security/mac_framework.h

   1 /*
   2  * Copyright (c) 2007 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*-
  29  * Copyright (c) 1999-2002 Robert N. M. Watson
  30  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
  31  * Copyright (c) 2005-2007 SPARTA, Inc.
  32  * All rights reserved.
  33  *
  34  * This software was developed by Robert Watson for the TrustedBSD Project.
  35  *
  36  * This software was developed for the FreeBSD Project in part by Network
  37  * Associates Laboratories, the Security Research Division of Network
  38  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  39  * as part of the DARPA CHATS research program.
  40  *
  41  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  42  * N66001-04-C-6019 ("SEFOS").
  43  *
  44  * Redistribution and use in source and binary forms, with or without
  45  * modification, are permitted provided that the following conditions
  46  * are met:
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  * 2. Redistributions in binary form must reproduce the above copyright
  50  *    notice, this list of conditions and the following disclaimer in the
  51  *    documentation and/or other materials provided with the distribution.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  63  * SUCH DAMAGE.
  64  *
  65  * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $
  66  *
  67  */
  68 /*
  69  * Kernel interface for Mandatory Access Control -- how kernel services
  70  * interact with the TrustedBSD MAC Framework.
  71  */
  72
  73 #ifndef _SECURITY_MAC_FRAMEWORK_H_
  74 #define _SECURITY_MAC_FRAMEWORK_H_
  75
  76 #ifndef KERNEL
  77 #error "no user-serviceable parts inside"
  78 #endif
  79
  80 #ifndef PRIVATE
  81 #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
  82 #endif
  83
  84 struct attrlist;
  85 struct auditinfo;
  86 struct componentname;
  87 struct cs_blob;
  88 struct devnode;
  89 struct exception_action;
  90 struct flock;
  91 struct fdescnode;
  92 struct fileglob;
  93 struct fileproc;
  94 struct ifreq;
  95 struct image_params;
  96 struct ipc_port;
  97 struct knote;
  98 struct mac;
  99 struct msg;
 100 struct msqid_kernel;
 101 struct mount;
 102 struct pipe;
 103 struct proc;
 104 struct pseminfo;
 105 struct pshminfo;
 106 struct semid_kernel;
 107 struct shmid_kernel;
 108 struct sockaddr;
 109 struct sockopt;
 110 struct socket;
 111 struct task;
 112 struct thread;
 113 struct timespec;
 114 struct tty;
 115 struct ucred;
 116 struct uio;
 117 struct uthread;
 118 struct vfs_attr;
 119 struct vfs_context;
 120 struct vnode;
 121 struct vnode_attr;
 122 struct vop_setlabel_args;
 123
 124 #include <stdbool.h>
 125 #include <sys/kauth.h>
 126 #include <sys/kernel_types.h>
 127
 128 #if CONFIG_MACF
 129
 130 #ifndef __IOKIT_PORTS_DEFINED__
 131 #define __IOKIT_PORTS_DEFINED__
 132 #ifdef __cplusplus
 133 class OSObject;
 134 typedef OSObject *io_object_t;
 135 #else
 136 struct OSObject;
 137 typedef struct OSObject *io_object_t;
 138 #endif
 139 #endif /* __IOKIT_PORTS_DEFINED__ */
 140
 141 /*@ macros */
 142 #define VNODE_LABEL_CREATE      1
 143
 144 /*@ === */
 145 int     mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode,
 146     void *args, int error, int retval, int mac_forced) __result_use_check;
 147 int     mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode,
 148     void *args) __result_use_check;
 149 int     mac_cred_check_label_update(kauth_cred_t cred,
 150     struct label *newlabel) __result_use_check;
 151 int     mac_cred_check_label_update_execve(vfs_context_t ctx,
 152     struct vnode *vp, off_t offset, struct vnode *scriptvp,
 153     struct label *scriptvnodelabel, struct label *execlabel,
 154     proc_t proc, void *macextensions) __result_use_check;
 155 int     mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2) __result_use_check;
 156 struct label    *mac_cred_label_alloc(void);
 157 void    mac_cred_label_associate(kauth_cred_t cred_parent,
 158     kauth_cred_t cred_child);
 159 void    mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child);
 160 void    mac_cred_label_associate_kernel(kauth_cred_t cred);
 161 void    mac_cred_label_associate_user(kauth_cred_t cred);
 162 void    mac_cred_label_destroy(kauth_cred_t cred);
 163 int     mac_cred_label_externalize_audit(proc_t p, struct mac *mac) __result_use_check;
 164 void    mac_cred_label_free(struct label *label);
 165 void    mac_cred_label_init(kauth_cred_t cred);
 166 bool    mac_cred_label_is_equal(const struct label *a, const struct label *b) __result_use_check;
 167 uint32_t mac_cred_label_hash_update(const struct label *a, uint32_t hash);
 168 void    mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
 169 void    mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
 170     struct vnode *vp, off_t offset, struct vnode *scriptvp,
 171     struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags,
 172     void *macextensions, int *disjoint, int *labelupdateerror);
 173 void    mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
 174     const char *fullpath);
