xnu-3789.70.16.tar.gz

[apple/xnu.git] / bsd / kern / policy_check.c

diff --git a/bsd/kern/policy_check.c b/bsd/kern/policy_check.c
index 95ae2d593d9f85b93b7d2586bf00616d01158a62..cbaf30ca4ea274d0966691180d8f300fa463588f 100644 (file)
--- a/bsd/kern/policy_check.c
+++ b/bsd/kern/policy_check.c
@@ -118,7 +118,7 @@ common_hook(void)
        return rv;
 }
 
-#if (MAC_POLICY_OPS_VERSION != 32)
+#if (MAC_POLICY_OPS_VERSION != 47)
 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 #endif
 /*
@@ -201,15 +201,16 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(ipq_label_init)
        CHECK_SET_HOOK(ipq_label_update)
 
-       CHECK_SET_HOOK(lctx_check_label_update)
-       CHECK_SET_HOOK(lctx_label_destroy)
-       CHECK_SET_HOOK(lctx_label_externalize)
-       CHECK_SET_HOOK(lctx_label_init)
-       CHECK_SET_HOOK(lctx_label_internalize)
-       CHECK_SET_HOOK(lctx_label_update)
-       CHECK_SET_HOOK(lctx_notify_create)
-       CHECK_SET_HOOK(lctx_notify_join)
-       CHECK_SET_HOOK(lctx_notify_leave)
+       CHECK_SET_HOOK(file_check_library_validation)
+
+       CHECK_SET_HOOK(vnode_notify_setacl)
+       CHECK_SET_HOOK(vnode_notify_setattrlist)
+       CHECK_SET_HOOK(vnode_notify_setextattr)
+       CHECK_SET_HOOK(vnode_notify_setflags)
+       CHECK_SET_HOOK(vnode_notify_setmode)
+       CHECK_SET_HOOK(vnode_notify_setowner)
+       CHECK_SET_HOOK(vnode_notify_setutimes)
+       CHECK_SET_HOOK(vnode_notify_truncate)
 
        CHECK_SET_HOOK(mbuf_label_associate_bpfdesc)
        CHECK_SET_HOOK(mbuf_label_associate_ifnet)
@@ -265,25 +266,26 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(system_check_sysctlbyname)
        CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
        CHECK_SET_HOOK(vnode_check_rename)
+       CHECK_SET_HOOK(kext_check_query)
+       CHECK_SET_HOOK(iokit_check_nvram_get)
+       CHECK_SET_HOOK(iokit_check_nvram_set)
+       CHECK_SET_HOOK(iokit_check_nvram_delete)
+       CHECK_SET_HOOK(proc_check_expose_task)
+       CHECK_SET_HOOK(proc_check_set_host_special_port)
+       CHECK_SET_HOOK(proc_check_set_host_exception_port)
+       CHECK_SET_HOOK(exc_action_check_exception_send)
+       CHECK_SET_HOOK(exc_action_label_associate)
+       CHECK_SET_HOOK(exc_action_label_copy)
+       CHECK_SET_HOOK(exc_action_label_destroy)
+       CHECK_SET_HOOK(exc_action_label_init)
+       CHECK_SET_HOOK(exc_action_label_update)
+
+       .mpo_reserved1 = (mpo_reserved_hook_t *)common_hook,
+       .mpo_reserved2 = (mpo_reserved_hook_t *)common_hook,
+       .mpo_reserved3 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved4 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved6 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved7 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved8 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved9 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved10 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved11 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved12 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved13 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved14 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved15 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved16 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved17 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved18 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved19 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved20 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved21 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved22 = (mpo_reserved_hook_t *)common_hook,
 
        CHECK_SET_HOOK(posixsem_check_create)
        CHECK_SET_HOOK(posixsem_check_open)
@@ -361,7 +363,7 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(system_check_settime)
        CHECK_SET_HOOK(system_check_swapoff)
        CHECK_SET_HOOK(system_check_swapon)
-       .mpo_reserved31 = (mpo_reserved_hook_t *)common_hook,
+       .mpo_reserved7 = (mpo_reserved_hook_t *)common_hook,
 
        CHECK_SET_HOOK(sysvmsg_label_associate)
        CHECK_SET_HOOK(sysvmsg_label_destroy)
@@ -394,14 +396,14 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(sysvshm_label_init)
        CHECK_SET_HOOK(sysvshm_label_recycle)
 
-       .mpo_reserved23 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved24 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved25 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved26 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved27 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved28 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved29 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved30 = (mpo_reserved_hook_t *)common_hook,
+       .mpo_reserved8 = (mpo_reserved_hook_t *)common_hook,
+       CHECK_SET_HOOK(mount_check_snapshot_revert)
+       CHECK_SET_HOOK(vnode_check_getattr)
+       CHECK_SET_HOOK(mount_check_snapshot_create)
+       CHECK_SET_HOOK(mount_check_snapshot_delete)
+       CHECK_SET_HOOK(vnode_check_clone)
+       CHECK_SET_HOOK(proc_check_get_cs_info)
+       CHECK_SET_HOOK(proc_check_set_cs_info)
 
        CHECK_SET_HOOK(iokit_check_hid_control)
 
@@ -461,8 +463,7 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(vnode_check_uipc_bind)
        CHECK_SET_HOOK(vnode_check_uipc_connect)
 
-       /* CHECK_SET_HOOK(proc_check_run_cs_invalid) */
-       .mpo_proc_check_run_cs_invalid = (mac_proc_check_run_cs_invalid_t *)common_hook,
+       CHECK_SET_HOOK(proc_check_run_cs_invalid)
        CHECK_SET_HOOK(proc_check_suspend_resume)
 
        CHECK_SET_HOOK(thread_userret)
@@ -486,8 +487,9 @@ static struct mac_policy_ops policy_ops = {
 
        CHECK_SET_HOOK(vnode_notify_rename)
 
-       CHECK_SET_HOOK(thread_label_init)
-       CHECK_SET_HOOK(thread_label_destroy)
+       CHECK_SET_HOOK(vnode_check_setacl)
+
+       CHECK_SET_HOOK(vnode_notify_deleteextattr)
 
        CHECK_SET_HOOK(system_check_kas_info)