xnu-3248.60.10.tar.gz

[apple/xnu.git] / security / mac_audit.c

diff --git a/security/mac_audit.c b/security/mac_audit.c
index 7fe8b5705a41c731e5d5d9a3811cc0b22b1e6c7d..2454b57aa980bda2c8aaaa5b41961ab8f596c8b9 100644 (file)
--- a/security/mac_audit.c
+++ b/security/mac_audit.c
@@ -116,8 +116,13 @@ mac_proc_check_getauid(struct proc *curp)
        kauth_cred_t cred;
        int error;
 
-       if (!mac_proc_enforce ||
-           !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_proc_enforce)
+        return 0;
+#endif
+    
+       if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
                return 0;
 
        cred = kauth_cred_proc_ref(curp);
@@ -133,9 +138,13 @@ mac_proc_check_setauid(struct proc *curp, uid_t auid)
        kauth_cred_t cred;
        int error;
 
-       if (!mac_proc_enforce ||
-           !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_proc_enforce)
+        return 0;
+#endif
+    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+        return 0;
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_setauid, cred, auid);
@@ -150,9 +159,13 @@ mac_proc_check_getaudit(struct proc *curp)
        kauth_cred_t cred;
        int error;
 
-       if (!mac_proc_enforce ||
-           !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_proc_enforce)
+        return 0;
+#endif
+    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+        return 0;
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_getaudit, cred);
@@ -167,9 +180,13 @@ mac_proc_check_setaudit(struct proc *curp, struct auditinfo_addr *ai)
        kauth_cred_t cred;
        int error;
 
-       if (!mac_proc_enforce ||
-           !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-               return 0;
+#if SECURITY_MAC_CHECK_ENFORCE
+    /* 21167099 - only check if we allow write */
+    if (!mac_proc_enforce)
+        return 0;
+#endif
+    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+        return 0;
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_setaudit, cred, ai);