xnu-3789.1.32.tar.gz

[apple/xnu.git] / security / mac.h

diff --git a/security/mac.h b/security/mac.h
index 936abc34afd858834cc8d4e62a5ec11e10645cab..9563a77969b6f36c0eaad1d6cc602d16f78b9713 100644 (file)
--- a/security/mac.h
+++ b/security/mac.h
@@ -97,10 +97,33 @@ struct mac {
 typedef struct mac     *mac_t;
 
 #ifdef KERNEL
+
+#ifndef PRIVATE
+#warning "MAC policy is not KPI, see Technical Q&A QA1574"
+#endif
+
+#if DEBUG
+#define SECURITY_MAC_CTLFLAGS (CTLFLAG_RW | CTLFLAG_LOCKED)
+#define SECURITY_MAC_CHECK_ENFORCE 1
+#else
+#define SECURITY_MAC_CTLFLAGS (CTLFLAG_RD | CTLFLAG_LOCKED)
+#define SECURITY_MAC_CHECK_ENFORCE 0
+#endif
+
 struct user_mac {
        user_size_t     m_buflen;
        user_addr_t     m_string;
 };
+
+struct user32_mac {
+       uint32_t        m_buflen;
+       uint32_t        m_string;
+};
+
+struct user64_mac {
+       uint64_t        m_buflen;
+       uint64_t        m_string;
+};
 #endif /* KERNEL */
 
 /*
@@ -131,6 +154,15 @@ struct user_mac {
 #define MAC_DEVICE_FIREWIRE    "FireWire"
 #define MAC_DEVICE_TYPE_KEY    "DeviceType"
 
+/*
+ * Flags for mac_proc_check_suspend_resume()
+ */
+#define MAC_PROC_CHECK_SUSPEND                 0
+#define MAC_PROC_CHECK_RESUME                  1
+#define MAC_PROC_CHECK_HIBERNATE               2
+#define MAC_PROC_CHECK_SHUTDOWN_SOCKETS                3
+#define MAC_PROC_CHECK_PIDBIND                 4
+
 #ifndef KERNEL
 /*
  * Location of the userland MAC framework configuration file.  mac.conf
@@ -148,14 +180,11 @@ __BEGIN_DECLS
 int     __mac_execve(char *fname, char **argv, char **envv, mac_t _label);
 int     __mac_get_fd(int _fd, mac_t _label);
 int     __mac_get_file(const char *_path, mac_t _label);
-int     __mac_get_lcid(pid_t _lcid, mac_t _label);
-int     __mac_get_lctx(mac_t _label);
 int     __mac_get_link(const char *_path, mac_t _label);
 int     __mac_get_pid(pid_t _pid, mac_t _label);
 int     __mac_get_proc(mac_t _label);
 int     __mac_set_fd(int _fildes, const mac_t _label);
 int     __mac_set_file(const char *_path, mac_t _label);
-int     __mac_set_lctx(mac_t _label);
 int     __mac_set_link(const char *_path, mac_t _label);
 int     __mac_mount(const char *type, const char *path, int flags, void *data,
     struct mac *label);