#include <sys/param.h>
-#include <sys/systm.h> /* XXX printf() */
+#include <sys/systm.h> /* XXX printf() */
#include <sys/types.h>
#include <sys/fcntl.h>
#include <security/mac.h>
#include <security/mac_policy.h>
-#include <libkern/OSDebug.h> /* OSBPrintBacktrace */
+#include <libkern/section_keywords.h>
+#include <libkern/OSDebug.h> /* OSBPrintBacktrace */
/* forward declaration; see bsd_init.c */
* Note: CHECK_POLICY_CHECK is probably not very useful unless you
* are kernel debugging and set a breakpoint.
*/
-#define CHECK_POLICY_CHECK 0x00000001 /* Check on calls */
-#define CHECK_POLICY_FAIL 0x00000002 /* EPERM on fails */
-#define CHECK_POLICY_BACKTRACE 0x00000004 /* Show call stack on fails */
-#define CHECK_POLICY_PANIC 0x00000008 /* Panic on fails */
-#define CHECK_POLICY_PERIODIC 0x00000010 /* Show fails periodically */
+#define CHECK_POLICY_CHECK 0x00000001 /* Check on calls */
+#define CHECK_POLICY_FAIL 0x00000002 /* EPERM on fails */
+#define CHECK_POLICY_BACKTRACE 0x00000004 /* Show call stack on fails */
+#define CHECK_POLICY_PANIC 0x00000008 /* Panic on fails */
+#define CHECK_POLICY_PERIODIC 0x00000010 /* Show fails periodically */
static int policy_flags = 0;
-#define CHECK_SET_HOOK(x) .mpo_##x = (mpo_##x##_t *)common_hook,
+#define CHECK_SET_HOOK(x) .mpo_##x = (mpo_##x##_t *)common_hook,
/*
* Init; currently, we only print our arrival notice.
/* Implementation */
-#define CLASS_PERIOD_LIMIT 10000
-#define CLASS_PERIOD_MULT 20
+#define CLASS_PERIOD_LIMIT 10000
+#define CLASS_PERIOD_MULT 20
static int policy_check_event = 1;
static int policy_check_period = 1;
static int
common_hook(void)
{
- int i;
- int rv = 0;
+ int i;
+ int rv = 0;
if ((i = get_thread_lock_count(current_thread())) != 0) {
/*
* fail the MACF check if we hold a lock; this assumes a
* a non-void (authorization) MACF hook.
*/
- if (policy_flags & CHECK_POLICY_FAIL)
+ if (policy_flags & CHECK_POLICY_FAIL) {
rv = EPERM;
+ }
/*
* display a backtrace if we hold a lock and we are not
*/
if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) {
if (policy_flags & CHECK_POLICY_PERIODIC) {
- /* at exponentially increasing intervals */
- if (!(policy_check_event % policy_check_period)) {
- if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
- /*
- * According to Derek, we could
- * technically get a symbolicated name
- * here, if we refactered some code
- * and set the "keepsyms=1" boot
- * argument...
- */
- OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
- }
- } else {
- if (policy_check_period < CLASS_PERIOD_LIMIT) {
- policy_check_next *= CLASS_PERIOD_MULT;
- policy_check_period *= CLASS_PERIOD_MULT;
+ /* at exponentially increasing intervals */
+ if (!(policy_check_event % policy_check_period)) {
+ if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
+ /*
+ * According to Derek, we could
+ * technically get a symbolicated name
+ * here, if we refactered some code
+ * and set the "keepsyms=1" boot
+ * argument...
+ */
+ OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
+ }
+ } else {
+ if (policy_check_period < CLASS_PERIOD_LIMIT) {
+ policy_check_next *= CLASS_PERIOD_MULT;
+ policy_check_period *= CLASS_PERIOD_MULT;
+ }
}
- }
} else {
/* always */
OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
}
/* Panic */
- if (policy_flags & CHECK_POLICY_PANIC)
+ if (policy_flags & CHECK_POLICY_PANIC) {
panic("calling MACF hook with mutex count %d\n", i);
+ }
/* count for non-fatal tracing */
policy_check_event++;
return rv;
}
-#if (MAC_POLICY_OPS_VERSION != 32)
+#if (MAC_POLICY_OPS_VERSION != 58)
# error "struct mac_policy_ops doesn't match definition in mac_policy.h"
#endif
/*
* Please note that this struct initialization should be kept in sync with
* security/mac_policy.h (mac_policy_ops struct definition).
