xnu-6153.11.26.tar.gz

[apple/xnu.git] / bsd / kern / policy_check.c

diff --git a/bsd/kern/policy_check.c b/bsd/kern/policy_check.c
index 52a91f33bee73c74c3852a4dc7adbb91179854cc..de77a23be622a9211f113e50446e1e5ec2a8e8f8 100644 (file)
--- a/bsd/kern/policy_check.c
+++ b/bsd/kern/policy_check.c
@@ -1,5 +1,5 @@
 #include <sys/param.h>
 #include <sys/param.h>

-#include <sys/systm.h>         /* XXX printf() */
+#include <sys/systm.h>          /* XXX printf() */

 
 #include <sys/types.h>
 #include <sys/fcntl.h>
 
 #include <sys/types.h>
 #include <sys/fcntl.h>


@@ -14,7 +14,7 @@
 #include <security/mac_policy.h>
 
 #include <libkern/section_keywords.h>
 #include <security/mac_policy.h>
 
 #include <libkern/section_keywords.h>

-#include <libkern/OSDebug.h>   /* OSBPrintBacktrace */
+#include <libkern/OSDebug.h>    /* OSBPrintBacktrace */

 
 
 /* forward declaration; see bsd_init.c */
 
 
 /* forward declaration; see bsd_init.c */


@@ -27,16 +27,16 @@ int get_thread_lock_count(thread_t th);         /* forced forward */
  * Note:       CHECK_POLICY_CHECK is probably not very useful unless you
  *             are kernel debugging and set a breakpoint.
  */
  * Note:       CHECK_POLICY_CHECK is probably not very useful unless you
  *             are kernel debugging and set a breakpoint.
  */

-#define        CHECK_POLICY_CHECK      0x00000001      /* Check on calls */
-#define        CHECK_POLICY_FAIL       0x00000002      /* EPERM on fails */
-#define        CHECK_POLICY_BACKTRACE  0x00000004      /* Show call stack on fails */
-#define        CHECK_POLICY_PANIC      0x00000008      /* Panic on fails */
-#define        CHECK_POLICY_PERIODIC   0x00000010      /* Show fails periodically */
+#define CHECK_POLICY_CHECK      0x00000001      /* Check on calls */
+#define CHECK_POLICY_FAIL       0x00000002      /* EPERM on fails */
+#define CHECK_POLICY_BACKTRACE  0x00000004      /* Show call stack on fails */
+#define CHECK_POLICY_PANIC      0x00000008      /* Panic on fails */
+#define CHECK_POLICY_PERIODIC   0x00000010      /* Show fails periodically */

 
 static int policy_flags = 0;
 
 
 
 static int policy_flags = 0;
 
 

-#define CHECK_SET_HOOK(x)      .mpo_##x = (mpo_##x##_t *)common_hook,
+#define CHECK_SET_HOOK(x)       .mpo_##x = (mpo_##x##_t *)common_hook,

 
 /*
  * Init; currently, we only print our arrival notice.
 
 /*
  * Init; currently, we only print our arrival notice.


@@ -56,8 +56,8 @@ hook_policy_initbsd(struct mac_policy_conf *mpc)
 
 
 /* Implementation */
 
 
 /* Implementation */

-#define        CLASS_PERIOD_LIMIT      10000
-#define        CLASS_PERIOD_MULT       20
+#define CLASS_PERIOD_LIMIT      10000
+#define CLASS_PERIOD_MULT       20

 
 static int policy_check_event = 1;
 static int policy_check_period = 1;
 
 static int policy_check_event = 1;
 static int policy_check_period = 1;


@@ -67,16 +67,17 @@ static int policy_check_next = CLASS_PERIOD_MULT;
 static int
 common_hook(void)
 {
 static int
 common_hook(void)
 {

-       int     i;
-       int     rv = 0;
+       int     i;
+       int     rv = 0;

 
        if ((i = get_thread_lock_count(current_thread())) != 0) {
                /*
                 * fail the MACF check if we hold a lock; this assumes a
                 * a non-void (authorization) MACF hook.
                 */
 
        if ((i = get_thread_lock_count(current_thread())) != 0) {
                /*
                 * fail the MACF check if we hold a lock; this assumes a
                 * a non-void (authorization) MACF hook.
                 */

