security/mac_process.c

   1 /*
   2  * Copyright (c) 2007-2010 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 /*-
  30  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
  31  * Copyright (c) 2001 Ilmar S. Habibulin
  32  * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
  33  *
  34  * This software was developed by Robert Watson and Ilmar Habibulin for the
  35  * TrustedBSD Project.
  36  *
  37  * This software was developed for the FreeBSD Project in part by Network
  38  * Associates Laboratories, the Security Research Division of Network
  39  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  40  * as part of the DARPA CHATS research program.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  52  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  53  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  54  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  55  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  56  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  57  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  58  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  59  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  60  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  61  * SUCH DAMAGE.
  62  *
  63  */
  64
  65 #include <string.h>
  66 #include <sys/param.h>
  67 #include <sys/ucred.h>
  68 #include <sys/malloc.h>
  69 #include <sys/sbuf.h>
  70 #include <sys/vnode.h>
  71 #include <sys/proc.h>
  72 #include <sys/proc_internal.h>
  73 #include <sys/kauth.h>
  74 #include <sys/imgact.h>
  75 #include <mach/mach_types.h>
  76 #include <kern/task.h>
  77
  78 #include <os/hash.h>
  79
  80 #include <security/mac_internal.h>
  81 #include <security/mac_mach_internal.h>
  82
  83 #include <bsd/security/audit/audit.h>
  84
  85 struct label *
  86 mac_cred_label_alloc(void)
  87 {
  88         struct label *label;
  89
  90         label = mac_labelzone_alloc(MAC_WAITOK);
  91         if (label == NULL) {
  92                 return NULL;
  93         }
  94         MAC_PERFORM(cred_label_init, label);
  95         return label;
  96 }
  97
  98 void
  99 mac_cred_label_init(struct ucred *cred)
 100 {
 101         cred->cr_label = mac_cred_label_alloc();
 102 }
 103
 104 void
 105 mac_cred_label_free(struct label *label)
 106 {
 107         MAC_PERFORM(cred_label_destroy, label);
 108         mac_labelzone_free(label);
 109 }
 110
 111 bool
 112 mac_cred_label_is_equal(const struct label *a, const struct label *b)
 113 {
 114         if (a->l_flags != b->l_flags) {
 115                 return false;
 116         }
 117         for (int slot = 0; slot < MAC_MAX_SLOTS; slot++) {
 118                 const void *pa = a->l_perpolicy[slot].l_ptr;
 119                 const void *pb = b->l_perpolicy[slot].l_ptr;
 120
 121                 if (pa != pb) {
 122                         return false;
 123                 }
 124         }
 125         return true;
 126 }
 127
 128 uint32_t
 129 mac_cred_label_hash_update(const struct label *a, uint32_t hash)
 130 {
 131         hash = os_hash_jenkins_update(&a->l_flags,
 132             sizeof(a->l_flags), hash);
 133 #if __has_feature(ptrauth_calls)
 134         for (int slot = 0; slot < MAC_MAX_SLOTS; slot++) {
 135                 const void *ptr = a->l_perpolicy[slot].l_ptr;
 136                 hash = os_hash_jenkins_update(&ptr, sizeof(ptr), hash);
 137         }
 138 #else
 139         hash = os_hash_jenkins_update(&a->l_perpolicy,
 140             sizeof(a->l_perpolicy), hash);
 141 #endif
 142         return hash;
 143 }
 144
 145 int
 146 mac_cred_label_externalize_audit(struct proc *p, struct mac *mac)
 147 {
 148         kauth_cred_t cr;
 149         int error;
 150
 151         cr = kauth_cred_proc_ref(p);
 152
 153         error = MAC_EXTERNALIZE_AUDIT(cred, cr->cr_label,
 154             mac->m_string, mac->m_buflen);
 155
 156         kauth_cred_unref(&cr);
 157         return error;
 158 }
 159
 160 void
 161 mac_cred_label_destroy(kauth_cred_t cred)
 162 {
 163         mac_cred_label_free(cred->cr_label);
 164         cred->cr_label = NULL;
 165 }
 166
 167 int
 168 mac_cred_label_externalize(struct label *label, char *elements,
 169     char *outbuf, size_t outbuflen, int flags __unused)
 170 {
 171         int error = 0;
 172
 173         error = MAC_EXTERNALIZE(cred, label, elements, outbuf, outbuflen);
 174
 175         return error;
 176 }
 177
 178 int
 179 mac_cred_label_internalize(struct label *label, char *string)
 180 {
 181         int error;
 182
 183         error = MAC_INTERNALIZE(cred, label, string);
 184
 185         return error;
 186 }
 187
 188 /*
 189  * By default, fork just adds a reference to the parent
 190  * credential.  Policies may need to know about this reference
 191  * if they are tracking exit calls to know when to free the
 192  * label.