 175 void    mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
 176     struct devnode *de, const char *fullpath);
 177 void    mac_devfs_label_copy(struct label *, struct label *label);
 178 void    mac_devfs_label_destroy(struct devnode *de);
 179 void    mac_devfs_label_init(struct devnode *de);
 180 void    mac_devfs_label_update(struct mount *mp, struct devnode *de,
 181     struct vnode *vp);
 182 int     mac_execve_enter(user_addr_t mac_p, struct image_params *imgp) __result_use_check;
 183 int     mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
 184 int     mac_file_check_create(kauth_cred_t cred) __result_use_check;
 185 int     mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd) __result_use_check;
 186 int     mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd,
 187     user_long_t arg) __result_use_check;
 188 int     mac_file_check_get(kauth_cred_t cred, struct fileglob *fg,
 189     char *elements, size_t len) __result_use_check;
 190 int     mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
 191 int     mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
 192 int     mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg,
 193     unsigned long cmd) __result_use_check;
 194 int     mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op,
 195     struct flock *fl) __result_use_check;
 196 int     mac_file_check_library_validation(struct proc *proc,
 197     struct fileglob *fg, off_t slice_offset,
 198     user_long_t error_message, size_t error_message_size) __result_use_check;
 199 int     mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg,
 200     int prot, int flags, uint64_t file_pos, int *maxprot) __result_use_check;
 201 void    mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg,
 202     int *prot);
 203 int     mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
 204 int     mac_file_check_set(kauth_cred_t cred, struct fileglob *fg,
 205     char *bufp, size_t buflen) __result_use_check;
 206 void    mac_file_notify_close(struct ucred *cred, struct fileglob *fg);
 207 void    mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg);
 208 void    mac_file_label_destroy(struct fileglob *fg);
 209 void    mac_file_label_init(struct fileglob *fg);
 210 int     mac_iokit_check_open_service(kauth_cred_t cred, io_object_t service, unsigned int user_client_type) __result_use_check;
 211 int     mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type) __result_use_check;
 212 int     mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties) __result_use_check;
 213 int     mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry) __result_use_check;
 214 int     mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name) __result_use_check;
 215 #ifdef KERNEL_PRIVATE
 216 int     mac_iokit_check_hid_control(kauth_cred_t cred) __result_use_check;
 217 #endif
 218 int     mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp,
 219     unsigned long cmd) __result_use_check;
 220 int     mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp,
 221     struct vfs_attr *vfa) __result_use_check;
 222 int     mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp) __result_use_check;
 223 int     mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp,
 224     struct componentname *cnp, const char *vfc_name) __result_use_check;
 225 int     mac_mount_check_mount_late(vfs_context_t ctx, struct mount *mp) __result_use_check;
 226 int     mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp,
 227     const char *name) __result_use_check;
 228 int     mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp,
 229     const char *name) __result_use_check;
 230 #ifdef KERNEL_PRIVATE
 231 int     mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp,
 232     struct vnode *vp, struct componentname *cnp, const char *name,
 233     const char *vfc_name) __result_use_check;
 234 #endif
 235 int     mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp,
 236     const char *name) __result_use_check;
 237 int     mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) __result_use_check;
 238 int     mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp,
 239     struct vfs_attr *vfa) __result_use_check;
 240 int     mac_mount_check_stat(vfs_context_t ctx, struct mount *mp) __result_use_check;
 241 int     mac_mount_check_umount(vfs_context_t ctx, struct mount *mp) __result_use_check;
 242 void    mac_mount_label_associate(vfs_context_t ctx, struct mount *mp);
 243 void    mac_mount_label_destroy(struct mount *mp);
 244 int     mac_mount_label_externalize(struct label *label, char *elements,
 245     char *outbuf, size_t outbuflen) __result_use_check;
 246 int     mac_mount_label_get(struct mount *mp, user_addr_t mac_p) __result_use_check;
 247 void    mac_mount_label_init(struct mount *);
 248 int     mac_mount_label_internalize(struct label *, char *string) __result_use_check;
 249 int     mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe,
 250     unsigned long cmd) __result_use_check;
 251 int     mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn,
 252     struct pipe *cpipe) __result_use_check;
