_netinet_icmp_reply(struct mbuf *m);
 282 void    mac_netinet_tcp_reply(struct mbuf *m);
 283 int     mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe,
 284             unsigned int cmd);
 285 int     mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn,
 286             struct pipe *cpipe);
 287 int     mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe);
 288 int     mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe,
 289             int which);
 290 int     mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe);
 291 int     mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe);
 292 struct label    *mac_pipe_label_alloc(void);
 293 void    mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe);
 294 void    mac_pipe_label_copy(struct label *src, struct label *dest);
 295 void    mac_pipe_label_destroy(struct pipe *cpipe);
 296 void    mac_pipe_label_free(struct label *label);
 297 void    mac_pipe_label_init(struct pipe *cpipe);
 298 int     mac_pipe_label_update(kauth_cred_t cred, struct pipe *cpipe,
 299             struct label *label);
 300 void    mac_policy_initbsd(void);
 301 int     mac_posixsem_check_create(kauth_cred_t cred, const char *name);
 302 int     mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem);
 303 int     mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem);
 304 int     mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem,
 305             const char *name);
 306 int     mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem);
 307 void    mac_posixsem_vnode_label_associate(kauth_cred_t cred,
 308             struct pseminfo *psem, struct label *plabel,
 309             vnode_t vp, struct label *vlabel);
 310 void    mac_posixsem_label_associate(kauth_cred_t cred,
 311             struct pseminfo *psem, const char *name);
 312 void    mac_posixsem_label_destroy(struct pseminfo *psem);
 313 void    mac_posixsem_label_init(struct pseminfo *psem);
 314 int     mac_posixshm_check_create(kauth_cred_t cred, const char *name);
 315 int     mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm,
 316             int prot, int flags);
 317 int     mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm,
 318             int fflags);
 319 int     mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm);
 320 int     mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm,
 321             off_t s);
 322 int     mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm,
 323             const char *name);
 324 void    mac_posixshm_vnode_label_associate(kauth_cred_t cred,
 325             struct pshminfo *pshm, struct label *plabel,
 326             vnode_t vp, struct label *vlabel);
 327 void    mac_posixshm_label_associate(kauth_cred_t cred,
 328             struct pshminfo *pshm, const char *name);
 329 void    mac_posixshm_label_destroy(struct pshminfo *pshm);
 330 void    mac_posixshm_label_init(struct pshminfo *pshm);
 331 int     mac_priv_check(kauth_cred_t cred, int priv);
 332 int     mac_priv_grant(kauth_cred_t cred, int priv);
 333 int     mac_proc_check_debug(proc_t proc1, proc_t proc2);
 334 int     mac_proc_check_cpumon(proc_t curp);
 335 int     mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);
 336 int     mac_proc_check_fork(proc_t proc);
 337 int     mac_proc_check_suspend_resume(proc_t proc, int sr);
 338 int     mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
 339 int     mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
 340 int     mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp);
 341 int     mac_proc_check_getaudit(proc_t proc);
 342 int     mac_proc_check_getauid(proc_t proc);
 343 int     mac_proc_check_getlcid(proc_t proc1, proc_t proc2,
 344             pid_t pid);
 345 int     mac_proc_check_ledger(proc_t curp, proc_t target, int op);
 346 int     mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
 347             user_size_t u_size, int prot, int flags, int *maxprot);
 348 int     mac_proc_check_mprotect(proc_t proc,
 349             user_addr_t addr, user_size_t size, int prot);
 350 int     mac_proc_check_run_cs_invalid(proc_t proc);
 351 int     mac_proc_check_sched(proc_t proc, proc_t proc2);
 352 int     mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai);
 353 int     mac_proc_check_setauid(proc_t proc, uid_t auid);
 354 int     mac_proc_check_setlcid(proc_t proc1, proc_t proc2,
 355             pid_t pid1, pid_t pid2);
 356 int     mac_proc_check_signal(proc_t proc1, proc_t proc2,
 357             int signum);
 358 int     mac_proc_check_wait(proc_t proc1, proc_t proc2);
 359 void    mac_proc_set_enforce(proc_t p, int enforce_flags);
 360 int     mac_setsockopt_label(kauth_cred_t cred, struct socket *so,
 361             struct mac *extmac);
 362 int     mac_socket_check_accept(kauth_cred_t cred, struct socket *so);
 363 int     mac_socket_check_accepted(kauth_cred_t cred, struct socket *so);
 364 int     mac_socket_check_bind(kauth_cred_t cred, struct socket *so,
 365             struct sockaddr *addr);
 366 int     mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
 367             struct sockaddr *addr);
 368 int     mac_socket_check_create(kauth_cred_t cred, int domain,
 369             int type, int protocol);
 370 int     mac_socket_check_deliver(struct socket *so, struct mbuf *m);
 371 int     mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
 372             struct socket *so);
 373 int     mac_socket_check_listen(kauth_cred_t cred, struct socket *so);
 374 int     mac_socket_check_receive(kauth_cred_t cred, struct socket *so);
 375 int     mac_socket_check_received(kauth_cred_t cred, struct socket *so,
 376             struct sockaddr *saddr);
 377 int     mac_socket_check_select(kauth_cred_t cred, struct socket *so,
 378             int which);
 379 int     mac_socket_check_send(kauth_cred_t cred, struct socket *so,
 380             struct sockaddr *addr);