*/
-static struct mac_policy_ops policy_ops = {
+const static struct mac_policy_ops policy_ops = {
CHECK_SET_HOOK(audit_check_postselect)
CHECK_SET_HOOK(audit_check_preselect)
CHECK_SET_HOOK(ipq_label_init)
CHECK_SET_HOOK(ipq_label_update)
- CHECK_SET_HOOK(lctx_check_label_update)
- CHECK_SET_HOOK(lctx_label_destroy)
- CHECK_SET_HOOK(lctx_label_externalize)
- CHECK_SET_HOOK(lctx_label_init)
- CHECK_SET_HOOK(lctx_label_internalize)
- CHECK_SET_HOOK(lctx_label_update)
- CHECK_SET_HOOK(lctx_notify_create)
- CHECK_SET_HOOK(lctx_notify_join)
- CHECK_SET_HOOK(lctx_notify_leave)
+ CHECK_SET_HOOK(file_check_library_validation)
+
+ CHECK_SET_HOOK(vnode_notify_setacl)
+ CHECK_SET_HOOK(vnode_notify_setattrlist)
+ CHECK_SET_HOOK(vnode_notify_setextattr)
+ CHECK_SET_HOOK(vnode_notify_setflags)
+ CHECK_SET_HOOK(vnode_notify_setmode)
+ CHECK_SET_HOOK(vnode_notify_setowner)
+ CHECK_SET_HOOK(vnode_notify_setutimes)
+ CHECK_SET_HOOK(vnode_notify_truncate)
CHECK_SET_HOOK(mbuf_label_associate_bpfdesc)
CHECK_SET_HOOK(mbuf_label_associate_ifnet)
CHECK_SET_HOOK(system_check_sysctlbyname)
CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
CHECK_SET_HOOK(vnode_check_rename)
+ CHECK_SET_HOOK(kext_check_query)
+ CHECK_SET_HOOK(proc_notify_exec_complete)
.mpo_reserved4 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved6 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved7 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved8 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved9 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved10 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved11 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved12 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved13 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved14 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved15 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved16 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved17 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved18 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved19 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved20 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved21 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved22 = (mpo_reserved_hook_t *)common_hook,
+ CHECK_SET_HOOK(proc_check_syscall_unix)
+ CHECK_SET_HOOK(proc_check_expose_task)
+ CHECK_SET_HOOK(proc_check_set_host_special_port)
+ CHECK_SET_HOOK(proc_check_set_host_exception_port)
+ CHECK_SET_HOOK(exc_action_check_exception_send)
+ CHECK_SET_HOOK(exc_action_label_associate)
+ CHECK_SET_HOOK(exc_action_label_populate)
+ CHECK_SET_HOOK(exc_action_label_destroy)
+ CHECK_SET_HOOK(exc_action_label_init)
+ CHECK_SET_HOOK(exc_action_label_update)
+
+ CHECK_SET_HOOK(vnode_check_trigger_resolve)
+ CHECK_SET_HOOK(mount_check_mount_late)
+ .mpo_reserved1 = (mpo_reserved_hook_t *)common_hook,
+ .mpo_reserved2 = (mpo_reserved_hook_t *)common_hook,
+ CHECK_SET_HOOK(skywalk_flow_check_connect)
+ CHECK_SET_HOOK(skywalk_flow_check_listen)
CHECK_SET_HOOK(posixsem_check_create)
CHECK_SET_HOOK(posixsem_check_open)
CHECK_SET_HOOK(proc_check_setlcid)
CHECK_SET_HOOK(proc_check_signal)
CHECK_SET_HOOK(proc_check_wait)
- CHECK_SET_HOOK(proc_label_destroy)
- CHECK_SET_HOOK(proc_label_init)
+
