X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/c18c124eaa464aaaa5549e99e5a70fc9cbb50944..4d15aeb193b2c68f1d38666c317f8d3734f5f083:/bsd/kern/policy_check.c

diff --git a/bsd/kern/policy_check.c b/bsd/kern/policy_check.c
index 95ae2d593..cbaf30ca4 100644
--- a/bsd/kern/policy_check.c
+++ b/bsd/kern/policy_check.c
@@ -118,7 +118,7 @@ common_hook(void)
 	return rv;
 }
 
-#if (MAC_POLICY_OPS_VERSION != 32)
+#if (MAC_POLICY_OPS_VERSION != 47)
 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 #endif
 /*
@@ -201,15 +201,16 @@ static struct mac_policy_ops policy_ops = {
 	CHECK_SET_HOOK(ipq_label_init)
 	CHECK_SET_HOOK(ipq_label_update)
 
-	CHECK_SET_HOOK(lctx_check_label_update)
-	CHECK_SET_HOOK(lctx_label_destroy)
-	CHECK_SET_HOOK(lctx_label_externalize)
-	CHECK_SET_HOOK(lctx_label_init)
-	CHECK_SET_HOOK(lctx_label_internalize)
-	CHECK_SET_HOOK(lctx_label_update)
-	CHECK_SET_HOOK(lctx_notify_create)
-	CHECK_SET_HOOK(lctx_notify_join)
-	CHECK_SET_HOOK(lctx_notify_leave)
+	CHECK_SET_HOOK(file_check_library_validation)
+
+	CHECK_SET_HOOK(vnode_notify_setacl)
+	CHECK_SET_HOOK(vnode_notify_setattrlist)
+	CHECK_SET_HOOK(vnode_notify_setextattr)
+	CHECK_SET_HOOK(vnode_notify_setflags)
+	CHECK_SET_HOOK(vnode_notify_setmode)
+	CHECK_SET_HOOK(vnode_notify_setowner)
+	CHECK_SET_HOOK(vnode_notify_setutimes)
+	CHECK_SET_HOOK(vnode_notify_truncate)
 
 	CHECK_SET_HOOK(mbuf_label_associate_bpfdesc)
 	CHECK_SET_HOOK(mbuf_label_associate_ifnet)
@@ -265,25 +266,26 @@ static struct mac_policy_ops policy_ops = {
 	CHECK_SET_HOOK(system_check_sysctlbyname)
 	CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
 	CHECK_SET_HOOK(vnode_check_rename)
+	CHECK_SET_HOOK(kext_check_query)
+	CHECK_SET_HOOK(iokit_check_nvram_get)
+	CHECK_SET_HOOK(iokit_check_nvram_set)
+	CHECK_SET_HOOK(iokit_check_nvram_delete)
+	CHECK_SET_HOOK(proc_check_expose_task)
+	CHECK_SET_HOOK(proc_check_set_host_special_port)
+	CHECK_SET_HOOK(proc_check_set_host_exception_port)
+	CHECK_SET_HOOK(exc_action_check_exception_send)
+	CHECK_SET_HOOK(exc_action_label_associate)
+	CHECK_SET_HOOK(exc_action_label_copy)
+	CHECK_SET_HOOK(exc_action_label_destroy)
+	CHECK_SET_HOOK(exc_action_label_init)
+	CHECK_SET_HOOK(exc_action_label_update)
+
+	.mpo_reserved1 = (mpo_reserved_hook_t *)common_hook,
+	.mpo_reserved2 = (mpo_reserved_hook_t *)common_hook,
+	.mpo_reserved3 = (mpo_reserved_hook_t *)common_hook,
 	.mpo_reserved4 = (mpo_reserved_hook_t *)common_hook,
 	.mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,
 	.mpo_reserved6 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved7 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved8 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved9 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved10 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved11 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved12 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved13 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved14 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved15 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved16 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved17 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved18 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved19 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved20 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved21 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved22 = (mpo_reserved_hook_t *)common_hook,
 
 	CHECK_SET_HOOK(posixsem_check_create)
 	CHECK_SET_HOOK(posixsem_check_open)
@@ -361,7 +363,7 @@ static struct mac_policy_ops policy_ops = {
 	CHECK_SET_HOOK(system_check_settime)
 	CHECK_SET_HOOK(system_check_swapoff)
 	CHECK_SET_HOOK(system_check_swapon)
-	.mpo_reserved31 = (mpo_reserved_hook_t *)common_hook,
+	.mpo_reserved7 = (mpo_reserved_hook_t *)common_hook,
 
 	CHECK_SET_HOOK(sysvmsg_label_associate)
 	CHECK_SET_HOOK(sysvmsg_label_destroy)
@@ -394,14 +396,14 @@ static struct mac_policy_ops policy_ops = {
 	CHECK_SET_HOOK(sysvshm_label_init)
 	CHECK_SET_HOOK(sysvshm_label_recycle)
 
-	.mpo_reserved23 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved24 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved25 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved26 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved27 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved28 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved29 = (mpo_reserved_hook_t *)common_hook,
-	.mpo_reserved30 = (mpo_reserved_hook_t *)common_hook,
+	.mpo_reserved8 = (mpo_reserved_hook_t *)common_hook,
+	CHECK_SET_HOOK(mount_check_snapshot_revert)
+	CHECK_SET_HOOK(vnode_check_getattr)
+	CHECK_SET_HOOK(mount_check_snapshot_create)
+	CHECK_SET_HOOK(mount_check_snapshot_delete)
+	CHECK_SET_HOOK(vnode_check_clone)
+	CHECK_SET_HOOK(proc_check_get_cs_info)
+	CHECK_SET_HOOK(proc_check_set_cs_info)
 
 	CHECK_SET_HOOK(iokit_check_hid_control)
 
@@ -461,8 +463,7 @@ static struct mac_policy_ops policy_ops = {
 	CHECK_SET_HOOK(vnode_check_uipc_bind)
 	CHECK_SET_HOOK(vnode_check_uipc_connect)
 
-	/* CHECK_SET_HOOK(proc_check_run_cs_invalid) */
-	.mpo_proc_check_run_cs_invalid = (mac_proc_check_run_cs_invalid_t *)common_hook,
+	CHECK_SET_HOOK(proc_check_run_cs_invalid)
 	CHECK_SET_HOOK(proc_check_suspend_resume)
 
 	CHECK_SET_HOOK(thread_userret)
@@ -486,8 +487,9 @@ static struct mac_policy_ops policy_ops = {
 
 	CHECK_SET_HOOK(vnode_notify_rename)
 
-	CHECK_SET_HOOK(thread_label_init)
-	CHECK_SET_HOOK(thread_label_destroy)
+	CHECK_SET_HOOK(vnode_check_setacl)
+
+	CHECK_SET_HOOK(vnode_notify_deleteextattr)
 
 	CHECK_SET_HOOK(system_check_kas_info)