2 #include <sys/systm.h> /* XXX printf() */
11 #include <sys/socketvar.h>
12 #include <sys/vnode.h>
13 #include <security/mac.h>
14 #include <security/mac_policy.h>
16 #include <libkern/OSDebug.h> /* OSBPrintBacktrace */
19 /* forward declaration; see bsd_init.c */
20 errno_t
check_policy_init(int);
21 int get_thread_lock_count(thread_t th
); /* forced forward */
24 * Policy flags used when the policy is enabled
26 * Note: CHECK_POLICY_CHECK is probably not very useful unless you
27 * are kernel debugging and set a breakpoint.
29 #define CHECK_POLICY_CHECK 0x00000001 /* Check on calls */
30 #define CHECK_POLICY_FAIL 0x00000002 /* EPERM on fails */
31 #define CHECK_POLICY_BACKTRACE 0x00000004 /* Show call stack on fails */
32 #define CHECK_POLICY_PANIC 0x00000008 /* Panic on fails */
33 #define CHECK_POLICY_PERIODIC 0x00000010 /* Show fails periodically */
35 static int policy_flags
= 0;
38 #define CHECK_SET_HOOK(x) .mpo_##x = (mpo_##x##_t *)common_hook,
41 * Init; currently, we only print our arrival notice.
44 hook_policy_init(struct mac_policy_conf
*mpc
)
46 printf("Policy '%s' = '%s' ready\n", mpc
->mpc_name
, mpc
->mpc_fullname
);
50 hook_policy_initbsd(struct mac_policy_conf
*mpc
)
52 /* called with policy_grab_exclusive mutex held; exempt */
53 printf("hook_policy_initbsd: %s\n", mpc
->mpc_name
);
58 #define CLASS_PERIOD_LIMIT 10000
59 #define CLASS_PERIOD_MULT 20
61 static int policy_check_event
= 1;
62 static int policy_check_period
= 1;
63 static int policy_check_next
= CLASS_PERIOD_MULT
;
72 if ((i
= get_thread_lock_count(current_thread())) != 0) {
74 * fail the MACF check if we hold a lock; this assumes a
75 * a non-void (authorization) MACF hook.
77 if (policy_flags
& CHECK_POLICY_FAIL
)
81 * display a backtrace if we hold a lock and we are not
84 if ((policy_flags
& (CHECK_POLICY_BACKTRACE
| CHECK_POLICY_PANIC
)) == CHECK_POLICY_BACKTRACE
) {
85 if (policy_flags
& CHECK_POLICY_PERIODIC
) {
86 /* at exponentially increasing intervals */
87 if (!(policy_check_event
% policy_check_period
)) {
88 if (policy_check_event
<= policy_check_next
|| policy_check_period
== CLASS_PERIOD_LIMIT
) {
90 * According to Derek, we could
91 * technically get a symbolicated name
92 * here, if we refactered some code
93 * and set the "keepsyms=1" boot
96 OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i
, policy_check_event
);
99 if (policy_check_period
< CLASS_PERIOD_LIMIT
) {
100 policy_check_next
*= CLASS_PERIOD_MULT
;
101 policy_check_period
*= CLASS_PERIOD_MULT
;
106 OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i
, policy_check_event
);
111 if (policy_flags
& CHECK_POLICY_PANIC
)
112 panic("calling MACF hook with mutex count %d\n", i
);
114 /* count for non-fatal tracing */
115 policy_check_event
++;
121 #if (MAC_POLICY_OPS_VERSION != 32)
122 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
125 * Policy hooks; one per possible hook
127 * Please note that this struct initialization should be kept in sync with
128 * security/mac_policy.h (mac_policy_ops struct definition).