 193  */
 194 void
 195 mac_cred_label_associate_fork(kauth_cred_t cred, proc_t proc)
 196 {
 197         MAC_PERFORM(cred_label_associate_fork, cred, proc);
 198 }
 199
 200 /*
 201  * Initialize MAC label for the first kernel process, from which other
 202  * kernel processes and threads are spawned.
 203  */
 204 void
 205 mac_cred_label_associate_kernel(kauth_cred_t cred)
 206 {
 207         MAC_PERFORM(cred_label_associate_kernel, cred);
 208 }
 209
 210 /*
 211  * Initialize MAC label for the first userland process, from which other
 212  * userland processes and threads are spawned.
 213  */
 214 void
 215 mac_cred_label_associate_user(kauth_cred_t cred)
 216 {
 217         MAC_PERFORM(cred_label_associate_user, cred);
 218 }
 219
 220 /*
 221  * When a new process is created, its label must be initialized.  Generally,
 222  * this involves inheritence from the parent process, modulo possible
 223  * deltas.  This function allows that processing to take place.
 224  */
 225 void
 226 mac_cred_label_associate(struct ucred *parent_cred, struct ucred *child_cred)
 227 {
 228         MAC_PERFORM(cred_label_associate, parent_cred, child_cred);
 229 }
 230
 231 int
 232 mac_execve_enter(user_addr_t mac_p, struct image_params *imgp)
 233 {
 234         struct user_mac mac;
 235         struct label *execlabel;
 236         char *buffer;
 237         int error;
 238         size_t ulen;
 239
 240         if (mac_p == USER_ADDR_NULL) {
 241                 return 0;
 242         }
 243
 244         if (IS_64BIT_PROCESS(current_proc())) {
 245                 struct user64_mac mac64;
 246                 error = copyin(mac_p, &mac64, sizeof(mac64));
 247                 mac.m_buflen = mac64.m_buflen;
 248                 mac.m_string = mac64.m_string;
 249         } else {
 250                 struct user32_mac mac32;
 251                 error = copyin(mac_p, &mac32, sizeof(mac32));
 252                 mac.m_buflen = mac32.m_buflen;
 253                 mac.m_string = mac32.m_string;
 254         }
 255         if (error) {
 256                 return error;
 257         }
 258
 259         error = mac_check_structmac_consistent(&mac);
 260         if (error) {
 261                 return error;
 262         }
 263
 264         execlabel = mac_cred_label_alloc();
 265         MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
 266         error = copyinstr(CAST_USER_ADDR_T(mac.m_string), buffer, mac.m_buflen, &ulen);
 267         if (error) {
 268                 goto out;
 269         }
 270         AUDIT_ARG(mac_string, buffer);
 271
 272         error = mac_cred_label_internalize(execlabel, buffer);
 273 out:
 274         if (error) {
 275                 mac_cred_label_free(execlabel);
 276                 execlabel = NULL;
 277         }
 278         imgp->ip_execlabelp = execlabel;
 279         FREE(buffer, M_MACTEMP);
 280         return error;
 281 }
 282
 283 /*
 284  * When the subject's label changes, it may require revocation of privilege
 285  * to mapped objects.  This can't be done on-the-fly later with a unified
 286  * buffer cache.
