X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/593a1d5fd87cdf5b46dd5fcb84467b432cea0f91..3e170ce000f1506b7b5d2c5c7faec85ceabb573d:/security/mac_framework.h diff --git a/security/mac_framework.h b/security/mac_framework.h index 58f3e2b33..23863c0ed 100644 --- a/security/mac_framework.h +++ b/security/mac_framework.h @@ -77,7 +77,9 @@ #error "no user-serviceable parts inside" #endif -#if CONFIG_MACF +#ifndef PRIVATE +#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" +#endif struct attrlist; struct auditinfo; @@ -92,9 +94,9 @@ struct ifnet; struct ifreq; struct image_params; struct inpcb; +struct ipc_port; struct ipq; struct knote; -struct lctx; struct m_tag; struct mac; struct mac_module_data; @@ -114,24 +116,34 @@ struct socket; struct task; struct thread; struct timespec; +struct tty; struct ucred; struct uio; +struct uthread; struct vfs_attr; struct vfs_context; struct vnode; struct vnode_attr; struct vop_setlabel_args; -/*@ macros */ -#define VNODE_LABEL_CREATE 1 -#define VNODE_LABEL_NEEDREF 2 +#include +#include + +#if CONFIG_MACF -#if CONFIG_MACF_MACH -#define mac_task_label_update_cred(cred, task) \ - mac_task_label_update_internal(((cred)->cr_label), task) +#ifndef __IOKIT_PORTS_DEFINED__ +#define __IOKIT_PORTS_DEFINED__ +#ifdef __cplusplus +class OSObject; +typedef OSObject *io_object_t; #else -#define mac_task_label_update_cred(cred, task) +struct OSObject; +typedef struct OSObject *io_object_t; #endif +#endif /* __IOKIT_PORTS_DEFINED__ */ + +/*@ macros */ +#define VNODE_LABEL_CREATE 1 /*@ === */ int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode, @@ -145,8 +157,9 @@ void mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d); int mac_cred_check_label_update(kauth_cred_t cred, struct label *newlabel); int mac_cred_check_label_update_execve(vfs_context_t ctx, - struct vnode *vp, struct label *scriptvnodelabel, - struct label *execlabel, proc_t proc); + struct vnode *vp, off_t offset, struct vnode *scriptvp, + struct label *scriptvnodelabel, struct label *execlabel, + proc_t proc, void *macextensions); int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2); struct label *mac_cred_label_alloc(void); void mac_cred_label_associate(kauth_cred_t cred_parent, @@ -158,10 +171,12 @@ void mac_cred_label_destroy(kauth_cred_t cred); int mac_cred_label_externalize_audit(proc_t p, struct mac *mac); void mac_cred_label_free(struct label *label); void mac_cred_label_init(kauth_cred_t cred); +int mac_cred_label_compare(struct label *a, struct label *b); void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel); void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred, - struct vnode *vp, struct label *scriptvnodelabel, - struct label *execlabel); + struct vnode *vp, off_t offset, struct vnode *scriptvp, + struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags, + void *macextensions, int *disjoint, int *labelupdateerror); void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, const char *fullpath); void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, @@ -186,7 +201,7 @@ int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg, int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op, struct flock *fl); int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg, - int prot, int flags, int *maxprot); + int prot, int flags, uint64_t file_pos, int *maxprot); void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg, int *prot); int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg); @@ -213,18 +228,19 @@ int mac_inpcb_label_init(struct inpcb *inp, int flag); void mac_inpcb_label_recycle(struct inpcb *inp); void mac_inpcb_label_update(struct socket *so); int mac_iokit_check_device(char *devtype, struct mac_module_data *mdata); +int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type); +int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties); +int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry); +int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name); +int mac_iokit_check_hid_control(kauth_cred_t cred); +int mac_iokit_check_nvram_delete(kauth_cred_t cred, const char *name); +int mac_iokit_check_nvram_get(kauth_cred_t cred, const char *name); +int mac_iokit_check_nvram_set(kauth_cred_t cred, const char *name, io_object_t value); void mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq); int mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq); void mac_ipq_label_destroy(struct ipq *ipq); int mac_ipq_label_init(struct ipq *ipq, int flag); void mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq); -struct label *mac_lctx_label_alloc(void); -void mac_lctx_label_free(struct label *label); -void mac_lctx_label_update(struct lctx *l, struct label *newlabel); -int mac_lctx_check_label_update(struct lctx *l, struct label *newlabel); -void mac_lctx_notify_create(proc_t proc, struct lctx *l); -void mac_lctx_notify_join(proc_t proc, struct lctx *l); -void mac_lctx_notify_leave(proc_t proc, struct lctx *l); void mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); void mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m); void mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m); @@ -297,10 +313,11 @@ void mac_posixsem_label_init(struct pseminfo *psem); int mac_posixshm_check_create(kauth_cred_t cred, const char *name); int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm, int prot, int flags); -int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm); +int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm, + int fflags); int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm); int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm, - size_t s); + off_t s); int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm, const char *name); void mac_posixshm_vnode_label_associate(kauth_cred_t cred, @@ -310,19 +327,29 @@ void mac_posixshm_label_associate(kauth_cred_t cred, struct pshminfo *pshm, const char *name); void mac_posixshm_label_destroy(struct pshminfo *pshm); void mac_posixshm_label_init(struct pshminfo *pshm); +int mac_priv_check(kauth_cred_t cred, int priv); +int mac_priv_grant(kauth_cred_t cred, int priv); int mac_proc_check_debug(proc_t proc1, proc_t proc2); +int mac_proc_check_cpumon(proc_t