130 static struct mac_policy_ops policy_ops
= {
131 CHECK_SET_HOOK(audit_check_postselect
)
132 CHECK_SET_HOOK(audit_check_preselect
)
134 CHECK_SET_HOOK(bpfdesc_label_associate
)
135 CHECK_SET_HOOK(bpfdesc_label_destroy
)
136 CHECK_SET_HOOK(bpfdesc_label_init
)
137 CHECK_SET_HOOK(bpfdesc_check_receive
)
139 CHECK_SET_HOOK(cred_check_label_update_execve
)
140 CHECK_SET_HOOK(cred_check_label_update
)
141 CHECK_SET_HOOK(cred_check_visible
)
142 CHECK_SET_HOOK(cred_label_associate_fork
)
143 CHECK_SET_HOOK(cred_label_associate_kernel
)
144 CHECK_SET_HOOK(cred_label_associate
)
145 CHECK_SET_HOOK(cred_label_associate_user
)
146 CHECK_SET_HOOK(cred_label_destroy
)
147 CHECK_SET_HOOK(cred_label_externalize_audit
)
148 CHECK_SET_HOOK(cred_label_externalize
)
149 CHECK_SET_HOOK(cred_label_init
)
150 CHECK_SET_HOOK(cred_label_internalize
)
151 CHECK_SET_HOOK(cred_label_update_execve
)
152 CHECK_SET_HOOK(cred_label_update
)
154 CHECK_SET_HOOK(devfs_label_associate_device
)
155 CHECK_SET_HOOK(devfs_label_associate_directory
)
156 CHECK_SET_HOOK(devfs_label_copy
)
157 CHECK_SET_HOOK(devfs_label_destroy
)
158 CHECK_SET_HOOK(devfs_label_init
)
159 CHECK_SET_HOOK(devfs_label_update
)
161 CHECK_SET_HOOK(file_check_change_offset
)
162 CHECK_SET_HOOK(file_check_create
)
163 CHECK_SET_HOOK(file_check_dup
)
164 CHECK_SET_HOOK(file_check_fcntl
)
165 CHECK_SET_HOOK(file_check_get_offset
)
166 CHECK_SET_HOOK(file_check_get
)
167 CHECK_SET_HOOK(file_check_inherit
)
168 CHECK_SET_HOOK(file_check_ioctl
)
169 CHECK_SET_HOOK(file_check_lock
)
170 CHECK_SET_HOOK(file_check_mmap_downgrade
)
171 CHECK_SET_HOOK(file_check_mmap
)
172 CHECK_SET_HOOK(file_check_receive
)
173 CHECK_SET_HOOK(file_check_set
)
174 CHECK_SET_HOOK(file_label_init
)
175 CHECK_SET_HOOK(file_label_destroy
)
176 CHECK_SET_HOOK(file_label_associate
)
178 CHECK_SET_HOOK(ifnet_check_label_update
)
179 CHECK_SET_HOOK(ifnet_check_transmit
)
180 CHECK_SET_HOOK(ifnet_label_associate
)
181 CHECK_SET_HOOK(ifnet_label_copy
)
182 CHECK_SET_HOOK(ifnet_label_destroy
)
183 CHECK_SET_HOOK(ifnet_label_externalize
)
184 CHECK_SET_HOOK(ifnet_label_init
)
185 CHECK_SET_HOOK(ifnet_label_internalize
)
186 CHECK_SET_HOOK(ifnet_label_update
)
187 CHECK_SET_HOOK(ifnet_label_recycle
)
189 CHECK_SET_HOOK(inpcb_check_deliver
)
190 CHECK_SET_HOOK(inpcb_label_associate
)
191 CHECK_SET_HOOK(inpcb_label_destroy
)
192 CHECK_SET_HOOK(inpcb_label_init
)
193 CHECK_SET_HOOK(inpcb_label_recycle
)
194 CHECK_SET_HOOK(inpcb_label_update
)
196 CHECK_SET_HOOK(iokit_check_device
)
198 CHECK_SET_HOOK(ipq_label_associate
)
199 CHECK_SET_HOOK(ipq_label_compare
