bsd/kern/policy_check.c

   1 #include <sys/param.h>
   2 #include <sys/systm.h>          /* XXX printf() */
   3
   4 #include <sys/types.h>
   5 #include <sys/fcntl.h>
   6 #include <sys/file.h>
   7 #include <sys/kauth.h>
   8 #include <sys/mount.h>
   9 #include <sys/msg.h>
  10 #include <sys/proc.h>
  11 #include <sys/socketvar.h>
  12 #include <sys/vnode.h>
  13 #include <security/mac.h>
  14 #include <security/mac_policy.h>
  15
  16 #include <libkern/section_keywords.h>
  17 #include <libkern/OSDebug.h>    /* OSBPrintBacktrace */
  18
  19
  20 /* forward declaration; see bsd_init.c */
  21 errno_t check_policy_init(int);
  22 int get_thread_lock_count(thread_t th);         /* forced forward */
  23
  24 /*
  25  * Policy flags used when the policy is enabled
  26  *
  27  * Note:        CHECK_POLICY_CHECK is probably not very useful unless you
  28  *              are kernel debugging and set a breakpoint.
  29  */
  30 #define CHECK_POLICY_CHECK      0x00000001      /* Check on calls */
  31 #define CHECK_POLICY_FAIL       0x00000002      /* EPERM on fails */
  32 #define CHECK_POLICY_BACKTRACE  0x00000004      /* Show call stack on fails */
  33 #define CHECK_POLICY_PANIC      0x00000008      /* Panic on fails */
  34 #define CHECK_POLICY_PERIODIC   0x00000010      /* Show fails periodically */
  35
  36 static int policy_flags = 0;
  37
  38
  39 #define CHECK_SET_HOOK(x)       .mpo_##x = (mpo_##x##_t *)common_hook,
  40
  41 /*
  42  * Init; currently, we only print our arrival notice.
  43  */
  44 static void
  45 hook_policy_init(struct mac_policy_conf *mpc)
  46 {
  47         printf("Policy '%s' = '%s' ready\n", mpc->mpc_name, mpc->mpc_fullname);
  48 }
  49
  50 static void
  51 hook_policy_initbsd(struct mac_policy_conf *mpc)
  52 {
  53         /* called with policy_grab_exclusive mutex held; exempt */
  54         printf("hook_policy_initbsd: %s\n", mpc->mpc_name);
  55 }
  56
  57
  58 /* Implementation */
  59 #define CLASS_PERIOD_LIMIT      10000
  60 #define CLASS_PERIOD_MULT       20
  61
  62 static int policy_check_event = 1;
  63 static int policy_check_period = 1;
  64 static int policy_check_next = CLASS_PERIOD_MULT;
  65
  66
  67 static int
  68 common_hook(void)
  69 {
  70         int     i;
  71         int     rv = 0;
  72
  73         if ((i = get_thread_lock_count(current_thread())) != 0) {
  74                 /*
  75                  * fail the MACF check if we hold a lock; this assumes a
  76                  * a non-void (authorization) MACF hook.
  77                  */
  78                 if (policy_flags & CHECK_POLICY_FAIL) {
  79                         rv = EPERM;
  80                 }
  81
  82                 /*
  83                  * display a backtrace if we hold a lock and we are not
  84                  * going to panic
  85                  */
  86                 if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) {
  87                         if (policy_flags & CHECK_POLICY_PERIODIC) {
  88                                 /* at exponentially increasing intervals */
  89                                 if (!(policy_check_event % policy_check_period)) {
  90                                         if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
  91                                                 /*
  92                                                  * According to Derek, we could
  93                                                  * technically get a symbolicated name
  94                                                  * here, if we refactered some code
  95                                                  * and set the "keepsyms=1" boot
  96                                                  * argument...
  97                                                  */
  98                                                 OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
  99                                         }
 100                                 } else {
 101                                         if (policy_check_period < CLASS_PERIOD_LIMIT) {
 102                                                 policy_check_next *= CLASS_PERIOD_MULT;
 103                                                 policy_check_period *= CLASS_PERIOD_MULT;
 104                                         }
 105                                 }
 106                         } else {
 107                                 /* always */
 108                                 OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
 109                         }
 110                 }
 111
 112                 /* Panic */
 113                 if (policy_flags & CHECK_POLICY_PANIC) {
 114                         panic("calling MACF hook with mutex count %d\n", i);
 115                 }
 116
 117                 /* count for non-fatal tracing */
 118                 policy_check_event++;
 119         }
 120
 121         return rv;
 122 }
 123
 124 #if (MAC_POLICY_OPS_VERSION != 69)
 125 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 126 #endif
 127 /*
 128  * Policy hooks; one per possible hook
 129  *
 130  * Please note that this struct initialization should be kept in sync with
 131  * security/mac_policy.h (mac_policy_ops struct definition).