-               if (policy_flags & CHECK_POLICY_FAIL)
+               if (policy_flags & CHECK_POLICY_FAIL) {

                        rv = EPERM;
                        rv = EPERM;

+               }

 
                /*
                 * display a backtrace if we hold a lock and we are not
 
                /*
                 * display a backtrace if we hold a lock and we are not


@@ -84,24 +85,24 @@ common_hook(void)
                 */
                if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) {
                        if (policy_flags & CHECK_POLICY_PERIODIC) {
                 */
                if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) {
                        if (policy_flags & CHECK_POLICY_PERIODIC) {

-                           /* at exponentially increasing intervals */
-                           if (!(policy_check_event % policy_check_period)) {
-                               if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
-                                       /*
-                                        * According to Derek, we could
-                                        * technically get a symbolicated name
-                                        * here, if we refactered some code
-                                        * and set the "keepsyms=1" boot
-                                        * argument...
-                                        */
-                                       OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
-                               }
-                           } else {
-                               if (policy_check_period < CLASS_PERIOD_LIMIT) {
-                                       policy_check_next *= CLASS_PERIOD_MULT;
-                                       policy_check_period *= CLASS_PERIOD_MULT;
+                               /* at exponentially increasing intervals */
+                               if (!(policy_check_event % policy_check_period)) {
+                                       if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
+                                               /*
+                                                * According to Derek, we could
+                                                * technically get a symbolicated name
+                                                * here, if we refactered some code
+                                                * and set the "keepsyms=1" boot
+                                                * argument...
+                                                */
+                                               OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
+                                       }
+                               } else {
+                                       if (policy_check_period < CLASS_PERIOD_LIMIT) {
+                                               policy_check_next *= CLASS_PERIOD_MULT;
+                                               policy_check_period *= CLASS_PERIOD_MULT;
+                                       }

                                }
                                }

-                           }

                        } else {
                                /* always */
                                OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
                        } else {
                                /* always */
                                OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);


@@ -109,8 +110,9 @@ common_hook(void)
                }
 
                /* Panic */
                }
 
                /* Panic */

-               if (policy_flags & CHECK_POLICY_PANIC)
+               if (policy_flags & CHECK_POLICY_PANIC) {

                        panic("calling MACF hook with mutex count %d\n", i);
                        panic("calling MACF hook with mutex count %d\n", i);

+               }

 
                /* count for non-fatal tracing */
                policy_check_event++;
 
                /* count for non-fatal tracing */
                policy_check_event++;


@@ -119,7 +121,7 @@ common_hook(void)
        return rv;
 }
 
        return rv;
 }
 

-#if (MAC_POLICY_OPS_VERSION != 53)
+#if (MAC_POLICY_OPS_VERSION != 58)

 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 #endif
 /*
 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 #endif
 /*


@@ -268,9 +270,9 @@ const static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
        CHECK_SET_HOOK(vnode_check_rename)
        CHECK_SET_HOOK(kext_check_query)
        CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
        CHECK_SET_HOOK(vnode_check_rename)
        CHECK_SET_HOOK(kext_check_query)

-       CHECK_SET_HOOK(iokit_check_nvram_get)
-       CHECK_SET_HOOK(iokit_check_nvram_set)
-       CHECK_SET_HOOK(iokit_check_nvram_delete)
+       CHECK_SET_HOOK(proc_notify_exec_complete)
+       .mpo_reserved4 = (mpo_reserved_hook_t *)common_hook,
+       CHECK_SET_HOOK(proc_check_syscall_unix)

        CHECK_SET_HOOK(proc_check_expose_task)
        CHECK_SET_HOOK(proc_check_set_host_special_port)
        CHECK_SET_HOOK(proc_check_set_host_exception_port)
        CHECK_SET_HOOK(proc_check_expose_task)
        CHECK_SET_HOOK(proc_check_set_host_special_port)
        CHECK_SET_HOOK(proc_check_set_host_exception_port)