 253 int     mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe) __result_use_check;
 254 int     mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe,
 255     int which) __result_use_check;
 256 int     mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe) __result_use_check;
 257 int     mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe) __result_use_check;
 258 struct label    *mac_pipe_label_alloc(void);
 259 void    mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe);
 260 void    mac_pipe_label_destroy(struct pipe *cpipe);
 261 void    mac_pipe_label_free(struct label *label);
 262 void    mac_pipe_label_init(struct pipe *cpipe);
 263 void    mac_policy_initbsd(void);
 264 int     mac_posixsem_check_create(kauth_cred_t cred, const char *name) __result_use_check;
 265 int     mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem) __result_use_check;
 266 int     mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem) __result_use_check;
 267 int     mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem,
 268     const char *name) __result_use_check;
 269 int     mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem) __result_use_check;
 270 void    mac_posixsem_vnode_label_associate(kauth_cred_t cred,
 271     struct pseminfo *psem, struct label *plabel,
 272     vnode_t vp, struct label *vlabel);
 273 void    mac_posixsem_label_associate(kauth_cred_t cred,
 274     struct pseminfo *psem, const char *name);
 275 void    mac_posixsem_label_destroy(struct pseminfo *psem);
 276 void    mac_posixsem_label_init(struct pseminfo *psem);
 277 int     mac_posixshm_check_create(kauth_cred_t cred, const char *name) __result_use_check;
 278 int     mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm,
 279     int prot, int flags) __result_use_check;
 280 int     mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm,
 281     int fflags) __result_use_check;
 282 int     mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm) __result_use_check;
 283 int     mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm,
 284     off_t s) __result_use_check;
 285 int     mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm,
 286     const char *name) __result_use_check;
 287 void    mac_posixshm_vnode_label_associate(kauth_cred_t cred,
 288     struct pshminfo *pshm, struct label *plabel,
 289     vnode_t vp, struct label *vlabel);
 290 void    mac_posixshm_label_associate(kauth_cred_t cred,
 291     struct pshminfo *pshm, const char *name);
 292 void    mac_posixshm_label_destroy(struct pshminfo *pshm);
 293 void    mac_posixshm_label_init(struct pshminfo *pshm);
 294 int     mac_priv_check(kauth_cred_t cred, int priv) __result_use_check;
 295 int     mac_priv_grant(kauth_cred_t cred, int priv) __result_use_check;
 296 int     mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident) __result_use_check;
 297 int     mac_proc_check_dump_core(proc_t proc) __result_use_check;
 298 int     mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor) __result_use_check;
 299 int     mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check;
 300 int     mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check;
 301 int     mac_proc_check_fork(proc_t proc) __result_use_check;
 302 int     mac_proc_check_suspend_resume(proc_t proc, int sr) __result_use_check;
 303 int     mac_proc_check_get_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check;
 304 int     mac_proc_check_expose_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check;
 305 int     mac_proc_check_get_movable_control_port(void) __result_use_check;
 306 int     mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp) __result_use_check;
 307 int     mac_proc_check_getaudit(proc_t proc) __result_use_check;
 308 int     mac_proc_check_getauid(proc_t proc) __result_use_check;
 309 int     mac_proc_check_getlcid(proc_t proc1, proc_t proc2,
 310     pid_t pid) __result_use_check;
 311 int     mac_proc_check_dyld_process_info_notify_register(void) __result_use_check;
 312 int     mac_proc_check_ledger(proc_t curp, proc_t target, int op) __result_use_check;
 313 int     mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
 314     user_size_t u_size, int prot, int flags, int *maxprot) __result_use_check;
 315 int     mac_proc_check_mprotect(proc_t proc,
 316     user_addr_t addr, user_size_t size, int prot) __result_use_check;
 317 int     mac_proc_check_run_cs_invalid(proc_t proc) __result_use_check;
 318 void    mac_proc_notify_cs_invalidated(proc_t proc);
 319 int     mac_proc_check_sched(proc_t proc, proc_t proc2) __result_use_check;
 320 int     mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai) __result_use_check;
 321 int     mac_proc_check_setauid(proc_t proc, uid_t auid) __result_use_check;
 322 int     mac_proc_check_setlcid(proc_t proc1, proc_t proc2,
 323     pid_t pid1, pid_t pid2) __result_use_check;
 324 int     mac_proc_check_signal(proc_t proc1, proc_t proc2,
 325     int signum) __result_use_check;
 326 int     mac_proc_check_syscall_unix(proc_t proc, int scnum) __result_use_check;
 327 int     mac_proc_check_wait(proc_t proc1, proc_t proc2) __result_use_check;