 132  */
 133 const static struct mac_policy_ops policy_ops = {
 134         CHECK_SET_HOOK(audit_check_postselect)
 135         CHECK_SET_HOOK(audit_check_preselect)
 136
 137         .mpo_reserved01 = (mpo_reserved_hook_t *)common_hook,
 138         .mpo_reserved02 = (mpo_reserved_hook_t *)common_hook,
 139         .mpo_reserved03 = (mpo_reserved_hook_t *)common_hook,
 140         .mpo_reserved04 = (mpo_reserved_hook_t *)common_hook,
 141
 142         CHECK_SET_HOOK(cred_check_label_update_execve)
 143         CHECK_SET_HOOK(cred_check_label_update)
 144         CHECK_SET_HOOK(cred_check_visible)
 145         CHECK_SET_HOOK(cred_label_associate_fork)
 146         CHECK_SET_HOOK(cred_label_associate_kernel)
 147         CHECK_SET_HOOK(cred_label_associate)
 148         CHECK_SET_HOOK(cred_label_associate_user)
 149         CHECK_SET_HOOK(cred_label_destroy)
 150         CHECK_SET_HOOK(cred_label_externalize_audit)
 151         CHECK_SET_HOOK(cred_label_externalize)
 152         CHECK_SET_HOOK(cred_label_init)
 153         CHECK_SET_HOOK(cred_label_internalize)
 154         CHECK_SET_HOOK(cred_label_update_execve)
 155         CHECK_SET_HOOK(cred_label_update)
 156
 157         CHECK_SET_HOOK(devfs_label_associate_device)
 158         CHECK_SET_HOOK(devfs_label_associate_directory)
 159         CHECK_SET_HOOK(devfs_label_copy)
 160         CHECK_SET_HOOK(devfs_label_destroy)
 161         CHECK_SET_HOOK(devfs_label_init)
 162         CHECK_SET_HOOK(devfs_label_update)
 163
 164         CHECK_SET_HOOK(file_check_change_offset)
 165         CHECK_SET_HOOK(file_check_create)
 166         CHECK_SET_HOOK(file_check_dup)
 167         CHECK_SET_HOOK(file_check_fcntl)
 168         CHECK_SET_HOOK(file_check_get_offset)
 169         CHECK_SET_HOOK(file_check_get)
 170         CHECK_SET_HOOK(file_check_inherit)
 171         CHECK_SET_HOOK(file_check_ioctl)
 172         CHECK_SET_HOOK(file_check_lock)
 173         CHECK_SET_HOOK(file_check_mmap_downgrade)
 174         CHECK_SET_HOOK(file_check_mmap)
 175         CHECK_SET_HOOK(file_check_receive)
 176         CHECK_SET_HOOK(file_check_set)
 177         CHECK_SET_HOOK(file_label_init)
 178         CHECK_SET_HOOK(file_label_destroy)
 179         CHECK_SET_HOOK(file_label_associate)
 180         CHECK_SET_HOOK(file_notify_close)
 181
 182         .mpo_reserved06 = (mpo_reserved_hook_t *)common_hook,
 183         .mpo_reserved07 = (mpo_reserved_hook_t *)common_hook,
 184         .mpo_reserved08 = (mpo_reserved_hook_t *)common_hook,
 185         .mpo_reserved09 = (mpo_reserved_hook_t *)common_hook,
 186         .mpo_reserved10 = (mpo_reserved_hook_t *)common_hook,
 187         .mpo_reserved11 = (mpo_reserved_hook_t *)common_hook,
 188         .mpo_reserved12 = (mpo_reserved_hook_t *)common_hook,
 189         .mpo_reserved13 = (mpo_reserved_hook_t *)common_hook,
 190         .mpo_reserved14 = (mpo_reserved_hook_t *)common_hook,
 191         .mpo_reserved15 = (mpo_reserved_hook_t *)common_hook,
 192         .mpo_reserved16 = (mpo_reserved_hook_t *)common_hook,
 193         .mpo_reserved17 = (mpo_reserved_hook_t *)common_hook,
 194         .mpo_reserved18 = (mpo_reserved_hook_t *)common_hook,
 195         .mpo_reserved19 = (mpo_reserved_hook_t *)common_hook,
