#error "no user-serviceable parts inside"
#endif
-#if CONFIG_MACF
+#ifndef PRIVATE
+#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
+#endif
struct attrlist;
struct auditinfo;
struct task;
struct thread;
struct timespec;
+struct tty;
struct ucred;
struct uio;
+struct uthread;
struct vfs_attr;
struct vfs_context;
struct vnode;
struct vnode_attr;
struct vop_setlabel_args;
-/*@ macros */
-#define VNODE_LABEL_CREATE 1
+#if CONFIG_MACF
-#if CONFIG_MACF_MACH
-#define mac_task_label_update_cred(cred, task) \
- mac_task_label_update_internal(((cred)->cr_label), task)
+#ifndef __IOKIT_PORTS_DEFINED__
+#define __IOKIT_PORTS_DEFINED__
+#ifdef __cplusplus
+class OSObject;
+typedef OSObject *io_object_t;
#else
-#define mac_task_label_update_cred(cred, task)
+struct OSObject;
+typedef struct OSObject *io_object_t;
#endif
+#endif /* __IOKIT_PORTS_DEFINED__ */
+
+/*@ macros */
+#define VNODE_LABEL_CREATE 1
/*@ === */
int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode,
int mac_cred_check_label_update(kauth_cred_t cred,
struct label *newlabel);
int mac_cred_check_label_update_execve(vfs_context_t ctx,
- struct vnode *vp, struct label *scriptvnodelabel,
- struct label *execlabel, proc_t proc);
+ struct vnode *vp, off_t offset, struct vnode *scriptvp,
+ struct label *scriptvnodelabel, struct label *execlabel,
+ proc_t proc, void *macextensions);
int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2);
struct label *mac_cred_label_alloc(void);
void mac_cred_label_associate(kauth_cred_t cred_parent,
int mac_cred_label_externalize_audit(proc_t p, struct mac *mac);
void mac_cred_label_free(struct label *label);
void mac_cred_label_init(kauth_cred_t cred);
+int mac_cred_label_compare(struct label *a, struct label *b);
void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
-int mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
- struct vnode *vp, struct label *scriptvnodelabel,
- struct label *execlabel);
+void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
+ struct vnode *vp, off_t offset, struct vnode *scriptvp,
+ struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags,
+ void *macextensions, int *disjoint, int *labelupdateerror);
void mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
const char *fullpath);
void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
void mac_inpcb_label_recycle(struct inpcb *inp);
void mac_inpcb_label_update(struct socket *so);
int mac_iokit_check_device(char *devtype, struct mac_module_data *mdata);
+int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type);
+int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties);
+int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry);
+int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name);
+int mac_iokit_check_hid_control(kauth_cred_t cred);
void mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq);
int mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq);
void mac_ipq_label_destroy(struct ipq *ipq);
int mac_posixshm_check_create(kauth_cred_t cred, const char *name);
int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm,
int prot, int flags);
-int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm);
+int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm,
+ int fflags);
int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm);
int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm,
- size_t s);
+ off_t s);
int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm,
const char *name);
void mac_posixshm_vnode_label_associate(kauth_cred_t cred,
struct pshminfo *pshm, const char *name);
void mac_posixshm_label_destroy(struct pshminfo *pshm);
void mac_posixshm_label_init(struct pshminfo *pshm);
+int mac_priv_check(kauth_cred_t cred, int priv);
+int mac_priv_grant(kauth_cred_t cred, int priv);
int mac_proc_check_debug(proc_t proc1, proc_t proc2);
+int mac_proc_check_cpumon(proc_t curp);
+int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);
int mac_proc_check_fork(proc_t proc);
int mac_proc_check_suspend_resume(proc_t proc, int sr);
int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
int mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
+int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp);
int mac_proc_check_getaudit(proc_t proc);
int mac_proc_check_getauid(proc_t proc);
int mac_proc_check_getlcid(proc_t proc1, proc_t proc2,
pid_t pid);
+int mac_proc_check_ledger(proc_t curp, proc_t target, int op);
+int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
+ user_size_t u_size, int prot, int flags, int *maxprot);
int mac_proc_check_mprotect(proc_t proc,
user_addr_t addr, user_size_t size, int prot);
int mac_proc_check_run_cs_invalid(proc_t proc);
int mac_system_check_audit(kauth_cred_t cred, void *record, int length);
int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp);
int mac_system_check_auditon(kauth_cred_t cred, int cmd);
+int mac_system_check_chud(kauth_cred_t cred);
int mac_system_check_host_priv(kauth_cred_t cred);
+int mac_system_check_info(kauth_cred_t, const char *info_type);
int mac_system_check_nfsd(kauth_cred_t cred);
int mac_system_check_reboot(kauth_cred_t cred, int howto);
int mac_system_check_settime(kauth_cred_t cred);
int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp);
int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp);
-int mac_system_check_sysctl(kauth_cred_t cred, int *name,
- u_int namelen, user_addr_t oldctl, user_addr_t oldlenp, int inkernel,
- user_addr_t newctl, size_t newlen);
+int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name,
+ u_int namelen, user_addr_t oldctl, size_t oldlen,
+ user_addr_t newctl, size_t newlen);
+int mac_system_check_kas_info(kauth_cred_t cred, int selector);
void mac_sysvmsg_label_associate(kauth_cred_t cred,
struct msqid_kernel *msqptr, struct msg *msgptr);
void mac_sysvmsg_label_init(struct msg *msgptr);
void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr);
void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr);
void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr);
-void mac_thread_userret(int code, int error, struct thread *thread);
+struct label * mac_thread_label_alloc(void);
+void mac_thread_label_destroy(struct uthread *uthread);
+void mac_thread_label_free(struct label *label);
+void mac_thread_label_init(struct uthread *uthread);
int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
int acc_mode);
int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp);
struct vnode *v2);
int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
struct image_params *imgp);
-int mac_vnode_check_signature(struct vnode *vp, unsigned char *sha1,
- void * signature, size_t size);
+int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);
+int mac_vnode_check_signature(struct vnode *vp, off_t macho_offset,
+ unsigned char *sha1, const void * signature, size_t size,
+ int *is_platform_binary);
int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
struct attrlist *alist);
int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
kauth_cred_t file_cred, struct vnode *vp);
int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp);
int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp);
-int mac_vnode_check_rename_from(vfs_context_t ctx, struct vnode *dvp,
- struct vnode *vp, struct componentname *cnp);
-int mac_vnode_check_rename_to(vfs_context_t ctx, struct vnode *dvp,
- struct vnode *vp, int samedir, struct componentname *cnp);
+int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp,
+ struct vnode *vp, struct componentname *cnp, struct vnode *tdvp,
+ struct vnode *tvp, struct componentname *tcnp);
int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp);
+int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp,
+ struct attrlist *alist);
int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp,
int which);
int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp,
const char *name);
int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
+void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
+ struct vnode *dvp, struct componentname *cnp);
+void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
+void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
+ struct vnode *dvp, struct componentname *cnp);
+int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho);
int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
struct componentname *cnp, int flags, vfs_context_t ctx);
void vnode_relabel(struct vnode *vp);
+void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
+void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
+int mac_kext_check_load(kauth_cred_t cred, const char *identifier);
+int mac_kext_check_unload(kauth_cred_t cred, const char *identifier);
void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
projects / apple / xnu.git / blobdiff