 287  *
 288  * XXX:         CRF_MAC_ENFORCE should be in a kauth_cred_t field, rather
 289  * XXX:         than a posix_cred_t field.
 290  */
 291 void
 292 mac_cred_label_update(kauth_cred_t cred, struct label *newlabel)
 293 {
 294         posix_cred_t pcred = posix_cred_get(cred);
 295
 296         /* force label to be part of "matching" for credential */
 297         pcred->cr_flags |= CRF_MAC_ENFORCE;
 298
 299         /* inform the policies of the update */
 300         MAC_PERFORM(cred_label_update, cred, newlabel);
 301 }
 302
 303 int
 304 mac_cred_check_label_update(kauth_cred_t cred, struct label *newlabel)
 305 {
 306         int error;
 307
 308 #if SECURITY_MAC_CHECK_ENFORCE
 309         /* 21167099 - only check if we allow write */
 310         if (!mac_proc_enforce) {
 311                 return 0;
 312         }
 313 #endif
 314
 315         MAC_CHECK(cred_check_label_update, cred, newlabel);
 316
 317         return error;
 318 }
 319
 320 int
 321 mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2)
 322 {
 323         int error;
 324
 325 #if SECURITY_MAC_CHECK_ENFORCE
 326         /* 21167099 - only check if we allow write */
 327         if (!mac_proc_enforce) {
 328                 return 0;
 329         }
 330 #endif
 331
 332         MAC_CHECK(cred_check_visible, u1, u2);
 333
 334         return error;
 335 }
 336
 337 int
 338 mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident)
 339 {
 340         int error;
 341         bool enforce;
 342         proc_t tracingp;
 343
 344 #if SECURITY_MAC_CHECK_ENFORCE
 345         /* 21167099 - only check if we allow write */
 346         if (!mac_proc_enforce) {
 347                 return 0;
 348         }
 349 #endif
 350         /*
 351          * Once all mac hooks adopt proc_ident_t, finding proc_t and releasing
 352          * it below should go to mac_proc_check_enforce().
 353          */
 354         if ((tracingp = proc_find_ident(tracing_ident)) == PROC_NULL) {
 355                 return ESRCH;
 356         }
 357         enforce = mac_proc_check_enforce(tracingp);
 358         proc_rele(tracingp);
 359
 360         if (!enforce) {
 361                 return 0;
 362         }
 363         MAC_CHECK(proc_check_debug, tracing_cred, traced_ident);
 364
 365         return error;
 366 }
 367
 368 int
 369 mac_proc_check_dump_core(struct proc *proc)
 370 {
 371         int error;
 372
 373 #if SECURITY_MAC_CHECK_ENFORCE
 374         /* 21167099 - only check if we allow write */
 375         if (!mac_proc_enforce) {
 376                 return 0;
 377         }
 378 #endif
 379         if (!mac_proc_check_enforce(proc)) {
 380                 return 0;
 381         }
 382
 383         MAC_CHECK(proc_check_dump_core, proc);
 384
 385         return error;
 386 }
 387
 388 int
 389 mac_proc_check_remote_thread_create(struct task *task, int flavor, thread_state_t new_state, mach_msg_type_number_t new_state_count)
 390 {
 391         proc_t curp = current_proc();
 392         proc_t proc;
 393         kauth_cred_t cred;
 394         int error;
 395
 396 #if SECURITY_MAC_CHECK_ENFORCE
 397         /* 21167099 - only check if we allow write */