)
200 CHECK_SET_HOOK(ipq_label_destroy
)
201 CHECK_SET_HOOK(ipq_label_init
)
202 CHECK_SET_HOOK(ipq_label_update
)
204 CHECK_SET_HOOK(lctx_check_label_update
)
205 CHECK_SET_HOOK(lctx_label_destroy
)
206 CHECK_SET_HOOK(lctx_label_externalize
)
207 CHECK_SET_HOOK(lctx_label_init
)
208 CHECK_SET_HOOK(lctx_label_internalize
)
209 CHECK_SET_HOOK(lctx_label_update
)
210 CHECK_SET_HOOK(lctx_notify_create
)
211 CHECK_SET_HOOK(lctx_notify_join
)
212 CHECK_SET_HOOK(lctx_notify_leave
)
214 CHECK_SET_HOOK(mbuf_label_associate_bpfdesc
)
215 CHECK_SET_HOOK(mbuf_label_associate_ifnet
)
216 CHECK_SET_HOOK(mbuf_label_associate_inpcb
)
217 CHECK_SET_HOOK(mbuf_label_associate_ipq
)
218 CHECK_SET_HOOK(mbuf_label_associate_linklayer
)
219 CHECK_SET_HOOK(mbuf_label_associate_multicast_encap
)
220 CHECK_SET_HOOK(mbuf_label_associate_netlayer
)
221 CHECK_SET_HOOK(mbuf_label_associate_socket
)
222 CHECK_SET_HOOK(mbuf_label_copy
)
223 CHECK_SET_HOOK(mbuf_label_destroy
)
224 CHECK_SET_HOOK(mbuf_label_init
)
226 CHECK_SET_HOOK(mount_check_fsctl
)
227 CHECK_SET_HOOK(mount_check_getattr
)
228 CHECK_SET_HOOK(mount_check_label_update
)
229 CHECK_SET_HOOK(mount_check_mount
)
230 CHECK_SET_HOOK(mount_check_remount
)
231 CHECK_SET_HOOK(mount_check_setattr
)
232 CHECK_SET_HOOK(mount_check_stat
)
233 CHECK_SET_HOOK(mount_check_umount
)
234 CHECK_SET_HOOK(mount_label_associate
)
235 CHECK_SET_HOOK(mount_label_destroy
)
236 CHECK_SET_HOOK(mount_label_externalize
)
237 CHECK_SET_HOOK(mount_label_init
)
238 CHECK_SET_HOOK(mount_label_internalize
)
240 CHECK_SET_HOOK(netinet_fragment
)
241 CHECK_SET_HOOK(netinet_icmp_reply
)
242 CHECK_SET_HOOK(netinet_tcp_reply
)
244 CHECK_SET_HOOK(pipe_check_ioctl
)
245 CHECK_SET_HOOK(pipe_check_kqfilter
)
246 CHECK_SET_HOOK(pipe_check_label_update
)
247 CHECK_SET_HOOK(pipe_check_read
)
248 CHECK_SET_HOOK(pipe_check_select
)
249 CHECK_SET_HOOK(pipe_check_stat
)
250 CHECK_SET_HOOK(pipe_check_write
)
251 CHECK_SET_HOOK(pipe_label_associate
)
252 CHECK_SET_HOOK(pipe_label_copy
)
253 CHECK_SET_HOOK(pipe_label_destroy
)
254 CHECK_SET_HOOK(pipe_label_externalize
)
255 CHECK_SET_HOOK(pipe_label_init
)
256 CHECK_SET_HOOK(pipe_label_internalize
)
257 CHECK_SET_HOOK(pipe_label_update
)
259 CHECK_SET_HOOK(policy_destroy
)
260 /* special hooks for policy init's */
261 .mpo_policy_init
= hook_policy_init
,
262 .mpo_policy_initbsd
= hook_policy_initbsd
,
263 CHECK_SET_HOOK(policy_syscall
)
265 CHECK_SET_HOOK(system_check_sysctlbyname
)
266 CHECK_SET_HOOK(proc_check_inherit_ipc_ports
)
267 CHECK_SET_HOOK(vnode_check_rename
)
268 .mpo_reserved4
= (mpo_reserved_hook_t
*)common_hook
