xnu-1504.9.17.tar.gz

[apple/xnu.git] / security / mac_framework.h

diff --git a/security/mac_framework.h b/security/mac_framework.h
index 58f3e2b33aa5b83e538c23290cc5c779ff543bb0..8331596a59083f108fc5d75da1a02cbda2b2f1ce 100644 (file)
--- a/security/mac_framework.h
+++ b/security/mac_framework.h
@@ -124,7 +124,6 @@ struct vop_setlabel_args;
 
 /*@ macros */
 #define        VNODE_LABEL_CREATE      1
 
 /*@ macros */
 #define        VNODE_LABEL_CREATE      1

-#define        VNODE_LABEL_NEEDREF     2

 
 #if CONFIG_MACF_MACH
 #define mac_task_label_update_cred(cred, task)                         \
 
 #if CONFIG_MACF_MACH
 #define mac_task_label_update_cred(cred, task)                         \


@@ -159,7 +158,7 @@ int mac_cred_label_externalize_audit(proc_t p, struct mac *mac);
 void   mac_cred_label_free(struct label *label);
 void   mac_cred_label_init(kauth_cred_t cred);
 void   mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
 void   mac_cred_label_free(struct label *label);
 void   mac_cred_label_init(kauth_cred_t cred);
 void   mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);

-void   mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
+int    mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,

            struct vnode *vp, struct label *scriptvnodelabel,
            struct label *execlabel);
 void   mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
            struct vnode *vp, struct label *scriptvnodelabel,
            struct label *execlabel);
 void   mac_devfs_label_associate_device(dev_t dev, struct devnode *de,


@@ -312,17 +311,18 @@ void      mac_posixshm_label_destroy(struct pshminfo *pshm);
 void   mac_posixshm_label_init(struct pshminfo *pshm);
 int    mac_proc_check_debug(proc_t proc1, proc_t proc2);
 int    mac_proc_check_fork(proc_t proc);
 void   mac_posixshm_label_init(struct pshminfo *pshm);
 int    mac_proc_check_debug(proc_t proc1, proc_t proc2);
 int    mac_proc_check_fork(proc_t proc);

+int    mac_proc_check_suspend_resume(proc_t proc, int sr);

 int    mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
 int    mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
 int    mac_proc_check_getaudit(proc_t proc);
 int    mac_proc_check_getauid(proc_t proc);
 int     mac_proc_check_getlcid(proc_t proc1, proc_t proc2,
            pid_t pid);
 int    mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
 int    mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
 int    mac_proc_check_getaudit(proc_t proc);
 int    mac_proc_check_getauid(proc_t proc);
 int     mac_proc_check_getlcid(proc_t proc1, proc_t proc2,
            pid_t pid);

-int    mac_proc_check_map_prot_copy_allow(proc_t proc);

 int    mac_proc_check_mprotect(proc_t proc,
            user_addr_t addr, user_size_t size, int prot);
 int    mac_proc_check_mprotect(proc_t proc,
            user_addr_t addr, user_size_t size, int prot);

+int    mac_proc_check_run_cs_invalid(proc_t proc);

 int    mac_proc_check_sched(proc_t proc, proc_t proc2);
 int    mac_proc_check_sched(proc_t proc, proc_t proc2);

-int    mac_proc_check_setaudit(proc_t proc, struct auditinfo *ai);
+int    mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai);

 int    mac_proc_check_setauid(proc_t proc, uid_t auid);
 int     mac_proc_check_setlcid(proc_t proc1, proc_t proc2,
            pid_t pid1, pid_t pid2);
 int    mac_proc_check_setauid(proc_t proc, uid_t auid);
 int     mac_proc_check_setlcid(proc_t proc1, proc_t proc2,
            pid_t pid1, pid_t pid2);


@@ -486,6 +486,9 @@ int mac_vnode_check_stat(vfs_context_t ctx,
            kauth_cred_t file_cred, struct vnode *vp);
 int    mac_vnode_check_truncate(vfs_context_t ctx,
            kauth_cred_t file_cred, struct vnode *vp);
            kauth_cred_t file_cred, struct vnode *vp);
 int    mac_vnode_check_truncate(vfs_context_t ctx,
            kauth_cred_t file_cred, struct vnode *vp);

+int    mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
+           struct componentname *cnp, struct vnode_attr *vap);
+int    mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp);

 int    mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
            struct vnode *vp, struct componentname *cnp);
 int    mac_vnode_check_write(vfs_context_t ctx,
 int    mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
            struct vnode *vp, struct componentname *cnp);
 int    mac_vnode_check_write(vfs_context_t ctx,


@@ -505,6 +508,7 @@ void        mac_vnode_label_destroy(struct vnode *vp);
 int    mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac);
 void   mac_vnode_label_free(struct label *label);
 void   mac_vnode_label_init(struct vnode *vp);
 int    mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac);
 void   mac_vnode_label_free(struct label *label);
 void   mac_vnode_label_init(struct vnode *vp);

+int    mac_vnode_label_init_needed(struct vnode *vp);

 void   mac_vnode_label_recycle(struct vnode *vp);
 void   mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
            struct label *newlabel);
 void   mac_vnode_label_recycle(struct vnode *vp);
 void   mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
            struct label *newlabel);