 196         .mpo_reserved20 = (mpo_reserved_hook_t *)common_hook,
 197         .mpo_reserved21 = (mpo_reserved_hook_t *)common_hook,
 198         .mpo_reserved22 = (mpo_reserved_hook_t *)common_hook,
 199         .mpo_reserved23 = (mpo_reserved_hook_t *)common_hook,
 200         .mpo_reserved24 = (mpo_reserved_hook_t *)common_hook,
 201         .mpo_reserved25 = (mpo_reserved_hook_t *)common_hook,
 202         .mpo_reserved26 = (mpo_reserved_hook_t *)common_hook,
 203
 204         CHECK_SET_HOOK(file_check_library_validation)
 205
 206         CHECK_SET_HOOK(vnode_notify_setacl)
 207         CHECK_SET_HOOK(vnode_notify_setattrlist)
 208         CHECK_SET_HOOK(vnode_notify_setextattr)
 209         CHECK_SET_HOOK(vnode_notify_setflags)
 210         CHECK_SET_HOOK(vnode_notify_setmode)
 211         CHECK_SET_HOOK(vnode_notify_setowner)
 212         CHECK_SET_HOOK(vnode_notify_setutimes)
 213         CHECK_SET_HOOK(vnode_notify_truncate)
 214
 215         .mpo_reserved27 = (mpo_reserved_hook_t *)common_hook,
 216         .mpo_reserved28 = (mpo_reserved_hook_t *)common_hook,
 217         .mpo_reserved29 = (mpo_reserved_hook_t *)common_hook,
 218         .mpo_reserved30 = (mpo_reserved_hook_t *)common_hook,
 219         .mpo_reserved31 = (mpo_reserved_hook_t *)common_hook,
 220         .mpo_reserved32 = (mpo_reserved_hook_t *)common_hook,
 221         .mpo_reserved33 = (mpo_reserved_hook_t *)common_hook,
 222         .mpo_reserved34 = (mpo_reserved_hook_t *)common_hook,
 223         .mpo_reserved35 = (mpo_reserved_hook_t *)common_hook,
 224         .mpo_reserved36 = (mpo_reserved_hook_t *)common_hook,
 225         .mpo_reserved37 = (mpo_reserved_hook_t *)common_hook,
 226
 227         CHECK_SET_HOOK(mount_check_fsctl)
 228         CHECK_SET_HOOK(mount_check_getattr)
 229         CHECK_SET_HOOK(mount_check_label_update)
 230         CHECK_SET_HOOK(mount_check_mount)
 231         CHECK_SET_HOOK(mount_check_remount)
 232         CHECK_SET_HOOK(mount_check_setattr)
 233         CHECK_SET_HOOK(mount_check_stat)
 234         CHECK_SET_HOOK(mount_check_umount)
 235         CHECK_SET_HOOK(mount_label_associate)
 236         CHECK_SET_HOOK(mount_label_destroy)
 237         CHECK_SET_HOOK(mount_label_externalize)
 238         CHECK_SET_HOOK(mount_label_init)
 239         CHECK_SET_HOOK(mount_label_internalize)
 240
 241         .mpo_reserved38 = (mpo_reserved_hook_t *)common_hook,
 242         .mpo_reserved39 = (mpo_reserved_hook_t *)common_hook,
 243         .mpo_reserved40 = (mpo_reserved_hook_t *)common_hook,
 244
 245         CHECK_SET_HOOK(pipe_check_ioctl)
 246         CHECK_SET_HOOK(pipe_check_kqfilter)
 247         .mpo_reserved41 = (mpo_reserved_hook_t *)common_hook,
 248         CHECK_SET_HOOK(pipe_check_read)
 249         CHECK_SET_HOOK(pipe_check_select)
 250         CHECK_SET_HOOK(pipe_check_stat)
 251         CHECK_SET_HOOK(pipe_check_write)
 252         CHECK_SET_HOOK(pipe_label_associate)
 253         .mpo_reserved42 = (mpo_reserved_hook_t *)common_hook,
 254         CHECK_SET_HOOK(pipe_label_destroy)
 255         .mpo_reserved43 = (mpo_reserved_hook_t *)common_hook,
 256         CHECK_SET_HOOK(pipe_label_init)
 257         .mpo_reserved44 = (mpo_reserved_hook_t *)common_hook,
 258         .mpo_reserved45 = (mpo_reserved_hook_t *)common_hook,