,
269 .mpo_reserved5
= (mpo_reserved_hook_t
*)common_hook
,
270 .mpo_reserved6
= (mpo_reserved_hook_t
*)common_hook
,
271 .mpo_reserved7
= (mpo_reserved_hook_t
*)common_hook
,
272 .mpo_reserved8
= (mpo_reserved_hook_t
*)common_hook
,
273 .mpo_reserved9
= (mpo_reserved_hook_t
*)common_hook
,
274 .mpo_reserved10
= (mpo_reserved_hook_t
*)common_hook
,
275 .mpo_reserved11
= (mpo_reserved_hook_t
*)common_hook
,
276 .mpo_reserved12
= (mpo_reserved_hook_t
*)common_hook
,
277 .mpo_reserved13
= (mpo_reserved_hook_t
*)common_hook
,
278 .mpo_reserved14
= (mpo_reserved_hook_t
*)common_hook
,
279 .mpo_reserved15
= (mpo_reserved_hook_t
*)common_hook
,
280 .mpo_reserved16
= (mpo_reserved_hook_t
*)common_hook
,
281 .mpo_reserved17
= (mpo_reserved_hook_t
*)common_hook
,
282 .mpo_reserved18
= (mpo_reserved_hook_t
*)common_hook
,
283 .mpo_reserved19
= (mpo_reserved_hook_t
*)common_hook
,
284 .mpo_reserved20
= (mpo_reserved_hook_t
*)common_hook
,
285 .mpo_reserved21
= (mpo_reserved_hook_t
*)common_hook
,
286 .mpo_reserved22
= (mpo_reserved_hook_t
*)common_hook
,
288 CHECK_SET_HOOK(posixsem_check_create
)
289 CHECK_SET_HOOK(posixsem_check_open
)
290 CHECK_SET_HOOK(posixsem_check_post
)
291 CHECK_SET_HOOK(posixsem_check_unlink
)
292 CHECK_SET_HOOK(posixsem_check_wait
)
293 CHECK_SET_HOOK(posixsem_label_associate
)
294 CHECK_SET_HOOK(posixsem_label_destroy
)
295 CHECK_SET_HOOK(posixsem_label_init
)
296 CHECK_SET_HOOK(posixshm_check_create
)
297 CHECK_SET_HOOK(posixshm_check_mmap
)
298 CHECK_SET_HOOK(posixshm_check_open
)
299 CHECK_SET_HOOK(posixshm_check_stat
)
300 CHECK_SET_HOOK(posixshm_check_truncate
)
301 CHECK_SET_HOOK(posixshm_check_unlink
)
302 CHECK_SET_HOOK(posixshm_label_associate
)
303 CHECK_SET_HOOK(posixshm_label_destroy
)
304 CHECK_SET_HOOK(posixshm_label_init
)
306 CHECK_SET_HOOK(proc_check_debug
)
307 CHECK_SET_HOOK(proc_check_fork
)
308 CHECK_SET_HOOK(proc_check_get_task_name
)
309 CHECK_SET_HOOK(proc_check_get_task
)
310 CHECK_SET_HOOK(proc_check_getaudit
)
311 CHECK_SET_HOOK(proc_check_getauid
)
312 CHECK_SET_HOOK(proc_check_getlcid
)
313 CHECK_SET_HOOK(proc_check_mprotect
)
314 CHECK_SET_HOOK(proc_check_sched
)
315 CHECK_SET_HOOK(proc_check_setaudit
)
316 CHECK_SET_HOOK(proc_check_setauid
)
317 CHECK_SET_HOOK(proc_check_setlcid
)
318 CHECK_SET_HOOK(proc_check_signal
)
319 CHECK_SET_HOOK(proc_check_wait
)
320 CHECK_SET_HOOK(proc_label_destroy
)
321 CHECK_SET_HOOK(proc_label_init
)
323 CHECK_SET_HOOK(socket_check_accept
)
324 CHECK_SET_HOOK(socket_check_accepted
)
325 CHECK_SET_HOOK(socket_check_bind
)
326 CHECK_SET_HOOK(socket_check_connect
)