 398         if (!mac_proc_enforce) {
 399                 return 0;
 400         }
 401 #endif
 402         if (!mac_proc_check_enforce(curp)) {
 403                 return 0;
 404         }
 405
 406         proc = proc_find(task_pid(task));
 407         if (proc == PROC_NULL) {
 408                 return ESRCH;
 409         }
 410
 411         cred = kauth_cred_proc_ref(curp);
 412         MAC_CHECK(proc_check_remote_thread_create, cred, proc, flavor, new_state, new_state_count);
 413         kauth_cred_unref(&cred);
 414         proc_rele(proc);
 415
 416         return error;
 417 }
 418
 419 int
 420 mac_proc_check_fork(proc_t curp)
 421 {
 422         kauth_cred_t cred;
 423         int error;
 424
 425 #if SECURITY_MAC_CHECK_ENFORCE
 426         /* 21167099 - only check if we allow write */
 427         if (!mac_proc_enforce) {
 428                 return 0;
 429         }
 430 #endif
 431         if (!mac_proc_check_enforce(curp)) {
 432                 return 0;
 433         }
 434
 435         cred = kauth_cred_proc_ref(curp);
 436         MAC_CHECK(proc_check_fork, cred, curp);
 437         kauth_cred_unref(&cred);
 438
 439         return error;
 440 }
 441
 442 int
 443 mac_proc_check_get_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)
 444 {
 445         int error;
 446
 447         assert(flavor <= TASK_FLAVOR_NAME);
 448
 449         /* Also call the old hook for compatability, deprecating in rdar://66356944. */
 450         if (flavor == TASK_FLAVOR_CONTROL) {
 451                 MAC_CHECK(proc_check_get_task, cred, pident);
 452                 if (error) {
 453                         return error;
 454                 }
 455         }
 456
 457         if (flavor == TASK_FLAVOR_NAME) {
 458                 MAC_CHECK(proc_check_get_task_name, cred, pident);
 459                 if (error) {
 460                         return error;
 461                 }
 462         }
 463
 464         MAC_CHECK(proc_check_get_task_with_flavor, cred, pident, flavor);
 465
 466         return error;
 467 }
 468
 469 int
 470 mac_proc_check_expose_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)
 471 {
 472         int error;
 473
 474         assert(flavor <= TASK_FLAVOR_NAME);
 475
 476         /* Also call the old hook for compatability, deprecating in rdar://66356944. */
 477         if (flavor == TASK_FLAVOR_CONTROL) {
 478                 MAC_CHECK(proc_check_expose_task, cred, pident);
 479                 if (error) {
 480                         return error;
 481                 }
 482         }
 483
 484         MAC_CHECK(proc_check_expose_task_with_flavor, cred, pident, flavor);
 485
 486         return error;
 487 }
 488
 489 int
 490 mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp)
 491 {
 492         int error;
 493
 494         MAC_CHECK(proc_check_inherit_ipc_ports, p, cur_vp, cur_offset, img_vp, img_offset, scriptvp);
 495
 496         return error;
 497 }
 498
 499 /*
 500  * The type of maxprot in proc_check_map_anon must be equivalent to vm_prot_t
 501  * (defined in <mach/vm_prot.h>). mac_policy.h does not include any header
 502  * files, so cannot use the typedef itself.
