X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/6d2010ae8f7a6078e10b361c6962983bab233e0f..143464d58d2bd6378e74eec636961ceb0d32fb91:/security/mac_framework.h diff --git a/security/mac_framework.h b/security/mac_framework.h index 20780b249..777efd542 100644 --- a/security/mac_framework.h +++ b/security/mac_framework.h @@ -77,7 +77,9 @@ #error "no user-serviceable parts inside" #endif -#if CONFIG_MACF +#ifndef PRIVATE +#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" +#endif struct attrlist; struct auditinfo; @@ -114,14 +116,18 @@ struct socket; struct task; struct thread; struct timespec; +struct tty; struct ucred; struct uio; +struct uthread; struct vfs_attr; struct vfs_context; struct vnode; struct vnode_attr; struct vop_setlabel_args; +#if CONFIG_MACF + #ifndef __IOKIT_PORTS_DEFINED__ #define __IOKIT_PORTS_DEFINED__ #ifdef __cplusplus @@ -155,8 +161,8 @@ void mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d); int mac_cred_check_label_update(kauth_cred_t cred, struct label *newlabel); int mac_cred_check_label_update_execve(vfs_context_t ctx, - struct vnode *vp, struct label *scriptvnodelabel, - struct label *execlabel, proc_t proc); + struct vnode *vp, struct vnode *scriptvp, struct label *scriptvnodelabel, + struct label *execlabel, proc_t proc, void *macextensions); int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2); struct label *mac_cred_label_alloc(void); void mac_cred_label_associate(kauth_cred_t cred_parent, @@ -168,10 +174,11 @@ void mac_cred_label_destroy(kauth_cred_t cred); int mac_cred_label_externalize_audit(proc_t p, struct mac *mac); void mac_cred_label_free(struct label *label); void mac_cred_label_init(kauth_cred_t cred); +int mac_cred_label_compare(struct label *a, struct label *b); void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel); int mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred, - struct vnode *vp, struct label *scriptvnodelabel, - struct label *execlabel); + struct vnode *vp, struct vnode *scriptvp, struct label *scriptvnodelabel, + struct label *execlabel, void *macextensions); void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, const char *fullpath); void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, @@ -310,7 +317,8 @@ void mac_posixsem_label_init(struct pseminfo *psem); int mac_posixshm_check_create(kauth_cred_t cred, const char *name); int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm, int prot, int flags); -int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm); +int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm, + int fflags); int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm); int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm, off_t s); @@ -326,6 +334,8 @@ void mac_posixshm_label_init(struct pshminfo *pshm); int mac_priv_check(kauth_cred_t cred, int priv); int mac_priv_grant(kauth_cred_t cred, int priv); int mac_proc_check_debug(proc_t proc1, proc_t proc2); +int mac_proc_check_cpumon(proc_t curp); +int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor); int mac_proc_check_fork(proc_t proc); int mac_proc_check_suspend_resume(proc_t proc, int sr); int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p); @@ -334,6 +344,7 @@ int mac_proc_check_getaudit(proc_t proc); int mac_proc_check_getauid(proc_t proc); int mac_proc_check_getlcid(proc_t proc1, proc_t proc2, pid_t pid); +int mac_proc_check_ledger(proc_t curp, proc_t target, int op); int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr, user_size_t u_size, int prot, int flags, int *maxprot); int mac_proc_check_mprotect(proc_t proc, @@ -393,6 +404,7 @@ int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp); int mac_system_check_auditon(kauth_cred_t cred, int cmd); int mac_system_check_chud(kauth_cred_t cred); int mac_system_check_host_priv(kauth_cred_t cred); +int mac_system_check_info(kauth_cred_t, const char *info_type); int mac_system_check_nfsd(kauth_cred_t cred); int mac_system_check_reboot(kauth_cred_t cred, int howto); int mac_system_check_settime(kauth_cred_t cred); @@ -401,6 +413,7 @@ int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp); int mac_system_check_sysctl(kauth_cred_t cred, int *name, u_int namelen, user_addr_t oldctl, user_addr_t oldlenp, int inkernel, user_addr_t newctl, size_t newlen); +int mac_system_check_kas_info(kauth_cred_t cred, int selector); void mac_sysvmsg_label_associate(kauth_cred_t cred, struct msqid_kernel *msqptr, struct msg *msgptr); void mac_sysvmsg_label_init(struct msg *msgptr); @@ -445,6 +458,10 @@ void mac_sysvshm_label_associate(kauth_cred_t cred, void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr); void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr); void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr); +struct label * mac_thread_label_alloc(void); +void mac_thread_label_destroy(struct uthread *uthread); +void mac_thread_label_free(struct label *label); +void mac_thread_label_init(struct uthread *uthread); int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, int acc_mode); int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp); @@ -459,8 +476,8 @@ int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, struct image_params *imgp); int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp); -int mac_vnode_check_signature(struct vnode *vp, unsigned char *sha1, - void * signature, size_t size); +int mac_vnode_check_signature(struct vnode *vp, off_t macho_offset, + unsigned char *sha1, void * signature, size_t size); int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, @@ -539,9 +556,17 @@ int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, struct vnode *dvp, struct componentname *cnp); +void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); +void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, + struct vnode *dvp, struct componentname *cnp); +int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho); int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, struct componentname *cnp, int flags, vfs_context_t ctx); void vnode_relabel(struct vnode *vp); +void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label); +void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label); +int mac_kext_check_load(kauth_cred_t cred, const char *identifier); +int mac_kext_check_unload(kauth_cred_t cred, const char *identifier); void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);