@@ -282,9 +284,9 @@ const static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(exc_action_label_update)
 
        CHECK_SET_HOOK(vnode_check_trigger_resolve)
        CHECK_SET_HOOK(exc_action_label_update)
 
        CHECK_SET_HOOK(vnode_check_trigger_resolve)

+       CHECK_SET_HOOK(mount_check_mount_late)

        .mpo_reserved1 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved2 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved1 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved2 = (mpo_reserved_hook_t *)common_hook,

-       .mpo_reserved3 = (mpo_reserved_hook_t *)common_hook,

        CHECK_SET_HOOK(skywalk_flow_check_connect)
        CHECK_SET_HOOK(skywalk_flow_check_listen)
 
        CHECK_SET_HOOK(skywalk_flow_check_connect)
        CHECK_SET_HOOK(skywalk_flow_check_listen)
 


@@ -320,8 +322,9 @@ const static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(proc_check_setlcid)
        CHECK_SET_HOOK(proc_check_signal)
        CHECK_SET_HOOK(proc_check_wait)
        CHECK_SET_HOOK(proc_check_setlcid)
        CHECK_SET_HOOK(proc_check_signal)
        CHECK_SET_HOOK(proc_check_wait)

-       CHECK_SET_HOOK(proc_label_destroy)
-       CHECK_SET_HOOK(proc_label_init)
+
+       .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,
+       .mpo_reserved6 = (mpo_reserved_hook_t *)common_hook,

 
        CHECK_SET_HOOK(socket_check_accept)
        CHECK_SET_HOOK(socket_check_accepted)
 
        CHECK_SET_HOOK(socket_check_accept)
        CHECK_SET_HOOK(socket_check_accepted)


@@ -471,6 +474,8 @@ const static struct mac_policy_ops policy_ops = {
 
        CHECK_SET_HOOK(iokit_check_set_properties)
 
 
        CHECK_SET_HOOK(iokit_check_set_properties)
 

+       .mpo_reserved3 = (mpo_reserved_hook_t *)common_hook,
+

        CHECK_SET_HOOK(vnode_check_searchfs)
 
        CHECK_SET_HOOK(priv_check)
        CHECK_SET_HOOK(vnode_check_searchfs)
 
        CHECK_SET_HOOK(priv_check)


@@ -521,10 +526,10 @@ const static struct mac_policy_ops policy_ops = {
 static SECURITY_READ_ONLY_LATE(struct mac_policy_conf) policy_conf = {
        .mpc_name               = "CHECK",
        .mpc_fullname           = "Check Assumptions Policy",
 static SECURITY_READ_ONLY_LATE(struct mac_policy_conf) policy_conf = {
        .mpc_name               = "CHECK",
        .mpc_fullname           = "Check Assumptions Policy",

-       .mpc_field_off          = NULL,         /* no label slot */
-       .mpc_labelnames         = NULL,         /* no policy label names */
-       .mpc_labelname_count    = 0,            /* count of label names is 0 */
-       .mpc_ops                = &policy_ops,  /* policy operations */
+       .mpc_field_off          = NULL,         /* no label slot */
+       .mpc_labelnames         = NULL,         /* no policy label names */
+       .mpc_labelname_count    = 0,            /* count of label names is 0 */
+       .mpc_ops                = &policy_ops,  /* policy operations */

        .mpc_loadtime_flags     = 0,
        .mpc_runtime_flags      = 0,
 };
        .mpc_loadtime_flags     = 0,
        .mpc_runtime_flags      = 0,
 };


@@ -540,8 +545,9 @@ errno_t
 check_policy_init(int flags)
 {
        /* Only instantiate the module if we have been asked to do checking */
 check_policy_init(int flags)
 {
        /* Only instantiate the module if we have been asked to do checking */

-       if (!flags)
+       if (!flags) {

                return 0;
                return 0;

+       }

 
        policy_flags = flags;
 
 
        policy_flags = flags;