X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/7e41aa883dd258f888d0470250eead40a53ef1f5..cc8bc92ae4a8e9f1a1ab61bf83d34ad8150b3405:/security/mac_framework.h?ds=inline diff --git a/security/mac_framework.h b/security/mac_framework.h index b9973b2a6..b5560a320 100644 --- a/security/mac_framework.h +++ b/security/mac_framework.h @@ -2,7 +2,7 @@ * Copyright (c) 2007 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ - * + * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in @@ -11,10 +11,10 @@ * unlawful or unlicensed copies of an Apple operating system, or to * circumvent, violate, or enable the circumvention or violation of, any * terms of an Apple operating system software license agreement. - * + * * Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this file. - * + * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, @@ -22,7 +22,7 @@ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. - * + * * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ /*- @@ -85,7 +85,9 @@ struct attrlist; struct auditinfo; struct bpf_d; struct componentname; +struct cs_blob; struct devnode; +struct exception_action; struct flock; struct fdescnode; struct fileglob; @@ -200,6 +202,9 @@ int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg, unsigned int cmd); int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op, struct flock *fl); +int mac_file_check_library_validation(struct proc *proc, + struct fileglob *fg, off_t slice_offset, + user_long_t error_message, size_t error_message_size); int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg, int prot, int flags, uint64_t file_pos, int *maxprot); void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg, @@ -264,6 +269,12 @@ int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp); int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, struct componentname *cnp, const char *vfc_name); +int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp, + const char *name); +int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp, + const char *name); +int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp, + const char *name); int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp); int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, struct vfs_attr *vfa); @@ -330,7 +341,6 @@ void mac_posixshm_label_init(struct pshminfo *pshm); int mac_priv_check(kauth_cred_t cred, int priv); int mac_priv_grant(kauth_cred_t cred, int priv); int mac_proc_check_debug(proc_t proc1, proc_t proc2); -int mac_proc_check_cpumon(proc_t curp); int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor); int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op); int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op); @@ -358,7 +368,7 @@ int mac_proc_check_setlcid(proc_t proc1, proc_t proc2, int mac_proc_check_signal(proc_t proc1, proc_t proc2, int signum); int mac_proc_check_wait(proc_t proc1, proc_t proc2); -void mac_proc_set_enforce(proc_t p, int enforce_flags); +void mac_proc_notify_exit(proc_t proc); int mac_setsockopt_label(kauth_cred_t cred, struct socket *so, struct mac *extmac); int mac_socket_check_accept(kauth_cred_t cred, struct socket *so); @@ -370,11 +380,13 @@ int mac_socket_check_connect(kauth_cred_t cred, struct socket *so, int mac_socket_check_create(kauth_cred_t cred, int domain, int type, int protocol); int mac_socket_check_deliver(struct socket *so, struct mbuf *m); +int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so, + unsigned int cmd); int mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn, struct socket *so); int mac_socket_check_listen(kauth_cred_t cred, struct socket *so); int mac_socket_check_receive(kauth_cred_t cred, struct socket *so); -int mac_socket_check_received(kauth_cred_t cred, struct socket *so, +int mac_socket_check_received(kauth_cred_t cred, struct socket *so, struct sockaddr *saddr); int mac_socket_check_select(kauth_cred_t cred, struct socket *so, int which); @@ -463,6 +475,8 @@ int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp); int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, struct componentname *cnp); +int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp); int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, struct componentname *cnp, struct vnode_attr *vap); int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, @@ -472,9 +486,8 @@ int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, struct image_params *imgp); int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp); -int mac_vnode_check_signature(struct vnode *vp, off_t macho_offset, - unsigned char *sha1, const void * signature, size_t size, - int flags, int *is_platform_binary); +int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred, + struct vnode *vp, struct vnode_attr *va); int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, @@ -490,6 +503,8 @@ int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp); int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, struct componentname *cnp); +int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp, + const char *path, size_t pathlen); int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, int acc_mode); int mac_vnode_check_read(vfs_context_t ctx, @@ -504,6 +519,8 @@ int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, int which); +int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, + struct kauth_acl *acl); int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp, struct attrlist *alist); int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, @@ -516,13 +533,17 @@ int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid); int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime); +int mac_vnode_check_signature(struct vnode *vp, + struct cs_blob *cs_blob, struct image_params *imgp, + unsigned int *cs_flags, unsigned int *signer_type, + int flags); int mac_vnode_check_stat(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); int mac_vnode_check_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, struct componentname *cnp, struct vnode_attr *vap); -int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp); +int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so); int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_vnode_check_write(vfs_context_t ctx, @@ -550,11 +571,20 @@ void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, const char *name); int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); -void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, +void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name); +void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, struct vnode *dvp, struct componentname *cnp); void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); -void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, - struct vnode *dvp, struct componentname *cnp); +void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, + struct vnode *dvp, struct componentname *cnp); +void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl); +void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); +void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio); +void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags); +void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode); +void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid); +void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime); +void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho); int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, struct componentname *cnp, int flags, vfs_context_t ctx); @@ -564,6 +594,8 @@ void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *lab int mac_kext_check_load(kauth_cred_t cred, const char *identifier); int mac_kext_check_unload(kauth_cred_t cred, const char *identifier); int mac_kext_check_query(kauth_cred_t cred); +int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol); +int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol); void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);