 328 void    mac_proc_notify_exit(proc_t proc);
 329 int     mac_socket_check_accept(kauth_cred_t cred, struct socket *so) __result_use_check;
 330 int     mac_socket_check_accepted(kauth_cred_t cred, struct socket *so) __result_use_check;
 331 int     mac_socket_check_bind(kauth_cred_t cred, struct socket *so,
 332     struct sockaddr *addr) __result_use_check;
 333 int     mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
 334     struct sockaddr *addr) __result_use_check;
 335 int     mac_socket_check_create(kauth_cred_t cred, int domain,
 336     int type, int protocol) __result_use_check;
 337 int     mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
 338     unsigned long cmd) __result_use_check;
 339 int     mac_socket_check_listen(kauth_cred_t cred, struct socket *so) __result_use_check;
 340 int     mac_socket_check_receive(kauth_cred_t cred, struct socket *so) __result_use_check;
 341 int     mac_socket_check_received(kauth_cred_t cred, struct socket *so,
 342     struct sockaddr *saddr) __result_use_check;
 343 int     mac_socket_check_send(kauth_cred_t cred, struct socket *so,
 344     struct sockaddr *addr) __result_use_check;
 345 int     mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
 346     struct sockopt *sopt) __result_use_check;
 347 int     mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
 348     struct sockopt *sopt) __result_use_check;
 349 int     mac_socket_check_stat(kauth_cred_t cred, struct socket *so) __result_use_check;
 350 void    mac_socket_label_associate(kauth_cred_t cred, struct socket *so);
 351 void    mac_socket_label_associate_accept(struct socket *oldsocket,
 352     struct socket *newsocket);
 353 void    mac_socket_label_copy(struct label *from, struct label *to);
 354 void    mac_socket_label_destroy(struct socket *);
 355 int     mac_socket_label_get(kauth_cred_t cred, struct socket *so,
 356     struct mac *extmac) __result_use_check;
 357 int     mac_socket_label_init(struct socket *, int waitok) __result_use_check;
 358 void    mac_socketpeer_label_associate_socket(struct socket *peersocket,
 359     struct socket *socket_to_modify);
 360 int     mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so,
 361     struct mac *extmac) __result_use_check;
 362 int     mac_system_check_acct(kauth_cred_t cred, struct vnode *vp) __result_use_check;
 363 int     mac_system_check_audit(kauth_cred_t cred, void *record, int length) __result_use_check;
 364 int     mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp) __result_use_check;
 365 int     mac_system_check_auditon(kauth_cred_t cred, int cmd) __result_use_check;
 366 int     mac_system_check_host_priv(kauth_cred_t cred) __result_use_check;
 367 int     mac_system_check_info(kauth_cred_t, const char *info_type) __result_use_check;
 368 int     mac_system_check_nfsd(kauth_cred_t cred) __result_use_check;
 369 int     mac_system_check_reboot(kauth_cred_t cred, int howto) __result_use_check;
 370 int     mac_system_check_settime(kauth_cred_t cred) __result_use_check;
 371 int     mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp) __result_use_check;
 372 int     mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp) __result_use_check;
 373 int     mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name,
 374     size_t namelen, user_addr_t oldctl, size_t oldlen,
 375     user_addr_t newctl, size_t newlen) __result_use_check;
 376 int     mac_system_check_kas_info(kauth_cred_t cred, int selector) __result_use_check;
 377 void    mac_sysvmsg_label_associate(kauth_cred_t cred,
 378     struct msqid_kernel *msqptr, struct msg *msgptr);
 379 void    mac_sysvmsg_label_init(struct msg *msgptr);
 380 void    mac_sysvmsg_label_recycle(struct msg *msgptr);
 381 int     mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr,
 382     struct msqid_kernel *msqptr) __result_use_check;
 383 int     mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr) __result_use_check;
 384 int     mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr) __result_use_check;
 385 int     mac_sysvmsq_check_msqctl(kauth_cred_t cred,
 386     struct msqid_kernel *msqptr, int cmd) __result_use_check;
 387 int     mac_sysvmsq_check_msqget(kauth_cred_t cred,
 388     struct msqid_kernel *msqptr) __result_use_check;
 389 int     mac_sysvmsq_check_msqrcv(kauth_cred_t cred,
 390     struct msqid_kernel *msqptr) __result_use_check;
 391 int     mac_sysvmsq_check_msqsnd(kauth_cred_t cred,
 392     struct msqid_kernel *msqptr) __result_use_check;
 393 void    mac_sysvmsq_label_associate(kauth_cred_t cred,
 394     struct msqid_kernel *msqptr);
 395 void    mac_sysvmsq_label_init(struct msqid_kernel *msqptr);
 396 void    mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr);
 397 int     mac_sysvsem_check_semctl(kauth_cred_t cred,
 398     struct semid_kernel *semakptr, int cmd) __result_use_check;
 399 int     mac_sysvsem_check_semget(kauth_cred_t cred,
 400     struct semid_kernel *semakptr) __result_use_check;
 401 int     mac_sysvsem_check_semop(kauth_cred_t cred,