+ .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,
+ .mpo_reserved6 = (mpo_reserved_hook_t *)common_hook,
CHECK_SET_HOOK(socket_check_accept)
CHECK_SET_HOOK(socket_check_accepted)
CHECK_SET_HOOK(system_check_settime)
CHECK_SET_HOOK(system_check_swapoff)
CHECK_SET_HOOK(system_check_swapon)
- .mpo_reserved31 = (mpo_reserved_hook_t *)common_hook,
+ CHECK_SET_HOOK(socket_check_ioctl)
CHECK_SET_HOOK(sysvmsg_label_associate)
CHECK_SET_HOOK(sysvmsg_label_destroy)
CHECK_SET_HOOK(sysvshm_label_init)
CHECK_SET_HOOK(sysvshm_label_recycle)
- .mpo_reserved23 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved24 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved25 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved26 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved27 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved28 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved29 = (mpo_reserved_hook_t *)common_hook,
- .mpo_reserved30 = (mpo_reserved_hook_t *)common_hook,
+ CHECK_SET_HOOK(proc_notify_exit)
+ CHECK_SET_HOOK(mount_check_snapshot_revert)
+ CHECK_SET_HOOK(vnode_check_getattr)
+ CHECK_SET_HOOK(mount_check_snapshot_create)
+ CHECK_SET_HOOK(mount_check_snapshot_delete)
+ CHECK_SET_HOOK(vnode_check_clone)
+ CHECK_SET_HOOK(proc_check_get_cs_info)
+ CHECK_SET_HOOK(proc_check_set_cs_info)
CHECK_SET_HOOK(iokit_check_hid_control)
CHECK_SET_HOOK(vnode_check_uipc_bind)
CHECK_SET_HOOK(vnode_check_uipc_connect)
- /* CHECK_SET_HOOK(proc_check_run_cs_invalid) */
- .mpo_proc_check_run_cs_invalid = (mac_proc_check_run_cs_invalid_t *)common_hook,
+ CHECK_SET_HOOK(proc_check_run_cs_invalid)
CHECK_SET_HOOK(proc_check_suspend_resume)
CHECK_SET_HOOK(thread_userret)
CHECK_SET_HOOK(iokit_check_set_properties)
- CHECK_SET_HOOK(system_check_chud)
+ .mpo_reserved3 = (mpo_reserved_hook_t *)common_hook,
CHECK_SET_HOOK(vnode_check_searchfs)
CHECK_SET_HOOK(vnode_notify_rename)
- CHECK_SET_HOOK(thread_label_init)
- CHECK_SET_HOOK(thread_label_destroy)
+ CHECK_SET_HOOK(vnode_check_setacl)
+
+ CHECK_SET_HOOK(vnode_notify_deleteextattr)
CHECK_SET_HOOK(system_check_kas_info)
- CHECK_SET_HOOK(proc_check_cpumon)
+ CHECK_SET_HOOK(vnode_check_lookup_preflight)
CHECK_SET_HOOK(vnode_notify_open)
/*
* Policy definition
*/
-static struct mac_policy_conf policy_conf = {
+static SECURITY_READ_ONLY_LATE(struct mac_policy_conf) policy_conf = {
.mpc_name = "CHECK",
.mpc_fullname = "Check Assumptions Policy",
- .mpc_field_off = NULL, /* no label slot */
- .mpc_labelnames = NULL, /* no policy label names */
- .mpc_labelname_count = 0, /* count of label names is 0 */
- .mpc_ops = &policy_ops, /* policy operations */
+ .mpc_field_off = NULL, /* no label slot */
+ .mpc_labelnames = NULL, /* no policy label names */
+ .mpc_labelname_count = 0, /* count of label names is 0 */
+ .mpc_ops = &policy_ops, /* policy operations */
.mpc_loadtime_flags = 0,
.mpc_runtime_flags = 0,
};
-static mac_policy_handle_t policy_handle;
+static SECURITY_READ_ONLY_LATE(mac_policy_handle_t) policy_handle;
/*
* Init routine; for a loadable policy, this would be called during the KEXT
check_policy_init(int flags)
{
/* Only instantiate the module if we have been asked to do checking */
- if (!flags)
+ if (!flags) {
return 0;
+ }
policy_flags = flags;
projects / apple / xnu.git / blobdiff