xnu-2422.115.4.tar.gz

[apple/xnu.git] / bsd / kern / kern_kpc.c

diff --git a/bsd/kern/kern_kpc.c b/bsd/kern/kern_kpc.c
index 321fa1b5add70fc7bba1e5c97fd4636ff4c70314..9cf0ab817712c4c2ee150d01d9c38b5027e6d342 100644 (file)
--- a/bsd/kern/kern_kpc.c
+++ b/bsd/kern/kern_kpc.c
@@ -37,6 +37,7 @@
 #include <kern/kpc.h>
 
 #include <pexpert/pexpert.h>
 #include <kern/kpc.h>
 
 #include <pexpert/pexpert.h>

+#include <kperf/kperf.h>

 
 /* Various sysctl requests */
 #define REQ_CLASSES              (1)
 
 /* Various sysctl requests */
 #define REQ_CLASSES              (1)


@@ -387,6 +388,24 @@ kpc_sysctl SYSCTL_HANDLER_ARGS
        if( !kpc_initted )
                panic("kpc_init not called");
 
        if( !kpc_initted )
                panic("kpc_init not called");
 

+       // Most sysctls require an access check, but a few are public.
+       switch( (uintptr_t) arg1 ) {
+       case REQ_CLASSES:
+       case REQ_CONFIG_COUNT:
+       case REQ_COUNTER_COUNT:
+               // These read-only sysctls are public.
+               break;
+
+       default:
+               // Require kperf access to read or write anything else.
+               // This is either root or the blessed pid.
+               ret = kperf_access_check();
+               if (ret) {
+                       return ret;
+               }
+               break;
+       }
+

        lck_mtx_lock(&sysctl_buffer_lock);
 
        /* which request */
        lck_mtx_lock(&sysctl_buffer_lock);
 
        /* which request */