 259
 260         CHECK_SET_HOOK(policy_destroy)
 261         /* special hooks for policy init's */
 262         .mpo_policy_init = hook_policy_init,
 263         .mpo_policy_initbsd = hook_policy_initbsd,
 264         CHECK_SET_HOOK(policy_syscall)
 265
 266         CHECK_SET_HOOK(system_check_sysctlbyname)
 267         CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
 268         CHECK_SET_HOOK(vnode_check_rename)
 269         CHECK_SET_HOOK(kext_check_query)
 270         CHECK_SET_HOOK(proc_notify_exec_complete)
 271         CHECK_SET_HOOK(proc_notify_cs_invalidated)
 272         CHECK_SET_HOOK(proc_check_syscall_unix)
 273         CHECK_SET_HOOK(proc_check_expose_task)
 274         CHECK_SET_HOOK(proc_check_set_host_special_port)
 275         CHECK_SET_HOOK(proc_check_set_host_exception_port)
 276         CHECK_SET_HOOK(exc_action_check_exception_send)
 277         CHECK_SET_HOOK(exc_action_label_associate)
 278         CHECK_SET_HOOK(exc_action_label_populate)
 279         CHECK_SET_HOOK(exc_action_label_destroy)
 280         CHECK_SET_HOOK(exc_action_label_init)
 281         CHECK_SET_HOOK(exc_action_label_update)
 282
 283         CHECK_SET_HOOK(vnode_check_trigger_resolve)
 284         CHECK_SET_HOOK(mount_check_mount_late)
 285         CHECK_SET_HOOK(mount_check_snapshot_mount)
 286         CHECK_SET_HOOK(vnode_notify_reclaim)
 287         CHECK_SET_HOOK(skywalk_flow_check_connect)
 288         CHECK_SET_HOOK(skywalk_flow_check_listen)
 289
 290         CHECK_SET_HOOK(posixsem_check_create)
 291         CHECK_SET_HOOK(posixsem_check_open)
 292         CHECK_SET_HOOK(posixsem_check_post)
 293         CHECK_SET_HOOK(posixsem_check_unlink)
 294         CHECK_SET_HOOK(posixsem_check_wait)
 295         CHECK_SET_HOOK(posixsem_label_associate)
 296         CHECK_SET_HOOK(posixsem_label_destroy)
 297         CHECK_SET_HOOK(posixsem_label_init)
 298         CHECK_SET_HOOK(posixshm_check_create)
 299         CHECK_SET_HOOK(posixshm_check_mmap)
 300         CHECK_SET_HOOK(posixshm_check_open)
 301         CHECK_SET_HOOK(posixshm_check_stat)
 302         CHECK_SET_HOOK(posixshm_check_truncate)
 303         CHECK_SET_HOOK(posixshm_check_unlink)
 304         CHECK_SET_HOOK(posixshm_label_associate)
 305         CHECK_SET_HOOK(posixshm_label_destroy)
 306         CHECK_SET_HOOK(posixshm_label_init)
 307
 308         CHECK_SET_HOOK(proc_check_debug)
 309         CHECK_SET_HOOK(proc_check_fork)
 310         CHECK_SET_HOOK(proc_check_get_task_name)
 311         CHECK_SET_HOOK(proc_check_get_task)
 312         CHECK_SET_HOOK(proc_check_getaudit)
 313         CHECK_SET_HOOK(proc_check_getauid)
 314         CHECK_SET_HOOK(proc_check_getlcid)
 315         CHECK_SET_HOOK(proc_check_mprotect)
 316         CHECK_SET_HOOK(proc_check_sched)
 317         CHECK_SET_HOOK(proc_check_setaudit)
 318         CHECK_SET_HOOK(proc_check_setauid)
 319         CHECK_SET_HOOK(proc_check_setlcid)
 320         CHECK_SET_HOOK(proc_check_signal)
 321         CHECK_SET_HOOK(proc_check_wait)
 322         CHECK_SET_HOOK(proc_check_dump_core)
 323         CHECK_SET_HOOK(proc_check_remote_thread_create)
 324
 325         CHECK_SET_HOOK(socket_check_accept)
 326         CHECK_SET_HOOK(socket_check_accepted)
