X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/316670eb35587141e969394ae8537d66b9211e80..143464d58d2bd6378e74eec636961ceb0d32fb91:/security/mac_framework.h

diff --git a/security/mac_framework.h b/security/mac_framework.h
index 7d0f15a10..777efd542 100644
--- a/security/mac_framework.h
+++ b/security/mac_framework.h
@@ -77,7 +77,9 @@
 #error "no user-serviceable parts inside"
 #endif
 
-#if CONFIG_MACF
+#ifndef PRIVATE
+#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
+#endif
 
 struct attrlist;
 struct auditinfo;
@@ -114,6 +116,7 @@ struct socket;
 struct task;
 struct thread;
 struct timespec;
+struct tty;
 struct ucred;
 struct uio;
 struct uthread;
@@ -123,6 +126,8 @@ struct vnode;
 struct vnode_attr;
 struct vop_setlabel_args;
 
+#if CONFIG_MACF
+
 #ifndef __IOKIT_PORTS_DEFINED__
 #define __IOKIT_PORTS_DEFINED__
 #ifdef __cplusplus
@@ -156,8 +161,8 @@ void	mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d);
 int	mac_cred_check_label_update(kauth_cred_t cred,
 	    struct label *newlabel);
 int	mac_cred_check_label_update_execve(vfs_context_t ctx,
-	    struct vnode *vp, struct label *scriptvnodelabel, 
-	    struct label *execlabel, proc_t proc);
+	    struct vnode *vp, struct vnode *scriptvp, struct label *scriptvnodelabel, 
+	    struct label *execlabel, proc_t proc, void *macextensions);
 int	mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2);
 struct label	*mac_cred_label_alloc(void);
 void	mac_cred_label_associate(kauth_cred_t cred_parent,
@@ -172,8 +177,8 @@ void	mac_cred_label_init(kauth_cred_t cred);
 int	mac_cred_label_compare(struct label *a, struct label *b);
 void	mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
 int	mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
-	    struct vnode *vp, struct label *scriptvnodelabel,
-	    struct label *execlabel);
+	    struct vnode *vp, struct vnode *scriptvp, struct label *scriptvnodelabel,
+	    struct label *execlabel, void *macextensions);
 void	mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
 	    const char *fullpath);
 void	mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
@@ -329,6 +334,8 @@ void	mac_posixshm_label_init(struct pshminfo *pshm);
 int	mac_priv_check(kauth_cred_t cred, int priv);
 int	mac_priv_grant(kauth_cred_t cred, int priv);
 int	mac_proc_check_debug(proc_t proc1, proc_t proc2);
+int	mac_proc_check_cpumon(proc_t curp);
+int	mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);
 int	mac_proc_check_fork(proc_t proc);
 int	mac_proc_check_suspend_resume(proc_t proc, int sr);
 int	mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
@@ -397,6 +404,7 @@ int	mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp);
 int	mac_system_check_auditon(kauth_cred_t cred, int cmd);
 int	mac_system_check_chud(kauth_cred_t cred);
 int	mac_system_check_host_priv(kauth_cred_t cred);
+int	mac_system_check_info(kauth_cred_t, const char *info_type);
 int	mac_system_check_nfsd(kauth_cred_t cred);
 int	mac_system_check_reboot(kauth_cred_t cred, int howto);
 int	mac_system_check_settime(kauth_cred_t cred);
@@ -468,8 +476,8 @@ int	mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1,
 int	mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
 	    struct image_params *imgp);
 int	mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);
-int	mac_vnode_check_signature(struct vnode *vp, unsigned char *sha1,
-	    void * signature, size_t size);
+int	mac_vnode_check_signature(struct vnode *vp, off_t macho_offset,
+	    unsigned char *sha1, void * signature, size_t size);
 int     mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
 	    struct attrlist *alist);
 int	mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
@@ -548,9 +556,17 @@ int	mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
 	    struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
 void	mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
 	    struct vnode *dvp, struct componentname *cnp);
+void	mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
+void	mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
+			      struct vnode *dvp, struct componentname *cnp);
+int	mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho);
 int	vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
 	    struct componentname *cnp, int flags, vfs_context_t ctx);
 void	vnode_relabel(struct vnode *vp);
+void	mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
+void	mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
+int	mac_kext_check_load(kauth_cred_t cred, const char *identifier);
+int	mac_kext_check_unload(kauth_cred_t cred, const char *identifier);
 
 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);