xnu-4570.51.1.tar.gz

[apple/xnu.git] / security / mac_base.c

diff --git a/security/mac_base.c b/security/mac_base.c
index 7f147cff1c953dbc1a963e0529d063ba9f2c4862..2bd03b8eb1cd155aabc3813cd83243ba9a234961 100644 (file)
--- a/security/mac_base.c
+++ b/security/mac_base.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2012 Apple Inc. All rights reserved.
+ * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
@@ -105,6 +105,9 @@
 #include <security/mac_mach_internal.h>
 #endif
 
+#if CONFIG_EMBEDDED
+#include <libkern/section_keywords.h>
+#endif
 
 /* 
  * define MB_DEBUG to display run-time debugging information
@@ -182,17 +185,6 @@ unsigned int       mac_label_vnodes = 0;
 SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS,
     &mac_label_vnodes, 0, "Label all vnodes");
 
-
-unsigned int   mac_mmap_revocation = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, SECURITY_MAC_CTLFLAGS,
-    &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
-    "relabel");
-
-unsigned int   mac_mmap_revocation_via_cow = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, SECURITY_MAC_CTLFLAGS,
-    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
-    "copy-on-write semantics, or by removing all write access");
-
 unsigned int mac_device_enforce = 1;
 SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,
           &mac_device_enforce, 0, "Enforce MAC policy on device operations");
@@ -276,7 +268,12 @@ static lck_mtx_t *mac_policy_mtx;
 
 static int mac_policy_busy;
 
+#if CONFIG_EMBEDDED
+SECURITY_READ_ONLY_LATE(mac_policy_list_t) mac_policy_list;
+SECURITY_READ_ONLY_LATE(static struct mac_policy_list_element) mac_policy_static_entries[MAC_POLICY_LIST_CHUNKSIZE];
+#else
 mac_policy_list_t mac_policy_list;
+#endif
 
 /*
  * mac_label_element_list holds the master list of label namespaces for
@@ -363,7 +360,11 @@ mac_policy_init(void)
        mac_policy_list.freehint = 0;
        mac_policy_list.chunks = 1;
 
+#if CONFIG_EMBEDDED
+       mac_policy_list.entries = mac_policy_static_entries;
+#else
        mac_policy_list.entries = kalloc(sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
+#endif
 
        bzero(mac_policy_list.entries, sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE); 
 
@@ -640,7 +641,9 @@ int
 mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
     void *xd)
 {
+#if !CONFIG_EMBEDDED
        struct mac_policy_list_element *tmac_policy_list_element;
+#endif
        int error, slot, static_entry = 0;
        u_int i;
 
@@ -672,6 +675,7 @@ mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
        }
 
        if (mac_policy_list.numloaded >= mac_policy_list.max) {
+#if !CONFIG_EMBEDDED
                /* allocate new policy list array, zero new chunk */
                tmac_policy_list_element =
                    kalloc((sizeof(struct mac_policy_list_element) *
@@ -695,6 +699,10 @@ mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
                /* Update maximums, etc */
                mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
                mac_policy_list.chunks++;
+#else
+               printf("out of space in mac_policy_list.\n");
+               return (ENOMEM);
+#endif /* CONFIG_EMBEDDED */
        }
 
        /* Check for policy with same name already loaded */
@@ -970,8 +978,8 @@ element_loop:
                        mpc = mac_policy_list.entries[mll->mll_handle].mpc;
                        if (mpc == NULL)
                                continue;
-                       mpo_externalize = *(typeof(mpo_externalize) *)
-                           ((char *)mpc->mpc_ops + mpo_externalize_off);
+                       mpo_externalize = *(const typeof(mpo_externalize) *)
+                           ((const char *)mpc->mpc_ops + mpo_externalize_off);
                        if (mpo_externalize == NULL)
                                continue;
                        error = sbuf_printf(sb, "%s/", name);
@@ -1099,8 +1107,8 @@ element_loop:
                        mpc = mac_policy_list.entries[mll->mll_handle].mpc;
                        if (mpc == NULL)
                                continue;
-                       mpo_internalize = *(typeof(mpo_internalize) *)
-                           ((char *)mpc->mpc_ops + mpo_internalize_off);
+                       mpo_internalize = *(const typeof(mpo_internalize) *)
+                           ((const char *)mpc->mpc_ops + mpo_internalize_off);
                        if (mpo_internalize == NULL)
                                continue;
                        error = mpo_internalize(label, element_name,
@@ -1402,6 +1410,8 @@ __mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)
                case DTYPE_PIPE:
                case DTYPE_KQUEUE:
                case DTYPE_FSEVENTS:
+               case DTYPE_ATALK:
+               case DTYPE_NETPOLICY:
                default:
                        error = ENOSYS;   // only sockets/vnodes so far
                        break;
@@ -1608,6 +1618,8 @@ __mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)
                case DTYPE_PIPE:
                case DTYPE_KQUEUE:
                case DTYPE_FSEVENTS:
+               case DTYPE_ATALK:
+               case DTYPE_NETPOLICY:
                default:
                        error = ENOSYS;  // only sockets/vnodes so far
                        break;
@@ -1622,7 +1634,7 @@ static int
 mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
                 int follow)
 {
-       register struct vnode *vp;
+       struct vnode *vp;
        struct vfs_context *ctx = vfs_context_current();
        struct label *intlabel;
        struct nameidata nd;
@@ -1957,6 +1969,28 @@ mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
        return (ENOENT);
 }
 
+int
+mac_file_setxattr(struct fileglob *fg __unused, const char *name __unused, char *buf __unused, size_t len __unused)
+{
+
+       return (ENOENT);
+}
+
+int
+mac_file_getxattr(struct fileglob *fg __unused, const char *name __unused,
+       char *buf __unused, size_t len __unused, size_t *attrlen __unused)
+{
+
+       return (ENOENT);
+}
+
+int
+mac_file_removexattr(struct fileglob *fg __unused, const char *name __unused)
+{
+
+       return (ENOENT);
+}
+
 intptr_t mac_label_get(struct label *l __unused, int slot __unused)
 {
         return 0;
@@ -1967,16 +2001,35 @@ void mac_label_set(struct label *l __unused, int slot __unused, intptr_t v __unu
                return;
 }
 
-void mac_proc_set_enforce(proc_t p, int enforce_flags);
-void mac_proc_set_enforce(proc_t p __unused, int enforce_flags __unused)
-{
-       return;
-}
-
 int mac_iokit_check_hid_control(kauth_cred_t cred __unused);
 int mac_iokit_check_hid_control(kauth_cred_t cred __unused)
 {
         return 0;
 }
 
+
+int mac_iokit_check_nvram_delete(kauth_cred_t cred __unused, const char *name __unused);
+int mac_iokit_check_nvram_delete(kauth_cred_t cred __unused, const char *name __unused)
+{
+       return 0;
+}
+
+int mac_iokit_check_nvram_get(kauth_cred_t cred __unused, const char *name __unused);
+int mac_iokit_check_nvram_get(kauth_cred_t cred __unused, const char *name __unused)
+{
+       return 0;
+}
+
+int mac_iokit_check_nvram_set(kauth_cred_t cred __unused, const char *name __unused, io_object_t value __unused);
+int mac_iokit_check_nvram_set(kauth_cred_t cred __unused, const char *name __unused, io_object_t value __unused)
+{
+       return 0;
+}
+
+int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused);
+int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused)
+{
+       return 0;
+}
+
 #endif /* !MAC */