xnu-4570.20.62.tar.gz

[apple/xnu.git] / security / mac_process.c

diff --git a/security/mac_process.c b/security/mac_process.c
index 8071c3e6507177a35e6461624635b00a868090b1..f3ea32890e68a607f79f5ecb1184c2ca554c0fcb 100644 (file)
--- a/security/mac_process.c
+++ b/security/mac_process.c
@@ -291,25 +291,16 @@ mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 
        MAC_CHECK(cred_check_visible, u1, u2);
 
 #endif
 
        MAC_CHECK(cred_check_visible, u1, u2);
 

-

        return (error);
 }
 
        return (error);
 }
 

-/*                                                                                                    
- * called with process locked.                                                                        
- */
-void mac_proc_set_enforce(proc_t p, int enforce_flags)
-{
-        p->p_mac_enforce |= enforce_flags;
-}
-

 int
 mac_proc_check_debug(proc_t curp, struct proc *proc)
 {
 int
 mac_proc_check_debug(proc_t curp, struct proc *proc)
 {


@@ -317,13 +308,12 @@ mac_proc_check_debug(proc_t curp, struct proc *proc)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    
-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_debug, cred, proc);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_debug, cred, proc);


@@ -339,13 +329,12 @@ mac_proc_check_fork(proc_t curp)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    
-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_fork, cred, curp);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_fork, cred, curp);


@@ -407,11 +396,11 @@ mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_vm_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_vm_enforce)
+               return 0;

 #endif
 #endif

-       if (!mac_proc_check_enforce(proc, MAC_VM_ENFORCE))
+       if (!mac_proc_check_enforce(proc))

                return (0);
 
        cred = kauth_cred_proc_ref(proc);
                return (0);
 
        cred = kauth_cred_proc_ref(proc);


@@ -429,12 +418,12 @@ mac_proc_check_mprotect(proc_t proc,
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_vm_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_vm_enforce)
+               return 0;

 #endif
 #endif

-    if (!mac_proc_check_enforce(proc, MAC_VM_ENFORCE))
-        return (0);
+       if (!mac_proc_check_enforce(proc))
+               return (0);

 
        cred = kauth_cred_proc_ref(proc);
        MAC_CHECK(proc_check_mprotect, cred, proc, addr, size, prot);
 
        cred = kauth_cred_proc_ref(proc);
        MAC_CHECK(proc_check_mprotect, cred, proc, addr, size, prot);


@@ -466,13 +455,12 @@ mac_proc_check_sched(proc_t curp, struct proc *proc)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    
-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_sched, cred, proc);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_sched, cred, proc);


@@ -488,13 +476,12 @@ mac_proc_check_signal(proc_t curp, struct proc *proc, int signum)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    
-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_signal, cred, proc, signum);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_signal, cred, proc, signum);


@@ -510,12 +497,12 @@ mac_proc_check_wait(proc_t curp, struct proc *proc)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_wait, cred, proc);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_wait, cred, proc);


@@ -524,6 +511,12 @@ mac_proc_check_wait(proc_t curp, struct proc *proc)
        return (error);
 }
 
        return (error);
 }
 

+void
+mac_proc_notify_exit(struct proc *proc)
+{
+       MAC_PERFORM(proc_notify_exit, proc);
+}
+

 int
 mac_proc_check_suspend_resume(proc_t curp, int sr)
 {
 int
 mac_proc_check_suspend_resume(proc_t curp, int sr)
 {


@@ -531,12 +524,12 @@ mac_proc_check_suspend_resume(proc_t curp, int sr)
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_suspend_resume, cred, curp, sr);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_suspend_resume, cred, curp, sr);


@@ -552,12 +545,12 @@ mac_proc_check_ledger(proc_t curp, proc_t proc, int ledger_op)
        int error = 0;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error = 0;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_ledger, cred, proc, ledger_op);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_ledger, cred, proc, ledger_op);


@@ -566,27 +559,6 @@ mac_proc_check_ledger(proc_t curp, proc_t proc, int ledger_op)
        return (error);
 }
 
        return (error);
 }
 

-int
-mac_proc_check_cpumon(proc_t curp)
-{
-       kauth_cred_t cred;
-       int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
-#endif
-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
-
-       cred = kauth_cred_proc_ref(curp);
-       MAC_CHECK(proc_check_cpumon, cred);
-       kauth_cred_unref(&cred);
-
-       return (error);
-}
-

 int
 mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
 {
 int
 mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
 {


@@ -594,12 +566,12 @@ mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
        int error = 0;
 
 #if SECURITY_MAC_CHECK_ENFORCE
        int error = 0;
 
 #if SECURITY_MAC_CHECK_ENFORCE

-    /* 21167099 - only check if we allow write */
-    if (!mac_proc_enforce)
-        return 0;
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce)
+               return 0;

 #endif
 #endif

-    if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
-        return 0;
+       if (!mac_proc_check_enforce(curp))
+               return 0;

 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_proc_info, cred, target, callnum, flavor);
 
        cred = kauth_cred_proc_ref(curp);
        MAC_CHECK(proc_check_proc_info, cred, target, callnum, flavor);


@@ -608,7 +580,6 @@ mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
        return (error);
 }
 
        return (error);
 }
 

-

 int
 mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op)
 {
 int
 mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op)
 {


@@ -620,7 +591,7 @@ mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op)
        if (!mac_proc_enforce)
                return 0;
 #endif
        if (!mac_proc_enforce)
                return 0;
 #endif

-       if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+       if (!mac_proc_check_enforce(curp))

                return 0;
 
        cred = kauth_cred_proc_ref(curp);
                return 0;
 
        cred = kauth_cred_proc_ref(curp);


@@ -641,7 +612,7 @@ mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op)
        if (!mac_proc_enforce)
                return 0;
 #endif
        if (!mac_proc_enforce)
                return 0;
 #endif

-       if (!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+       if (!mac_proc_check_enforce(curp))

                return 0;
 
        cred = kauth_cred_proc_ref(curp);
                return 0;
 
        cred = kauth_cred_proc_ref(curp);