 327         CHECK_SET_HOOK(socket_check_bind)
 328         CHECK_SET_HOOK(socket_check_connect)
 329         CHECK_SET_HOOK(socket_check_create)
 330         .mpo_reserved46 = (mpo_reserved_hook_t *)common_hook,
 331         .mpo_reserved47 = (mpo_reserved_hook_t *)common_hook,
 332         .mpo_reserved48 = (mpo_reserved_hook_t *)common_hook,
 333         CHECK_SET_HOOK(socket_check_listen)
 334         CHECK_SET_HOOK(socket_check_receive)
 335         CHECK_SET_HOOK(socket_check_received)
 336         .mpo_reserved49 = (mpo_reserved_hook_t *)common_hook,
 337         CHECK_SET_HOOK(socket_check_send)
 338         CHECK_SET_HOOK(socket_check_stat)
 339         CHECK_SET_HOOK(socket_check_setsockopt)
 340         CHECK_SET_HOOK(socket_check_getsockopt)
 341
 342         .mpo_reserved50 = (mpo_reserved_hook_t *)common_hook,
 343         .mpo_reserved51 = (mpo_reserved_hook_t *)common_hook,
 344         .mpo_reserved52 = (mpo_reserved_hook_t *)common_hook,
 345         .mpo_reserved53 = (mpo_reserved_hook_t *)common_hook,
 346         .mpo_reserved54 = (mpo_reserved_hook_t *)common_hook,
 347         .mpo_reserved55 = (mpo_reserved_hook_t *)common_hook,
 348         .mpo_reserved56 = (mpo_reserved_hook_t *)common_hook,
 349         .mpo_reserved57 = (mpo_reserved_hook_t *)common_hook,
 350         .mpo_reserved58 = (mpo_reserved_hook_t *)common_hook,
 351         .mpo_reserved59 = (mpo_reserved_hook_t *)common_hook,
 352         .mpo_reserved60 = (mpo_reserved_hook_t *)common_hook,
 353         .mpo_reserved61 = (mpo_reserved_hook_t *)common_hook,
 354         .mpo_reserved62 = (mpo_reserved_hook_t *)common_hook,
 355
 356         CHECK_SET_HOOK(system_check_acct)
 357         CHECK_SET_HOOK(system_check_audit)
 358         CHECK_SET_HOOK(system_check_auditctl)
 359         CHECK_SET_HOOK(system_check_auditon)
 360         CHECK_SET_HOOK(system_check_host_priv)
 361         CHECK_SET_HOOK(system_check_nfsd)
 362         CHECK_SET_HOOK(system_check_reboot)
 363         CHECK_SET_HOOK(system_check_settime)
 364         CHECK_SET_HOOK(system_check_swapoff)
 365         CHECK_SET_HOOK(system_check_swapon)
 366         CHECK_SET_HOOK(socket_check_ioctl)
 367
 368         CHECK_SET_HOOK(sysvmsg_label_associate)
 369         CHECK_SET_HOOK(sysvmsg_label_destroy)
 370         CHECK_SET_HOOK(sysvmsg_label_init)
 371         CHECK_SET_HOOK(sysvmsg_label_recycle)
 372         CHECK_SET_HOOK(sysvmsq_check_enqueue)
 373         CHECK_SET_HOOK(sysvmsq_check_msgrcv)
 374         CHECK_SET_HOOK(sysvmsq_check_msgrmid)
 375         CHECK_SET_HOOK(sysvmsq_check_msqctl)
 376         CHECK_SET_HOOK(sysvmsq_check_msqget)
 377         CHECK_SET_HOOK(sysvmsq_check_msqrcv)
 378         CHECK_SET_HOOK(sysvmsq_check_msqsnd)
 379         CHECK_SET_HOOK(sysvmsq_label_associate)
 380         CHECK_SET_HOOK(sysvmsq_label_destroy)
 381         CHECK_SET_HOOK(sysvmsq_label_init)
 382         CHECK_SET_HOOK(sysvmsq_label_recycle)
 383         CHECK_SET_HOOK(sysvsem_check_semctl)
 384         CHECK_SET_HOOK(sysvsem_check_semget)
 385         CHECK_SET_HOOK(sysvsem_check_semop)
 386         CHECK_SET_HOOK(sysvsem_label_associate)
 387         CHECK_SET_HOOK(sysvsem_label_destroy)
 388         CHECK_SET_HOOK(sysvsem_label_init)
