xnu-2422.115.4.tar.gz

[apple/xnu.git] / security / mac_framework.h

diff --git a/security/mac_framework.h b/security/mac_framework.h
index 7d0f15a103ecd8067f49eb7762d0e0aa1d0b0d11..777efd54221d94e864d88a2637b91d5279c6e6e7 100644 (file)
--- a/security/mac_framework.h
+++ b/security/mac_framework.h
@@ -77,7 +77,9 @@
 #error "no user-serviceable parts inside"
 #endif
 
 #error "no user-serviceable parts inside"
 #endif
 

-#if CONFIG_MACF
+#ifndef PRIVATE
+#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
+#endif

 
 struct attrlist;
 struct auditinfo;
 
 struct attrlist;
 struct auditinfo;


@@ -114,6 +116,7 @@ struct socket;
 struct task;
 struct thread;
 struct timespec;
 struct task;
 struct thread;
 struct timespec;

+struct tty;

 struct ucred;
 struct uio;
 struct uthread;
 struct ucred;
 struct uio;
 struct uthread;


@@ -123,6 +126,8 @@ struct vnode;
 struct vnode_attr;
 struct vop_setlabel_args;
 
 struct vnode_attr;
 struct vop_setlabel_args;
 

+#if CONFIG_MACF
+

 #ifndef __IOKIT_PORTS_DEFINED__
 #define __IOKIT_PORTS_DEFINED__
 #ifdef __cplusplus
 #ifndef __IOKIT_PORTS_DEFINED__
 #define __IOKIT_PORTS_DEFINED__
 #ifdef __cplusplus


@@ -156,8 +161,8 @@ void        mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d);
 int    mac_cred_check_label_update(kauth_cred_t cred,
            struct label *newlabel);
 int    mac_cred_check_label_update_execve(vfs_context_t ctx,
 int    mac_cred_check_label_update(kauth_cred_t cred,
            struct label *newlabel);
 int    mac_cred_check_label_update_execve(vfs_context_t ctx,

-           struct vnode *vp, struct label *scriptvnodelabel, 
-           struct label *execlabel, proc_t proc);
+           struct vnode *vp, struct vnode *scriptvp, struct label *scriptvnodelabel, 
+           struct label *execlabel, proc_t proc, void *macextensions);

 int    mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2);
 struct label   *mac_cred_label_alloc(void);
 void   mac_cred_label_associate(kauth_cred_t cred_parent,
 int    mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2);
 struct label   *mac_cred_label_alloc(void);
 void   mac_cred_label_associate(kauth_cred_t cred_parent,


@@ -172,8 +177,8 @@ void        mac_cred_label_init(kauth_cred_t cred);
 int    mac_cred_label_compare(struct label *a, struct label *b);
 void   mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
 int    mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
 int    mac_cred_label_compare(struct label *a, struct label *b);
 void   mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
 int    mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,

-           struct vnode *vp, struct label *scriptvnodelabel,
-           struct label *execlabel);
+           struct vnode *vp, struct vnode *scriptvp, struct label *scriptvnodelabel,
+           struct label *execlabel, void *macextensions);

 void   mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
            const char *fullpath);
 void   mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
 void   mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
            const char *fullpath);
 void   mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,


@@ -329,6 +334,8 @@ void        mac_posixshm_label_init(struct pshminfo *pshm);
 int    mac_priv_check(kauth_cred_t cred, int priv);
 int    mac_priv_grant(kauth_cred_t cred, int priv);
 int    mac_proc_check_debug(proc_t proc1, proc_t proc2);
 int    mac_priv_check(kauth_cred_t cred, int priv);
 int    mac_priv_grant(kauth_cred_t cred, int priv);
 int    mac_proc_check_debug(proc_t proc1, proc_t proc2);

+int    mac_proc_check_cpumon(proc_t curp);
+int    mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);

 int    mac_proc_check_fork(proc_t proc);
 int    mac_proc_check_suspend_resume(proc_t proc, int sr);
 int    mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
 int    mac_proc_check_fork(proc_t proc);
 int    mac_proc_check_suspend_resume(proc_t proc, int sr);
 int    mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);


@@ -397,6 +404,7 @@ int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp);
 int    mac_system_check_auditon(kauth_cred_t cred, int cmd);
 int    mac_system_check_chud(kauth_cred_t cred);
 int    mac_system_check_host_priv(kauth_cred_t cred);
 int    mac_system_check_auditon(kauth_cred_t cred, int cmd);
 int    mac_system_check_chud(kauth_cred_t cred);
 int    mac_system_check_host_priv(kauth_cred_t cred);

+int    mac_system_check_info(kauth_cred_t, const char *info_type);

 int    mac_system_check_nfsd(kauth_cred_t cred);
 int    mac_system_check_reboot(kauth_cred_t cred, int howto);
 int    mac_system_check_settime(kauth_cred_t cred);
 int    mac_system_check_nfsd(kauth_cred_t cred);
 int    mac_system_check_reboot(kauth_cred_t cred, int howto);
 int    mac_system_check_settime(kauth_cred_t cred);


@@ -468,8 +476,8 @@ int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1,
 int    mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
            struct image_params *imgp);
 int    mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);
 int    mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
            struct image_params *imgp);
 int    mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);

-int    mac_vnode_check_signature(struct vnode *vp, unsigned char *sha1,
-           void * signature, size_t size);
+int    mac_vnode_check_signature(struct vnode *vp, off_t macho_offset,
+           unsigned char *sha1, void * signature, size_t size);

 int     mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
            struct attrlist *alist);
 int    mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
 int     mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
            struct attrlist *alist);
 int    mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,


@@ -548,9 +556,17 @@ int        mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
            struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
 void   mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
            struct vnode *dvp, struct componentname *cnp);
            struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
 void   mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
            struct vnode *dvp, struct componentname *cnp);

+void   mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
+void   mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
+                             struct vnode *dvp, struct componentname *cnp);
+int    mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho);

 int    vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
            struct componentname *cnp, int flags, vfs_context_t ctx);
 void   vnode_relabel(struct vnode *vp);
 int    vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
            struct componentname *cnp, int flags, vfs_context_t ctx);
 void   vnode_relabel(struct vnode *vp);

+void   mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
+void   mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
+int    mac_kext_check_load(kauth_cred_t cred, const char *identifier);
+int    mac_kext_check_unload(kauth_cred_t cred, const char *identifier);

 
 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 
 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);