 381 int     mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
 382             struct sockopt *sopt);
 383 int     mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
 384             struct sockopt *sopt);
 385 int     mac_socket_check_stat(kauth_cred_t cred, struct socket *so);
 386 void    mac_socket_label_associate(kauth_cred_t cred, struct socket *so);
 387 void    mac_socket_label_associate_accept(struct socket *oldsocket,
 388             struct socket *newsocket);
 389 void    mac_socket_label_copy(struct label *from, struct label *to);
 390 void    mac_socket_label_destroy(struct socket *);
 391 int     mac_socket_label_get(kauth_cred_t cred, struct socket *so,
 392             struct mac *extmac);
 393 int     mac_socket_label_init(struct socket *, int waitok);
 394 void    mac_socketpeer_label_associate_mbuf(struct mbuf *m, struct socket *so);
 395 void    mac_socketpeer_label_associate_socket(struct socket *peersocket,
 396             struct socket *socket_to_modify);
 397 int     mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so,
 398             struct mac *extmac);
 399 int     mac_system_check_acct(kauth_cred_t cred, struct vnode *vp);
 400 int     mac_system_check_audit(kauth_cred_t cred, void *record, int length);
 401 int     mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp);
 402 int     mac_system_check_auditon(kauth_cred_t cred, int cmd);
 403 int     mac_system_check_chud(kauth_cred_t cred);
 404 int     mac_system_check_host_priv(kauth_cred_t cred);
 405 int     mac_system_check_info(kauth_cred_t, const char *info_type);
 406 int     mac_system_check_nfsd(kauth_cred_t cred);
 407 int     mac_system_check_reboot(kauth_cred_t cred, int howto);
 408 int     mac_system_check_settime(kauth_cred_t cred);
 409 int     mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp);
 410 int     mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp);
 411 int     mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name,
 412                                       u_int namelen, user_addr_t oldctl, size_t oldlen,
 413                                       user_addr_t newctl, size_t newlen);
 414 int     mac_system_check_kas_info(kauth_cred_t cred, int selector);
 415 void    mac_sysvmsg_label_associate(kauth_cred_t cred,
 416             struct msqid_kernel *msqptr, struct msg *msgptr);
 417 void    mac_sysvmsg_label_init(struct msg *msgptr);
 418 void    mac_sysvmsg_label_recycle(struct msg *msgptr);
 419 int     mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr,
 420             struct msqid_kernel *msqptr);
 421 int     mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr);
 422 int     mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr);
 423 int     mac_sysvmsq_check_msqctl(kauth_cred_t cred,
 424             struct msqid_kernel *msqptr, int cmd);
 425 int     mac_sysvmsq_check_msqget(kauth_cred_t cred,
 426             struct msqid_kernel *msqptr);
 427 int     mac_sysvmsq_check_msqrcv(kauth_cred_t cred,
 428             struct msqid_kernel *msqptr);
 429 int     mac_sysvmsq_check_msqsnd(kauth_cred_t cred,
 430             struct msqid_kernel *msqptr);
 431 void    mac_sysvmsq_label_associate(kauth_cred_t cred,
 432             struct msqid_kernel *msqptr);
 433 void    mac_sysvmsq_label_init(struct msqid_kernel *msqptr);
 434 void    mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr);
 435 int     mac_sysvsem_check_semctl(kauth_cred_t cred,
 436             struct semid_kernel *semakptr, int cmd);
 437 int     mac_sysvsem_check_semget(kauth_cred_t cred,
 438             struct semid_kernel *semakptr);
 439 int     mac_sysvsem_check_semop(kauth_cred_t cred,
 440             struct semid_kernel *semakptr, size_t accesstype);
 441 void    mac_sysvsem_label_associate(kauth_cred_t cred,
 442             struct semid_kernel *semakptr);
 443 void    mac_sysvsem_label_destroy(struct semid_kernel *semakptr);
 444 void    mac_sysvsem_label_init(struct semid_kernel *semakptr);
 445 void    mac_sysvsem_label_recycle(struct semid_kernel *semakptr);
 446 int     mac_sysvshm_check_shmat(kauth_cred_t cred,
 447             struct shmid_kernel *shmsegptr, int shmflg);
 448 int     mac_sysvshm_check_shmctl(kauth_cred_t cred,
 449             struct shmid_kernel *shmsegptr, int cmd);
 450 int     mac_sysvshm_check_shmdt(kauth_cred_t cred,
 451             struct shmid_kernel *shmsegptr);
 452 int     mac_sysvshm_check_shmget(kauth_cred_t cred,
 453             struct shmid_kernel *shmsegptr, int shmflg);
 454 void    mac_sysvshm_label_associate(kauth_cred_t cred,
 455             struct shmid_kernel *shmsegptr);
 456 void    mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr);
 457 void    mac_sysvshm_label_init(struct shmid_kernel* shmsegptr);
 458 void    mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr);
 459 struct label * mac_thread_label_alloc(void);
 460 void    mac_thread_label_destroy(struct uthread *uthread);
 461 void    mac_thread_label_free(struct label *label);
 462 void    mac_thread_label_init(struct uthread *uthread);
 463 int     mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
 464             int acc_mode);
 465 int     mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp);
 466 int     mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp,
 467             struct componentname *cnp);
 468 int     mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp,
 469             struct componentname *cnp, struct vnode_attr *vap);
 470 int     mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp,
 471             const char *name);
 472 int     mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1,
 473             struct vnode *v2);
 474 int     mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
 475             struct image_params *imgp);
 476 int     mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);