 389         CHECK_SET_HOOK(sysvsem_label_recycle)
 390         CHECK_SET_HOOK(sysvshm_check_shmat)
 391         CHECK_SET_HOOK(sysvshm_check_shmctl)
 392         CHECK_SET_HOOK(sysvshm_check_shmdt)
 393         CHECK_SET_HOOK(sysvshm_check_shmget)
 394         CHECK_SET_HOOK(sysvshm_label_associate)
 395         CHECK_SET_HOOK(sysvshm_label_destroy)
 396         CHECK_SET_HOOK(sysvshm_label_init)
 397         CHECK_SET_HOOK(sysvshm_label_recycle)
 398
 399         CHECK_SET_HOOK(proc_notify_exit)
 400         CHECK_SET_HOOK(mount_check_snapshot_revert)
 401         CHECK_SET_HOOK(vnode_check_getattr)
 402         CHECK_SET_HOOK(mount_check_snapshot_create)
 403         CHECK_SET_HOOK(mount_check_snapshot_delete)
 404         CHECK_SET_HOOK(vnode_check_clone)
 405         CHECK_SET_HOOK(proc_check_get_cs_info)
 406         CHECK_SET_HOOK(proc_check_set_cs_info)
 407
 408         CHECK_SET_HOOK(iokit_check_hid_control)
 409
 410         CHECK_SET_HOOK(vnode_check_access)
 411         CHECK_SET_HOOK(vnode_check_chdir)
 412         CHECK_SET_HOOK(vnode_check_chroot)
 413         CHECK_SET_HOOK(vnode_check_create)
 414         CHECK_SET_HOOK(vnode_check_deleteextattr)
 415         CHECK_SET_HOOK(vnode_check_exchangedata)
 416         CHECK_SET_HOOK(vnode_check_exec)
 417         CHECK_SET_HOOK(vnode_check_getattrlist)
 418         CHECK_SET_HOOK(vnode_check_getextattr)
 419         CHECK_SET_HOOK(vnode_check_ioctl)
 420         CHECK_SET_HOOK(vnode_check_kqfilter)
 421         CHECK_SET_HOOK(vnode_check_label_update)
 422         CHECK_SET_HOOK(vnode_check_link)
 423         CHECK_SET_HOOK(vnode_check_listextattr)
 424         CHECK_SET_HOOK(vnode_check_lookup)
 425         CHECK_SET_HOOK(vnode_check_open)
 426         CHECK_SET_HOOK(vnode_check_read)
 427         CHECK_SET_HOOK(vnode_check_readdir)
 428         CHECK_SET_HOOK(vnode_check_readlink)
 429         CHECK_SET_HOOK(vnode_check_rename_from)
 430         CHECK_SET_HOOK(vnode_check_rename_to)
 431         CHECK_SET_HOOK(vnode_check_revoke)
 432         CHECK_SET_HOOK(vnode_check_select)
 433         CHECK_SET_HOOK(vnode_check_setattrlist)
 434         CHECK_SET_HOOK(vnode_check_setextattr)
 435         CHECK_SET_HOOK(vnode_check_setflags)
 436         CHECK_SET_HOOK(vnode_check_setmode)
 437         CHECK_SET_HOOK(vnode_check_setowner)
 438         CHECK_SET_HOOK(vnode_check_setutimes)
 439         CHECK_SET_HOOK(vnode_check_stat)
 440         CHECK_SET_HOOK(vnode_check_truncate)
 441         CHECK_SET_HOOK(vnode_check_unlink)
 442         CHECK_SET_HOOK(vnode_check_write)
 443         CHECK_SET_HOOK(vnode_label_associate_devfs)
 444         CHECK_SET_HOOK(vnode_label_associate_extattr)
 445         CHECK_SET_HOOK(vnode_label_associate_file)
 446         CHECK_SET_HOOK(vnode_label_associate_pipe)
 447         CHECK_SET_HOOK(vnode_label_associate_posixsem)
 448         CHECK_SET_HOOK(vnode_label_associate_posixshm)
 449         CHECK_SET_HOOK(vnode_label_associate_singlelabel)
 450         CHECK_SET_HOOK(vnode_label_associate_socket)
 451         CHECK_SET_HOOK(vnode_label_copy)
 452         CHECK_SET_HOOK(vnode_label_destroy)
 453         CHECK_SET_HOOK(vnode_label_externalize_audit)
 454         CHECK_SET_HOOK(vnode_label_externalize)
 455         CHECK_SET_HOOK(vnode_label_init)