327 CHECK_SET_HOOK(socket_check_create
)
328 CHECK_SET_HOOK(socket_check_deliver
)
329 CHECK_SET_HOOK(socket_check_kqfilter
)
330 CHECK_SET_HOOK(socket_check_label_update
)
331 CHECK_SET_HOOK(socket_check_listen
)
332 CHECK_SET_HOOK(socket_check_receive
)
333 CHECK_SET_HOOK(socket_check_received
)
334 CHECK_SET_HOOK(socket_check_select
)
335 CHECK_SET_HOOK(socket_check_send
)
336 CHECK_SET_HOOK(socket_check_stat
)
337 CHECK_SET_HOOK(socket_check_setsockopt
)
338 CHECK_SET_HOOK(socket_check_getsockopt
)
339 CHECK_SET_HOOK(socket_label_associate_accept
)
340 CHECK_SET_HOOK(socket_label_associate
)
341 CHECK_SET_HOOK(socket_label_copy
)
342 CHECK_SET_HOOK(socket_label_destroy
)
343 CHECK_SET_HOOK(socket_label_externalize
)
344 CHECK_SET_HOOK(socket_label_init
)
345 CHECK_SET_HOOK(socket_label_internalize
)
346 CHECK_SET_HOOK(socket_label_update
)
348 CHECK_SET_HOOK(socketpeer_label_associate_mbuf
)
349 CHECK_SET_HOOK(socketpeer_label_associate_socket
)
350 CHECK_SET_HOOK(socketpeer_label_destroy
)
351 CHECK_SET_HOOK(socketpeer_label_externalize
)
352 CHECK_SET_HOOK(socketpeer_label_init
)
354 CHECK_SET_HOOK(system_check_acct
)
355 CHECK_SET_HOOK(system_check_audit
)
356 CHECK_SET_HOOK(system_check_auditctl
)
357 CHECK_SET_HOOK(system_check_auditon
)
358 CHECK_SET_HOOK(system_check_host_priv
)
359 CHECK_SET_HOOK(system_check_nfsd
)
360 CHECK_SET_HOOK(system_check_reboot
)
361 CHECK_SET_HOOK(system_check_settime
)
362 CHECK_SET_HOOK(system_check_swapoff
)
363 CHECK_SET_HOOK(system_check_swapon
)
364 .mpo_reserved31
= (mpo_reserved_hook_t
*)common_hook
,
366 CHECK_SET_HOOK(sysvmsg_label_associate
)
367 CHECK_SET_HOOK(sysvmsg_label_destroy
)
368 CHECK_SET_HOOK(sysvmsg_label_init
)
369 CHECK_SET_HOOK(sysvmsg_label_recycle
)
370 CHECK_SET_HOOK(sysvmsq_check_enqueue
)
371 CHECK_SET_HOOK(sysvmsq_check_msgrcv
)
372 CHECK_SET_HOOK(sysvmsq_check_msgrmid
)
373 CHECK_SET_HOOK(sysvmsq_check_msqctl
)
374 CHECK_SET_HOOK(sysvmsq_check_msqget
)
375 CHECK_SET_HOOK(sysvmsq_check_msqrcv
)
376 CHECK_SET_HOOK(sysvmsq_check_msqsnd
)
377 CHECK_SET_HOOK(sysvmsq_label_associate
)
378 CHECK_SET_HOOK(sysvmsq_label_destroy
)
379 CHECK_SET_HOOK(sysvmsq_label_init
)
380 CHECK_SET_HOOK(sysvmsq_label_recycle
)
381 CHECK_SET_HOOK(sysvsem_check_semctl
)
382 CHECK_SET_HOOK(sysvsem_check_semget
)
383 CHECK_SET_HOOK(sysvsem_check_semop
)
384 CHECK_SET_HOOK(sysvsem_label_associate
)
385 CHECK_SET_HOOK(sysvsem_label_destroy
)
386 CHECK_SET_HOOK(sysvsem_label_init
)
387 CHECK_SET_HOOK(sysvsem_label_recycle
)
388 CHECK_SET_HOOK(sysvshm_check_shmat
)
389 CHECK_SET_HOOK(sysvshm_check_shmctl
)
390 CHECK_SET_HOOK(sysvshm_check_shmdt