 477 int     mac_vnode_check_signature(struct vnode *vp, off_t macho_offset,
 478             unsigned char *sha1, const void * signature, size_t size,
 479             int *is_platform_binary);
 480 int     mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
 481             struct attrlist *alist);
 482 int     mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
 483             const char *name, struct uio *uio);
 484 int     mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp,
 485             unsigned int cmd);
 486 int     mac_vnode_check_kqfilter(vfs_context_t ctx,
 487             kauth_cred_t file_cred, struct knote *kn, struct vnode *vp);
 488 int     mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp,
 489             struct label *newlabel);
 490 int     mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp,
 491             struct vnode *vp, struct componentname *cnp);
 492 int     mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp);
 493 int     mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp,
 494             struct componentname *cnp);
 495 int     mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp,
 496             int acc_mode);
 497 int     mac_vnode_check_read(vfs_context_t ctx,
 498             kauth_cred_t file_cred, struct vnode *vp);
 499 int     mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp);
 500 int     mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp);
 501 int     mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp,
 502             struct vnode *vp, struct componentname *cnp, struct vnode *tdvp,
 503             struct vnode *tvp, struct componentname *tcnp);
 504 int     mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp);
 505 int     mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp,
 506             struct attrlist *alist);
 507 int     mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp,
 508             int which);
 509 int     mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp,
 510             struct attrlist *alist);
 511 int     mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp,
 512             const char *name, struct uio *uio);
 513 int     mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp,
 514             u_long flags);
 515 int     mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp,
 516             mode_t mode);
 517 int     mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp,
 518             uid_t uid, gid_t gid);
 519 int     mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
 520             struct timespec atime, struct timespec mtime);
 521 int     mac_vnode_check_stat(vfs_context_t ctx,
 522             kauth_cred_t file_cred, struct vnode *vp);
 523 int     mac_vnode_check_truncate(vfs_context_t ctx,
 524             kauth_cred_t file_cred, struct vnode *vp);
 525 int     mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
 526             struct componentname *cnp, struct vnode_attr *vap);
 527 int     mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp);
 528 int     mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
 529             struct vnode *vp, struct componentname *cnp);
 530 int     mac_vnode_check_write(vfs_context_t ctx,
 531             kauth_cred_t file_cred, struct vnode *vp);
 532 struct label    *mac_vnode_label_alloc(void);
 533 int     mac_vnode_label_associate(struct mount *mp, struct vnode *vp,
 534             vfs_context_t ctx);
 535 void    mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de,
 536             struct vnode *vp);
 537 int     mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp);
 538 int     mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp,
 539             struct vnode *vp, vfs_context_t ctx);
 540 void    mac_vnode_label_associate_singlelabel(struct mount *mp,
 541             struct vnode *vp);
 542 void    mac_vnode_label_copy(struct label *l1, struct label *l2);
 543 void    mac_vnode_label_destroy(struct vnode *vp);
 544 int     mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac);
 545 void    mac_vnode_label_free(struct label *label);
 546 void    mac_vnode_label_init(struct vnode *vp);
 547 int     mac_vnode_label_init_needed(struct vnode *vp);
 548 void    mac_vnode_label_recycle(struct vnode *vp);
 549 void    mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
 550             struct label *newlabel);
 551 void    mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp,
 552             const char *name);
 553 int     mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
 554             struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
 555 void    mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
 556             struct vnode *dvp, struct componentname *cnp);
 557 void    mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
 558 void    mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
 559                               struct vnode *dvp, struct componentname *cnp);
 560 int     mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho);
 561 int     vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
 562             struct componentname *cnp, int flags, vfs_context_t ctx);
 563 void    vnode_relabel(struct vnode *vp);
 564 void    mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
 565 void    mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
 566 int     mac_kext_check_load(kauth_cred_t cred, const char *identifier);
 567 int     mac_kext_check_unload(kauth_cred_t cred, const char *identifier);
 568
 569 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 570 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 571
 572 #if CONFIG_MACF_NET
 573 struct label *mac_bpfdesc_label_get(struct bpf_d *d);
 574 void mac_bpfdesc_label_set(struct bpf_d *d, struct label *label);
 575 #endif
 576
 577 #endif  /* CONFIG_MACF */
 578
 579 #endif /* !_SECURITY_MAC_FRAMEWORK_H_ */