xnu-3248.60.10.tar.gz

[apple/xnu.git] / security / mac_posix_shm.c

diff --git a/security/mac_posix_shm.c b/security/mac_posix_shm.c
index c42cfbb46a3d5e4dfecc130544d67a1fbfc2a697..cc4e281c1f3c2e8180b4252e8558f94178f4d9cd 100644 (file)
--- a/security/mac_posix_shm.c
+++ b/security/mac_posix_shm.c
@@ -127,8 +127,11 @@ mac_posixshm_check_create(kauth_cred_t cred, const char *name)
 {
        int error = 0;
 
-       if (!mac_posixshm_enforce)
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_posixshm_enforce)
+        return 0;
+#endif
 
        MAC_CHECK(posixshm_check_create, cred, name);
 
@@ -136,14 +139,17 @@ mac_posixshm_check_create(kauth_cred_t cred, const char *name)
 }
 
 int
-mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *shm)
+mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *shm, int fflags)
 {
        int error = 0;
 
-       if (!mac_posixshm_enforce)
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_posixshm_enforce)
+        return 0;
+#endif
 
-       MAC_CHECK(posixshm_check_open, cred, shm, shm->pshm_label);
+       MAC_CHECK(posixshm_check_open, cred, shm, shm->pshm_label, fflags);
 
        return (error);
 }
@@ -154,8 +160,11 @@ mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *shm,
 {
        int error = 0;
 
-       if (!mac_posixshm_enforce)
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_posixshm_enforce)
+        return 0;
+#endif
 
        MAC_CHECK(posixshm_check_mmap, cred, shm, shm->pshm_label,
             prot, flags);
@@ -168,8 +177,11 @@ mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *shm)
 {
        int error = 0;
 
-       if (!mac_posixshm_enforce)
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_posixshm_enforce)
+        return 0;
+#endif
 
        MAC_CHECK(posixshm_check_stat, cred, shm, shm->pshm_label);
 
@@ -178,12 +190,15 @@ mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *shm)
 
 int
 mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *shm,
-    size_t size)
+    off_t size)
 {
        int error = 0;
 
-       if (!mac_posixshm_enforce)
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_posixshm_enforce)
+        return 0;
+#endif
 
        MAC_CHECK(posixshm_check_truncate, cred, shm, shm->pshm_label, size);
 
@@ -196,8 +211,11 @@ mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *shm,
 {
        int error = 0;
 
-       if (!mac_posixshm_enforce)
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_posixshm_enforce)
+        return 0;
+#endif
 
        MAC_CHECK(posixshm_check_unlink, cred, shm, shm->pshm_label, name);