 456         CHECK_SET_HOOK(vnode_label_internalize)
 457         CHECK_SET_HOOK(vnode_label_recycle)
 458         CHECK_SET_HOOK(vnode_label_store)
 459         CHECK_SET_HOOK(vnode_label_update_extattr)
 460         CHECK_SET_HOOK(vnode_label_update)
 461         CHECK_SET_HOOK(vnode_notify_create)
 462         CHECK_SET_HOOK(vnode_check_signature)
 463         CHECK_SET_HOOK(vnode_check_uipc_bind)
 464         CHECK_SET_HOOK(vnode_check_uipc_connect)
 465
 466         CHECK_SET_HOOK(proc_check_run_cs_invalid)
 467         CHECK_SET_HOOK(proc_check_suspend_resume)
 468
 469         CHECK_SET_HOOK(thread_userret)
 470
 471         CHECK_SET_HOOK(iokit_check_set_properties)
 472
 473         CHECK_SET_HOOK(vnode_check_supplemental_signature)
 474
 475         CHECK_SET_HOOK(vnode_check_searchfs)
 476
 477         CHECK_SET_HOOK(priv_check)
 478         CHECK_SET_HOOK(priv_grant)
 479
 480         CHECK_SET_HOOK(proc_check_map_anon)
 481
 482         CHECK_SET_HOOK(vnode_check_fsgetpath)
 483
 484         CHECK_SET_HOOK(iokit_check_open)
 485
 486         CHECK_SET_HOOK(proc_check_ledger)
 487
 488         CHECK_SET_HOOK(vnode_notify_rename)
 489
 490         CHECK_SET_HOOK(vnode_check_setacl)
 491
 492         CHECK_SET_HOOK(vnode_notify_deleteextattr)
 493
 494         CHECK_SET_HOOK(system_check_kas_info)
 495
 496         CHECK_SET_HOOK(vnode_check_lookup_preflight)
 497
 498         CHECK_SET_HOOK(vnode_notify_open)
 499
 500         CHECK_SET_HOOK(system_check_info)
 501
 502         CHECK_SET_HOOK(pty_notify_grant)
 503         CHECK_SET_HOOK(pty_notify_close)
 504
 505         CHECK_SET_HOOK(vnode_find_sigs)
 506
 507         CHECK_SET_HOOK(kext_check_load)
 508         CHECK_SET_HOOK(kext_check_unload)
 509
 510         CHECK_SET_HOOK(proc_check_proc_info)
 511
 512         CHECK_SET_HOOK(vnode_notify_link)
 513
 514         CHECK_SET_HOOK(iokit_check_filter_properties)
 515         CHECK_SET_HOOK(iokit_check_get_property)
 516 };
 517
 518 /*
 519  * Policy definition
 520  */
 521 static SECURITY_READ_ONLY_LATE(struct mac_policy_conf) policy_conf = {
 522         .mpc_name               = "CHECK",
 523         .mpc_fullname           = "Check Assumptions Policy",
 524         .mpc_field_off          = NULL,         /* no label slot */
 525         .mpc_labelnames         = NULL,         /* no policy label names */
 526         .mpc_labelname_count    = 0,            /* count of label names is 0 */
 527         .mpc_ops                = &policy_ops,  /* policy operations */
 528         .mpc_loadtime_flags     = 0,
 529         .mpc_runtime_flags      = 0,
 530 };
 531
 532 static SECURITY_READ_ONLY_LATE(mac_policy_handle_t) policy_handle;
 533
 534 /*
 535  * Init routine; for a loadable policy, this would be called during the KEXT
 536  * initialization; we're going to call this from bsd_init() if the boot
 537  * argument for checking is present.
 538  */
 539 errno_t
 540 check_policy_init(int flags)
 541 {
 542         /* Only instantiate the module if we have been asked to do checking */
 543         if (!flags) {
 544                 return 0;
 545         }
 546
 547         policy_flags = flags;
 548
 549         return mac_policy_register(&policy_conf, &policy_handle, NULL);
 550 }