* Copyright (c) 2007 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
- *
+ *
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
* unlawful or unlicensed copies of an Apple operating system, or to
* circumvent, violate, or enable the circumvention or violation of, any
* terms of an Apple operating system software license agreement.
- *
+ *
* Please obtain a copy of the License at
* http://www.opensource.apple.com/apsl/ and read it before using this file.
- *
+ *
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
* Please see the License for the specific language governing rights and
* limitations under the License.
- *
+ *
* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
/*-
struct auditinfo;
struct bpf_d;
struct componentname;
+struct cs_blob;
struct devnode;
+struct exception_action;
struct flock;
struct fdescnode;
struct fileglob;
struct ifreq;
struct image_params;
struct inpcb;
+struct ipc_port;
struct ipq;
struct knote;
-struct lctx;
struct m_tag;
struct mac;
struct mac_module_data;
struct vnode_attr;
struct vop_setlabel_args;
+#include <sys/kauth.h>
+#include <sys/kernel_types.h>
+
#if CONFIG_MACF
#ifndef __IOKIT_PORTS_DEFINED__
unsigned int cmd);
int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op,
struct flock *fl);
+int mac_file_check_library_validation(struct proc *proc,
+ struct fileglob *fg, off_t slice_offset,
+ user_long_t error_message, size_t error_message_size);
int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg,
- int prot, int flags, int *maxprot);
+ int prot, int flags, uint64_t file_pos, int *maxprot);
void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg,
int *prot);
int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg);
void mac_ipq_label_destroy(struct ipq *ipq);
int mac_ipq_label_init(struct ipq *ipq, int flag);
void mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq);
-struct label *mac_lctx_label_alloc(void);
-void mac_lctx_label_free(struct label *label);
-void mac_lctx_label_update(struct lctx *l, struct label *newlabel);
-int mac_lctx_check_label_update(struct lctx *l, struct label *newlabel);
-void mac_lctx_notify_create(proc_t proc, struct lctx *l);
-void mac_lctx_notify_join(proc_t proc, struct lctx *l);
-void mac_lctx_notify_leave(proc_t proc, struct lctx *l);
void mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m);
void mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m);
void mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m);
int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp);
int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp,
struct componentname *cnp, const char *vfc_name);
+int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp,
+ const char *name);
+int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp,
+ const char *name);
+int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp,
+ const char *name);
int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp);
int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp,
struct vfs_attr *vfa);
int mac_priv_check(kauth_cred_t cred, int priv);
int mac_priv_grant(kauth_cred_t cred, int priv);
int mac_proc_check_debug(proc_t proc1, proc_t proc2);
-int mac_proc_check_cpumon(proc_t curp);
int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);
+int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op);
+int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op);
int mac_proc_check_fork(proc_t proc);
int mac_proc_check_suspend_resume(proc_t proc, int sr);
int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
int mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
+int mac_proc_check_expose_task(kauth_cred_t cred, struct proc *p);
int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp);
int mac_proc_check_getaudit(proc_t proc);
int mac_proc_check_getauid(proc_t proc);
int mac_proc_check_signal(proc_t proc1, proc_t proc2,
int signum);
int mac_proc_check_wait(proc_t proc1, proc_t proc2);
-void mac_proc_set_enforce(proc_t p, int enforce_flags);
+void mac_proc_notify_exit(proc_t proc);
int mac_setsockopt_label(kauth_cred_t cred, struct socket *so,
struct mac *extmac);
int mac_socket_check_accept(kauth_cred_t cred, struct socket *so);
int mac_socket_check_create(kauth_cred_t cred, int domain,
int type, int protocol);
int mac_socket_check_deliver(struct socket *so, struct mbuf *m);
+int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
+ unsigned int cmd);
int mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
struct socket *so);
int mac_socket_check_listen(kauth_cred_t cred, struct socket *so);
int mac_socket_check_receive(kauth_cred_t cred, struct socket *so);
-int mac_socket_check_received(kauth_cred_t cred, struct socket *so,
+int mac_socket_check_received(kauth_cred_t cred, struct socket *so,
struct sockaddr *saddr);
int mac_socket_check_select(kauth_cred_t cred, struct socket *so,
int which);
void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr);
void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr);
void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr);
-struct label * mac_thread_label_alloc(void);
-void mac_thread_label_destroy(struct uthread *uthread);
-void mac_thread_label_free(struct label *label);
-void mac_thread_label_init(struct uthread *uthread);
int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
int acc_mode);
int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp);
int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp,
struct componentname *cnp);
+int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp,
+ struct vnode *vp, struct componentname *cnp);
int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp,
struct componentname *cnp, struct vnode_attr *vap);
int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp,
int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
struct image_params *imgp);
int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);
-int mac_vnode_check_signature(struct vnode *vp, off_t macho_offset,
- unsigned char *sha1, const void * signature, size_t size,
- int flags, int *is_platform_binary);
+int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred,
+ struct vnode *vp, struct vnode_attr *va);
int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
struct attrlist *alist);
int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp);
int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp,
struct componentname *cnp);
+int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp,
+ const char *path, size_t pathlen);
int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp,
int acc_mode);
int mac_vnode_check_read(vfs_context_t ctx,
struct attrlist *alist);
int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp,
int which);
+int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp,
+ struct kauth_acl *acl);
int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp,
struct attrlist *alist);
int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp,
uid_t uid, gid_t gid);
int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
struct timespec atime, struct timespec mtime);
+int mac_vnode_check_signature(struct vnode *vp,
+ struct cs_blob *cs_blob, struct image_params *imgp,
+ unsigned int *cs_flags, unsigned int *signer_type,
+ int flags);
int mac_vnode_check_stat(vfs_context_t ctx,
kauth_cred_t file_cred, struct vnode *vp);
+int mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp,
+ struct componentname *cnp);
int mac_vnode_check_truncate(vfs_context_t ctx,
kauth_cred_t file_cred, struct vnode *vp);
int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
struct componentname *cnp, struct vnode_attr *vap);
-int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp);
+int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so);
int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp);
int mac_vnode_check_write(vfs_context_t ctx,
const char *name);
int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
-void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
+void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name);
+void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
struct vnode *dvp, struct componentname *cnp);
void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
-void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
- struct vnode *dvp, struct componentname *cnp);
+void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
+ struct vnode *dvp, struct componentname *cnp);
+void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl);
+void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist);
+void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio);
+void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags);
+void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode);
+void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid);
+void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime);
+void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp);
int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho);
int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
struct componentname *cnp, int flags, vfs_context_t ctx);
void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
int mac_kext_check_load(kauth_cred_t cred, const char *identifier);
int mac_kext_check_unload(kauth_cred_t cred, const char *identifier);
+int mac_kext_check_query(kauth_cred_t cred);
+int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol);
+int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol);
void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
projects / apple / xnu.git / blobdiff