)
391 CHECK_SET_HOOK(sysvshm_check_shmget
)
392 CHECK_SET_HOOK(sysvshm_label_associate
)
393 CHECK_SET_HOOK(sysvshm_label_destroy
)
394 CHECK_SET_HOOK(sysvshm_label_init
)
395 CHECK_SET_HOOK(sysvshm_label_recycle
)
397 .mpo_reserved23
= (mpo_reserved_hook_t
*)common_hook
,
398 .mpo_reserved24
= (mpo_reserved_hook_t
*)common_hook
,
399 .mpo_reserved25
= (mpo_reserved_hook_t
*)common_hook
,
400 .mpo_reserved26
= (mpo_reserved_hook_t
*)common_hook
,
401 .mpo_reserved27
= (mpo_reserved_hook_t
*)common_hook
,
402 .mpo_reserved28
= (mpo_reserved_hook_t
*)common_hook
,
403 .mpo_reserved29
= (mpo_reserved_hook_t
*)common_hook
,
404 .mpo_reserved30
= (mpo_reserved_hook_t
*)common_hook
,
406 CHECK_SET_HOOK(iokit_check_hid_control
)
408 CHECK_SET_HOOK(vnode_check_access
)
409 CHECK_SET_HOOK(vnode_check_chdir
)
410 CHECK_SET_HOOK(vnode_check_chroot
)
411 CHECK_SET_HOOK(vnode_check_create
)
412 CHECK_SET_HOOK(vnode_check_deleteextattr
)
413 CHECK_SET_HOOK(vnode_check_exchangedata
)
414 CHECK_SET_HOOK(vnode_check_exec
)
415 CHECK_SET_HOOK(vnode_check_getattrlist
)
416 CHECK_SET_HOOK(vnode_check_getextattr
)
417 CHECK_SET_HOOK(vnode_check_ioctl
)
418 CHECK_SET_HOOK(vnode_check_kqfilter
)
419 CHECK_SET_HOOK(vnode_check_label_update
)
420 CHECK_SET_HOOK(vnode_check_link
)
421 CHECK_SET_HOOK(vnode_check_listextattr
)
422 CHECK_SET_HOOK(vnode_check_lookup
)
423 CHECK_SET_HOOK(vnode_check_open
)
424 CHECK_SET_HOOK(vnode_check_read
)
425 CHECK_SET_HOOK(vnode_check_readdir
)
426 CHECK_SET_HOOK(vnode_check_readlink
)
427 CHECK_SET_HOOK(vnode_check_rename_from
)
428 CHECK_SET_HOOK(vnode_check_rename_to
)
429 CHECK_SET_HOOK(vnode_check_revoke
)
430 CHECK_SET_HOOK(vnode_check_select
)
431 CHECK_SET_HOOK(vnode_check_setattrlist
)
432 CHECK_SET_HOOK(vnode_check_setextattr
)
433 CHECK_SET_HOOK(vnode_check_setflags
)
434 CHECK_SET_HOOK(vnode_check_setmode
)
435 CHECK_SET_HOOK(vnode_check_setowner
)
436 CHECK_SET_HOOK(vnode_check_setutimes
)
437 CHECK_SET_HOOK(vnode_check_stat
)
438 CHECK_SET_HOOK(vnode_check_truncate
)
439 CHECK_SET_HOOK(vnode_check_unlink
)
440 CHECK_SET_HOOK(vnode_check_write
)
441 CHECK_SET_HOOK(vnode_label_associate_devfs
)
442 CHECK_SET_HOOK(vnode_label_associate_extattr
)
443 CHECK_SET_HOOK(vnode_label_associate_file
)
444 CHECK_SET_HOOK(vnode_label_associate_pipe
)
445 CHECK_SET_HOOK(vnode_label_associate_posixsem
)
446 CHECK_SET_HOOK(vnode_label_associate_posixshm
)
447 CHECK_SET_HOOK(vnode_label_associate_singlelabel
)
448 CHECK_SET_HOOK(vnode_label_associate_socket
)
449 CHECK_SET_HOOK(vnode_label_copy
)
450 CHECK_SET_HOOK(vnode_label_destroy