 402     struct semid_kernel *semakptr, size_t accesstype) __result_use_check;
 403 void    mac_sysvsem_label_associate(kauth_cred_t cred,
 404     struct semid_kernel *semakptr);
 405 void    mac_sysvsem_label_destroy(struct semid_kernel *semakptr);
 406 void    mac_sysvsem_label_init(struct semid_kernel *semakptr);
 407 void    mac_sysvsem_label_recycle(struct semid_kernel *semakptr);
 408 int     mac_sysvshm_check_shmat(kauth_cred_t cred,
 409     struct shmid_kernel *shmsegptr, int shmflg) __result_use_check;
 410 int     mac_sysvshm_check_shmctl(kauth_cred_t cred,
 411     struct shmid_kernel *shmsegptr, int cmd) __result_use_check;
 412 int     mac_sysvshm_check_shmdt(kauth_cred_t cred,
 413     struct shmid_kernel *shmsegptr) __result_use_check;
 414 int     mac_sysvshm_check_shmget(kauth_cred_t cred,
 415     struct shmid_kernel *shmsegptr, int shmflg) __result_use_check;
 416 void    mac_sysvshm_label_associate(kauth_cred_t cred,
 417     struct shmid_kernel *shmsegptr);
 418 void    mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr);
 419 void    mac_sysvshm_label_init(struct shmid_kernel* shmsegptr);
 420 void    mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr);
 421 int     mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
 422     int acc_mode) __result_use_check;
 423 int     mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) __result_use_check;
 424 int     mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp,
 425     struct componentname *cnp) __result_use_check;
 426 int     mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp,
 427     struct vnode *vp, struct componentname *cnp) __result_use_check;
 428 int     mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp,
 429     struct componentname *cnp, struct vnode_attr *vap) __result_use_check;
 430 int     mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp,
 431     const char *name) __result_use_check;
 432 int     mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1,
 433     struct vnode *v2) __result_use_check;
 434 int     mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
 435     struct image_params *imgp) __result_use_check;
 436 int     mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp) __result_use_check;
 437 int     mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred,
 438     struct vnode *vp, struct vnode_attr *va) __result_use_check;
 439 int     mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
 440     struct attrlist *alist) __result_use_check;
 441 int     mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
 442     const char *name, struct uio *uio) __result_use_check;
 443 int     mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp,
 444     unsigned long cmd) __result_use_check;
 445 int     mac_vnode_check_kqfilter(vfs_context_t ctx,
 446     kauth_cred_t file_cred, struct knote *kn, struct vnode *vp) __result_use_check;
 447 int     mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp,
 448     struct label *newlabel); __result_use_check
 449 int     mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp,
 450     struct vnode *vp, struct componentname *cnp) __result_use_check;
 451 int     mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp) __result_use_check;
 452 int     mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp,
 453     struct componentname *cnp) __result_use_check;
 454 int     mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp,
 455     const char *path, size_t pathlen) __result_use_check;
 456 int     mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp,
 457     int acc_mode) __result_use_check;
 458 int     mac_vnode_check_read(vfs_context_t ctx,
 459     kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
 460 int     mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp) __result_use_check;
 461 int     mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp) __result_use_check;
 462 int     mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp,
 463     struct vnode *vp, struct componentname *cnp, struct vnode *tdvp,
 464     struct vnode *tvp, struct componentname *tcnp) __result_use_check;
 465 int     mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp) __result_use_check;
 466 int     mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp,
 467     struct attrlist *alist) __result_use_check;
 468 int     mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp,
 469     int which) __result_use_check;
 470 int     mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp,
 471     struct kauth_acl *acl) __result_use_check;
 472 int     mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp,
 473     struct attrlist *alist) __result_use_check;
 474 int     mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp,
 475     const char *name, struct uio *uio) __result_use_check;
 476 int     mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp,
 477     u_long flags) __result_use_check;
 478 int     mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp,
 479     mode_t mode) __result_use_check;
 480 int     mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp,
