+out:
+ kauth_cred_unref(&target_cred);
+ return (error);
+
+}
+
+static int
+proc_set_darwin_role(proc_t curp, proc_t targetp, int priority)
+{
+ int error = 0;
+ uint32_t flagsp;
+
+ kauth_cred_t ucred, target_cred;
+
+ ucred = kauth_cred_get();
+ target_cred = kauth_cred_proc_ref(targetp);
+
+ if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
+ kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
+ kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
+ error = EPERM;
+ goto out;
+ }
+
+ if (curp != targetp) {
+#if CONFIG_MACF
+ if ((error = mac_proc_check_sched(curp, targetp)))
+ goto out;
+#endif
+ }
+
+ proc_get_darwinbgstate(proc_task(targetp), &flagsp);
+ if ((flagsp & PROC_FLAG_APPLICATION) != PROC_FLAG_APPLICATION) {
+ error = ENOTSUP;
+ goto out;
+ }
+
+ integer_t role = 0;
+
+ if ((error = proc_darwin_role_to_task_role(priority, &role)))
+ goto out;
+
+ proc_set_task_policy(proc_task(targetp), THREAD_NULL,
+ TASK_POLICY_ATTRIBUTE, TASK_POLICY_ROLE, role);
+
+out:
+ kauth_cred_unref(&target_cred);
+ return (error);
+}
+
+static int
+proc_get_darwin_role(proc_t curp, proc_t targetp, int *priority)
+{
+ int error = 0;
+ int role = 0;
+
+ kauth_cred_t ucred, target_cred;
+
+ ucred = kauth_cred_get();
+ target_cred = kauth_cred_proc_ref(targetp);
+
+ if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
+ kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
+ kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
+ error = EPERM;
+ goto out;
+ }
+
+ if (curp != targetp) {
+#if CONFIG_MACF
+ if ((error = mac_proc_check_sched(curp, targetp)))
+ goto out;
+#endif
+ }
+
+ role = proc_get_task_policy(proc_task(targetp), THREAD_NULL,
+ TASK_POLICY_ATTRIBUTE, TASK_POLICY_ROLE);
+
+ *priority = proc_task_role_to_darwin_role(role);
+
+out:
+ kauth_cred_unref(&target_cred);
+ return (error);
+}
+
+
+static int
+get_background_proc(struct proc *curp, struct proc *targetp, int *priority)
+{
+ int external = 0;
+ int error = 0;
+ kauth_cred_t ucred, target_cred;
+
+ ucred = kauth_cred_get();
+ target_cred = kauth_cred_proc_ref(targetp);
+
+ if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
+ kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
+ kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
+ error = EPERM;
+ goto out;
+ }
+
+ external = (curp == targetp) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
+
+ *priority = proc_get_task_policy(current_task(), THREAD_NULL, external, TASK_POLICY_DARWIN_BG);
+
+out:
+ kauth_cred_unref(&target_cred);
+ return (error);
+}
+
+static int
+do_background_proc(struct proc *curp, struct proc *targetp, int priority)
+{
+#if !CONFIG_MACF
+#pragma unused(curp)
+#endif
+ int error = 0;
+ kauth_cred_t ucred;
+ kauth_cred_t target_cred;
+ int external;
+ int enable;
+
+ ucred = kauth_cred_get();
+ target_cred = kauth_cred_proc_ref(targetp);
+
+ if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
+ kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
+ kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred))
+ {
+ error = EPERM;
+ goto out;
+ }
+
+#if CONFIG_MACF
+ error = mac_proc_check_sched(curp, targetp);
+ if (error)
+ goto out;
+#endif
+
+ external = (curp == targetp) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
+
+ switch (priority) {
+ case PRIO_DARWIN_BG:
+ enable = TASK_POLICY_ENABLE;
+ break;
+ case PRIO_DARWIN_NONUI:
+ /* ignored for compatibility */
+ goto out;
+ default:
+ /* TODO: EINVAL if priority != 0 */
+ enable = TASK_POLICY_DISABLE;
+ break;
+ }
+
+ proc_set_task_policy(proc_task(targetp), THREAD_NULL, external, TASK_POLICY_DARWIN_BG, enable);
+
+out:
+ kauth_cred_unref(&target_cred);
+ return (error);
+}
+
+static void
+do_background_socket(struct proc *p, thread_t thread)
+{
+#if SOCKETS
+ struct filedesc *fdp;
+ struct fileproc *fp;
+ int i, background;
+
+ proc_fdlock(p);
+
+ if (thread != THREAD_NULL)
+ background = proc_get_effective_thread_policy(thread, TASK_POLICY_ALL_SOCKETS_BG);
+ else
+ background = proc_get_effective_task_policy(proc_task(p), TASK_POLICY_ALL_SOCKETS_BG);
+
+ if (background) {
+ /*
+ * For PRIO_DARWIN_PROCESS (thread is NULL), simply mark
+ * the sockets with the background flag. There's nothing
+ * to do here for the PRIO_DARWIN_THREAD case.
+ */
+ if (thread == THREAD_NULL) {
+ fdp = p->p_fd;
+
+ for (i = 0; i < fdp->fd_nfiles; i++) {
+ struct socket *sockp;
+
+ fp = fdp->fd_ofiles[i];
+ if (fp == NULL || (fdp->fd_ofileflags[i] & UF_RESERVED) != 0 ||
+ FILEGLOB_DTYPE(fp->f_fglob) != DTYPE_SOCKET) {
+ continue;
+ }
+ sockp = (struct socket *)fp->f_fglob->fg_data;
+ socket_set_traffic_mgt_flags(sockp, TRAFFIC_MGT_SO_BACKGROUND);
+ sockp->so_background_thread = NULL;
+ }
+ }
+ } else {
projects / apple / xnu.git / blobdiff