 503  */
 504 int
 505 mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
 506     user_size_t u_size, int prot, int flags, int *maxprot)
 507 {
 508         kauth_cred_t cred;
 509         int error;
 510
 511 #if SECURITY_MAC_CHECK_ENFORCE
 512         /* 21167099 - only check if we allow write */
 513         if (!mac_vm_enforce) {
 514                 return 0;
 515         }
 516 #endif
 517         if (!mac_proc_check_enforce(proc)) {
 518                 return 0;
 519         }
 520
 521         cred = kauth_cred_proc_ref(proc);
 522         MAC_CHECK(proc_check_map_anon, proc, cred, u_addr, u_size, prot, flags, maxprot);
 523         kauth_cred_unref(&cred);
 524
 525         return error;
 526 }
 527
 528 int
 529 mac_proc_check_mprotect(proc_t proc,
 530     user_addr_t addr, user_size_t size, int prot)
 531 {
 532         kauth_cred_t cred;
 533         int error;
 534
 535 #if SECURITY_MAC_CHECK_ENFORCE
 536         /* 21167099 - only check if we allow write */
 537         if (!mac_vm_enforce) {
 538                 return 0;
 539         }
 540 #endif
 541         if (!mac_proc_check_enforce(proc)) {
 542                 return 0;
 543         }
 544
 545         cred = kauth_cred_proc_ref(proc);
 546         MAC_CHECK(proc_check_mprotect, cred, proc, addr, size, prot);
 547         kauth_cred_unref(&cred);
 548
 549         return error;
 550 }
 551
 552 int
 553 mac_proc_check_run_cs_invalid(proc_t proc)
 554 {
 555         int error;
 556
 557 #if SECURITY_MAC_CHECK_ENFORCE
 558         /* 21167099 - only check if we allow write */
 559         if (!mac_vm_enforce) {
 560                 return 0;
 561         }
 562 #endif
 563
 564         MAC_CHECK(proc_check_run_cs_invalid, proc);
 565
 566         return error;
 567 }
 568
 569 void
 570 mac_proc_notify_cs_invalidated(proc_t proc)
 571 {
 572         MAC_PERFORM(proc_notify_cs_invalidated, proc);
 573 }
 574
 575 int
 576 mac_proc_check_sched(proc_t curp, struct proc *proc)
 577 {
 578         kauth_cred_t cred;
 579         int error;
 580
 581 #if SECURITY_MAC_CHECK_ENFORCE
 582         /* 21167099 - only check if we allow write */
 583         if (!mac_proc_enforce) {
 584                 return 0;
 585         }
 586 #endif
 587         if (!mac_proc_check_enforce(curp)) {
 588                 return 0;
 589         }
 590
 591         cred = kauth_cred_proc_ref(curp);
 592         MAC_CHECK(proc_check_sched, cred, proc);
 593         kauth_cred_unref(&cred);
 594
 595         return error;
 596 }
 597
 598 int
 599 mac_proc_check_signal(proc_t curp, struct proc *proc, int signum)
 600 {
 601         kauth_cred_t cred;
 602         int error;
 603
 604 #if SECURITY_MAC_CHECK_ENFORCE
 605         /* 21167099 - only check if we allow write */
 606         if (!mac_proc_enforce) {
 607                 return 0;
 608         }
 609 #endif
 610         if (!mac_proc_check_enforce(curp)) {
 611                 return 0;
 612         }
 613
 614         cred = kauth_cred_proc_ref(curp);
 615         MAC_CHECK(proc_check_signal, cred, proc, signum);
 616         kauth_cred_unref(&cred);
 617
 618         return error;
 619 }
 620
 621 int
 622 mac_proc_check_syscall_unix(proc_t curp, int scnum)
 623 {
 624         int error;
 625
 626 #if SECURITY_MAC_CHECK_ENFORCE
 627         /* 21167099 - only check if we allow write */
 628         if (!mac_proc_enforce) {
 629                 return 0;
 630         }
 631 #endif
 632         if (!mac_proc_check_enforce(curp)) {
 633                 return 0;
 634         }
 635
 636         MAC_CHECK(proc_check_syscall_unix, curp, scnum);
 637
 638         return error;
 639 }
 640
 641 int
 642 mac_proc_check_wait(proc_t curp, struct proc *proc)
 643 {
 644         kauth_cred_t cred;
 645         int error;