 481     uid_t uid, gid_t gid) __result_use_check;
 482 int     mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
 483     struct timespec atime, struct timespec mtime) __result_use_check;
 484 int     mac_vnode_check_signature(struct vnode *vp,
 485     struct cs_blob *cs_blob, struct image_params *imgp,
 486     unsigned int *cs_flags, unsigned int *signer_type,
 487     int flags, unsigned int platform) __result_use_check;
 488 int     mac_vnode_check_supplemental_signature(struct vnode *vp,
 489     struct cs_blob *cs_blob, struct vnode *linked_vp,
 490     struct cs_blob *linked_cs_blob, unsigned int *signer_type) __result_use_check;
 491 int     mac_vnode_check_stat(vfs_context_t ctx,
 492     kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
 493 #ifdef KERNEL_PRIVATE
 494 int     mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp,
 495     struct componentname *cnp) __result_use_check;
 496 #endif
 497 int     mac_vnode_check_truncate(vfs_context_t ctx,
 498     kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
 499 int     mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
 500     struct componentname *cnp, struct vnode_attr *vap) __result_use_check;
 501 int     mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so) __result_use_check;
 502 int     mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
 503     struct vnode *vp, struct componentname *cnp) __result_use_check;
 504 int     mac_vnode_check_write(vfs_context_t ctx,
 505     kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
 506 struct label    *mac_vnode_label_alloc(void);
 507 int     mac_vnode_label_associate(struct mount *mp, struct vnode *vp,
 508     vfs_context_t ctx) __result_use_check;
 509 void    mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de,
 510     struct vnode *vp);
 511 int     mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp) __result_use_check;
 512 int     mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp,
 513     struct vnode *vp, vfs_context_t ctx) __result_use_check;
 514 void    mac_vnode_label_associate_singlelabel(struct mount *mp,
 515     struct vnode *vp);
 516 void    mac_vnode_label_copy(struct label *l1, struct label *l2);
 517 void    mac_vnode_label_destroy(struct vnode *vp);
 518 int     mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac) __result_use_check;
 519 void    mac_vnode_label_free(struct label *label);
 520 void    mac_vnode_label_init(struct vnode *vp);
 521 int     mac_vnode_label_init_needed(struct vnode *vp) __result_use_check;
 522 #ifdef KERNEL_PRIVATE
 523 struct label *mac_vnode_label_allocate(vnode_t vp);
 524 #endif
 525 void    mac_vnode_label_recycle(struct vnode *vp);
 526 void    mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
 527     struct label *newlabel);
 528 void    mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp,
 529     const char *name);
 530 int     mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
 531     struct vnode *dvp, struct vnode *vp, struct componentname *cnp) __result_use_check;
 532 void    mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name);
 533 void    mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
 534     struct vnode *dvp, struct componentname *cnp);
 535 void    mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
 536 void    mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
 537     struct vnode *dvp, struct componentname *cnp);
 538 void    mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl);
 539 void    mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist);
 540 void    mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio);
 541 void    mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags);
 542 void    mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode);
 543 void    mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid);
 544 void    mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime);
 545 void    mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp);
 546 int     mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho) __result_use_check;
 547 int     vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
 548     struct componentname *cnp, int flags, vfs_context_t ctx) __result_use_check;
 549 void    vnode_relabel(struct vnode *vp);
 550 void    mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
 551 void    mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
 552 int     mac_kext_check_load(kauth_cred_t cred, const char *identifier) __result_use_check;
 553 int     mac_kext_check_unload(kauth_cred_t cred, const char *identifier) __result_use_check;
 554 int     mac_kext_check_query(kauth_cred_t cred) __result_use_check;
 555 int     mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check;
 556 int     mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check;
 557 void    mac_vnode_notify_reclaim(vnode_t vp);
 558
 559 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 560 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 561
 562 #endif  /* CONFIG_MACF */
 563
 564 #endif /* !_SECURITY_MAC_FRAMEWORK_H_ */