)
451 CHECK_SET_HOOK(vnode_label_externalize_audit
)
452 CHECK_SET_HOOK(vnode_label_externalize
)
453 CHECK_SET_HOOK(vnode_label_init
)
454 CHECK_SET_HOOK(vnode_label_internalize
)
455 CHECK_SET_HOOK(vnode_label_recycle
)
456 CHECK_SET_HOOK(vnode_label_store
)
457 CHECK_SET_HOOK(vnode_label_update_extattr
)
458 CHECK_SET_HOOK(vnode_label_update
)
459 CHECK_SET_HOOK(vnode_notify_create
)
460 CHECK_SET_HOOK(vnode_check_signature
)
461 CHECK_SET_HOOK(vnode_check_uipc_bind
)
462 CHECK_SET_HOOK(vnode_check_uipc_connect
)
464 /* CHECK_SET_HOOK(proc_check_run_cs_invalid) */
465 .mpo_proc_check_run_cs_invalid
= (mac_proc_check_run_cs_invalid_t
*)common_hook
,
466 CHECK_SET_HOOK(proc_check_suspend_resume
)
468 CHECK_SET_HOOK(thread_userret
)
470 CHECK_SET_HOOK(iokit_check_set_properties
)
472 CHECK_SET_HOOK(system_check_chud
)
474 CHECK_SET_HOOK(vnode_check_searchfs
)
476 CHECK_SET_HOOK(priv_check
)
477 CHECK_SET_HOOK(priv_grant
)
479 CHECK_SET_HOOK(proc_check_map_anon
)
481 CHECK_SET_HOOK(vnode_check_fsgetpath
)
483 CHECK_SET_HOOK(iokit_check_open
)
485 CHECK_SET_HOOK(proc_check_ledger
)
487 CHECK_SET_HOOK(vnode_notify_rename
)
489 CHECK_SET_HOOK(thread_label_init
)
490 CHECK_SET_HOOK(thread_label_destroy
)
492 CHECK_SET_HOOK(system_check_kas_info
)
494 CHECK_SET_HOOK(proc_check_cpumon
)
496 CHECK_SET_HOOK(vnode_notify_open
)
498 CHECK_SET_HOOK(system_check_info
)
500 CHECK_SET_HOOK(pty_notify_grant
)
501 CHECK_SET_HOOK(pty_notify_close
)
503 CHECK_SET_HOOK(vnode_find_sigs
)
506 CHECK_SET_HOOK(kext_check_load
)
507 CHECK_SET_HOOK(kext_check_unload
)
509 CHECK_SET_HOOK(proc_check_proc_info
)
511 CHECK_SET_HOOK(vnode_notify_link
)
513 CHECK_SET_HOOK(iokit_check_filter_properties
)
514 CHECK_SET_HOOK(iokit_check_get_property
)
520 static struct mac_policy_conf policy_conf
= {
522 .mpc_fullname
= "Check Assumptions Policy",
523 .mpc_field_off
= NULL
, /* no label slot */
524 .mpc_labelnames
= NULL
, /* no policy label names */
525 .mpc_labelname_count
= 0, /* count of label names is 0 */
526 .mpc_ops
= &policy_ops
, /* policy operations */
527 .mpc_loadtime_flags
= 0,
528 .mpc_runtime_flags
= 0,
531 static mac_policy_handle_t policy_handle
;
534 * Init routine; for a loadable policy, this would be called during the KEXT
535 * initialization; we're going to call this from bsd_init() if the boot
536 * argument for checking is present.
539 check_policy_init(int flags
)
541 /* Only instantiate the module if we have been asked to do checking */
545 policy_flags
= flags
;
547 return mac_policy_register(&policy_conf
, &policy_handle
, NULL
);
projects / apple / xnu.git / blob