curp); +int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor); int mac_proc_check_fork(proc_t proc); +int mac_proc_check_suspend_resume(proc_t proc, int sr); int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p); int mac_proc_check_get_task(kauth_cred_t cred, struct proc *p); +int mac_proc_check_expose_task(kauth_cred_t cred, struct proc *p); +int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp); int mac_proc_check_getaudit(proc_t proc); int mac_proc_check_getauid(proc_t proc); int mac_proc_check_getlcid(proc_t proc1, proc_t proc2, pid_t pid); -int mac_proc_check_map_prot_copy_allow(proc_t proc); +int mac_proc_check_ledger(proc_t curp, proc_t target, int op); +int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr, + user_size_t u_size, int prot, int flags, int *maxprot); int mac_proc_check_mprotect(proc_t proc, user_addr_t addr, user_size_t size, int prot); +int mac_proc_check_run_cs_invalid(proc_t proc); int mac_proc_check_sched(proc_t proc, proc_t proc2); -int mac_proc_check_setaudit(proc_t proc, struct auditinfo *ai); +int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai); int mac_proc_check_setauid(proc_t proc, uid_t auid); int mac_proc_check_setlcid(proc_t proc1, proc_t proc2, pid_t pid1, pid_t pid2); @@ -373,15 +400,18 @@ int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp); int mac_system_check_audit(kauth_cred_t cred, void *record, int length); int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp); int mac_system_check_auditon(kauth_cred_t cred, int cmd); +int mac_system_check_chud(kauth_cred_t cred); int mac_system_check_host_priv(kauth_cred_t cred); +int mac_system_check_info(kauth_cred_t, const char *info_type); int mac_system_check_nfsd(kauth_cred_t cred); int mac_system_check_reboot(kauth_cred_t cred, int howto); int mac_system_check_settime(kauth_cred_t cred); int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp); int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp); -int mac_system_check_sysctl(kauth_cred_t cred, int *name, - u_int namelen, user_addr_t oldctl, user_addr_t oldlenp, int inkernel, - user_addr_t newctl, size_t newlen); +int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name, + u_int namelen, user_addr_t oldctl, size_t oldlen, + user_addr_t newctl, size_t newlen); +int mac_system_check_kas_info(kauth_cred_t cred, int selector); void mac_sysvmsg_label_associate(kauth_cred_t cred, struct msqid_kernel *msqptr, struct msg *msgptr); void mac_sysvmsg_label_init(struct msg *msgptr); @@ -426,7 +456,6 @@ void mac_sysvshm_label_associate(kauth_cred_t cred, void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr); void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr); void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr); -void mac_thread_userret(int code, int error, struct thread *thread); int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, int acc_mode); int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp); @@ -440,8 +469,10 @@ int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, struct vnode *v2); int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, struct image_params *imgp); -int mac_vnode_check_signature(struct vnode *vp, unsigned char *sha1, - void * signature, size_t size); +int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp); +int mac_vnode_check_signature(struct vnode *vp, off_t macho_offset, + unsigned char *sha1, const void * signature, size_t size, + int flags, int *is_platform_binary); int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, @@ -463,11 +494,12 @@ int mac_vnode_check_read(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp); int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp); -int mac_vnode_check_rename_from(vfs_context_t ctx, struct vnode *dvp, - struct vnode *vp, struct componentname *cnp); -int mac_vnode_check_rename_to(vfs_context_t ctx, struct vnode *dvp, - struct vnode *vp, int samedir, struct componentname *cnp); +int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp, struct vnode *tdvp, + struct vnode *tvp, struct componentname *tcnp); int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp); +int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, + struct attrlist *alist); int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, int which); int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp, @@ -486,6 +518,9 @@ int mac_vnode_check_stat(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); int mac_vnode_check_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); +int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, + struct componentname *cnp, struct vnode_attr *vap); +int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp); int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_vnode_check_write(vfs_context_t ctx, @@ -505,6 +540,7 @@ void mac_vnode_label_destroy(struct vnode *vp); int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac); void mac_vnode_label_free(struct label *label); void mac_vnode_label_init(struct vnode *vp); +int mac_vnode_label_init_needed(struct vnode *vp); void mac_vnode_label_recycle(struct vnode *vp); void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, struct label *newlabel); @@ -512,9 +548,20 @@ void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, const char *name); int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); +void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, + struct vnode *dvp, struct componentname *cnp); +void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); +void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, + struct vnode *dvp, struct componentname *cnp); +int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho); int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, struct componentname *cnp, int flags, vfs_context_t ctx); void vnode_relabel(struct vnode *vp); +void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label); +void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label); +int mac_kext_check_load(kauth_cred_t cred, const char *identifier); +int mac_kext_check_unload(kauth_cred_t cred, const char *identifier); +int mac_kext_check_query(kauth_cred_t cred); void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);