security/mac_data.h

   1 /*
   2  * Copyright (c) 2007 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*-
  29  * Copyright (c) 2006 SPARTA, Inc.
  30  * All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  */
  53
  54 #ifndef _SECURITY_MAC_DATA_H_
  55 #define _SECURITY_MAC_DATA_H_
  56
  57 #ifndef PRIVATE
  58 #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
  59 #endif
  60
  61 /**
  62  *  @brief Mac policy module data
  63  *
  64  *  This structure specifies module data that is passed in to the
  65  *  TrustedBSD MAC policy module by the kernel module loader.  The
  66  *  data is made of up key/value pairs where the key is always a
  67  *  string and the value is a string, binary data or array.  An array
  68  *  may be a list of values (actually a similar set of key/value pairs,
  69  *  but in this case the keys are always null), and may also consist of
  70  *  a set of dictionaries, which in turn are made up of a list of key/value
  71  *  pairs.
  72  *
  73  *  Module data may be specified in the MAC policy module's
  74  *  Info.plist file as part of the OSModuleData dictionary.
  75  *
  76  *  E.g.
  77  *
  78  *  <key>OSModuleData</key>
  79  *  <dict>
  80  *       <key>foo</key>
  81  *       <string>bar</string>
  82  *       <key>Beers</key>
  83  *       <array>
  84  *       <dict>
  85  *               <key>type</key>
  86  *               <string>lager</string>
  87  *               <key>Name</key>
  88  *               <string>Anchor Steam</string>
  89  *       </dict>
  90  *       <dict>
  91  *               <key>type</key>
  92  *               <string>ale</string>
  93  *               <key>Name</key>
  94  *               <string>Sierra Nevada Pale Ale</string>
  95  *       </dict>
  96  *       </array>
  97  *  </dict>
  98  *
  99  */
 100 struct mac_module_data_element {
 101         unsigned int key_size;
 102         unsigned int value_size;
 103         unsigned int value_type;
 104         char *key;
 105         char *value;
 106 };
 107 struct mac_module_data_list {
 108         unsigned int count;
 109         unsigned int type;
 110         struct mac_module_data_element list[1];
 111 };
 112 struct mac_module_data {
 113         void *base_addr;                /* Orig base address, for ptr fixup.  */
 114         unsigned int size;
 115         unsigned int count;
 116         struct mac_module_data_element data[1]; /* actually bigger */
 117 };
 118
 119 #define MAC_DATA_TYPE_PRIMITIVE 0       /* Primitive type (int, string, etc.) */
 120 #define MAC_DATA_TYPE_ARRAY     1       /* Array type.                        */
 121 #define MAC_DATA_TYPE_DICT      2       /* Dictionary type.                   */
 122
 123 #ifdef _SECURITY_MAC_POLICY_H_
 124 /* XXX mac_policy_handle_t is defined in mac_policy.h, move prototype there? */
 125 int mac_find_policy_data(const mac_policy_handle_t, const char *key,
 126     void **valp, size_t *sizep);
 127 int mac_find_module_data(struct mac_module_data *mmd, const char *key,
 128     void **valp, size_t *sizep);
 129
 130 /*
 131  * This is a routine to fix up pointers in a mac_module_data_element when the
 132  * mac_module_data has been copied to a new area.  It depends on the pointers
 133  * all being offset from base_addr.
 134  */
 135 static __inline void
 136 mmd_fixup_ele(struct mac_module_data *oldbase,
 137     struct mac_module_data *newbase, struct mac_module_data_element *ele)
 138 {
 139         if (ele->key != NULL) {         /* Array elements have no keys.       */
 140                 ele->key -= (uintptr_t)oldbase;
 141                 ele->key += (uintptr_t)newbase;
 142         }
 143         ele->value -= (uintptr_t)oldbase;
 144         ele->value += (uintptr_t)newbase;
 145 }
 146
 147 #endif
 148
 149 #endif /* !_SECURITY_MAC_DATA_H_ */