 646
 647 #if SECURITY_MAC_CHECK_ENFORCE
 648         /* 21167099 - only check if we allow write */
 649         if (!mac_proc_enforce) {
 650                 return 0;
 651         }
 652 #endif
 653         if (!mac_proc_check_enforce(curp)) {
 654                 return 0;
 655         }
 656
 657         cred = kauth_cred_proc_ref(curp);
 658         MAC_CHECK(proc_check_wait, cred, proc);
 659         kauth_cred_unref(&cred);
 660
 661         return error;
 662 }
 663
 664 void
 665 mac_proc_notify_exit(struct proc *proc)
 666 {
 667         MAC_PERFORM(proc_notify_exit, proc);
 668 }
 669
 670 int
 671 mac_proc_check_suspend_resume(proc_t proc, int sr)
 672 {
 673         kauth_cred_t cred;
 674         int error;
 675
 676 #if SECURITY_MAC_CHECK_ENFORCE
 677         /* 21167099 - only check if we allow write */
 678         if (!mac_proc_enforce) {
 679                 return 0;
 680         }
 681 #endif
 682         if (!mac_proc_check_enforce(current_proc())) {
 683                 return 0;
 684         }
 685
 686         cred = kauth_cred_proc_ref(current_proc());
 687         MAC_CHECK(proc_check_suspend_resume, cred, proc, sr);
 688         kauth_cred_unref(&cred);
 689
 690         return error;
 691 }
 692
 693 int
 694 mac_proc_check_ledger(proc_t curp, proc_t proc, int ledger_op)
 695 {
 696         kauth_cred_t cred;
 697         int error = 0;
 698
 699 #if SECURITY_MAC_CHECK_ENFORCE
 700         /* 21167099 - only check if we allow write */
 701         if (!mac_proc_enforce) {
 702                 return 0;
 703         }
 704 #endif
 705         if (!mac_proc_check_enforce(curp)) {
 706                 return 0;
 707         }
 708
 709         cred = kauth_cred_proc_ref(curp);
 710         MAC_CHECK(proc_check_ledger, cred, proc, ledger_op);
 711         kauth_cred_unref(&cred);
 712
 713         return error;
 714 }
 715
 716 int
 717 mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
 718 {
 719         kauth_cred_t cred;
 720         int error = 0;
 721
 722 #if SECURITY_MAC_CHECK_ENFORCE
 723         /* 21167099 - only check if we allow write */
 724         if (!mac_proc_enforce) {
 725                 return 0;
 726         }
 727 #endif
 728         if (!mac_proc_check_enforce(curp)) {
 729                 return 0;
 730         }
 731
 732         cred = kauth_cred_proc_ref(curp);
 733         MAC_CHECK(proc_check_proc_info, cred, target, callnum, flavor);
 734         kauth_cred_unref(&cred);
 735
 736         return error;
 737 }
 738
 739 int
 740 mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op)
 741 {
 742         kauth_cred_t cred;
 743         int error = 0;
 744
 745 #if SECURITY_MAC_CHECK_ENFORCE
 746         /* 21167099 - only check if we allow write */
 747         if (!mac_proc_enforce) {
 748                 return 0;
 749         }
 750 #endif
 751         if (!mac_proc_check_enforce(curp)) {
 752                 return 0;
 753         }
 754
 755         cred = kauth_cred_proc_ref(curp);
 756         MAC_CHECK(proc_check_get_cs_info, cred, target, op);
 757         kauth_cred_unref(&cred);
 758
 759         return error;
 760 }
 761
 762 int
 763 mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op)
 764 {
 765         kauth_cred_t cred;
 766         int error = 0;
 767
 768 #if SECURITY_MAC_CHECK_ENFORCE
 769         /* 21167099 - only check if we allow write */
 770         if (!mac_proc_enforce) {
 771                 return 0;
 772         }
 773 #endif
 774         if (!mac_proc_check_enforce(curp)) {
 775                 return 0;
 776         }
 777
 778         cred = kauth_cred_proc_ref(curp);
 779         MAC_CHECK(proc_check_set_cs_info, cred, target, op);
 780         kauth_cred_unref(&cred);
 781
 782         return error;
 783 }