X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/c6bf4f310a33a9262d455ea4d3f0630b1255e3fe..f427ee49d309d8fc33ebf3042c3a775f2f530ded:/security/mac_framework.h

diff --git a/security/mac_framework.h b/security/mac_framework.h
index e8c27a348..5a30437a0 100644
--- a/security/mac_framework.h
+++ b/security/mac_framework.h
@@ -83,7 +83,6 @@
 
 struct attrlist;
 struct auditinfo;
-struct bpf_d;
 struct componentname;
 struct cs_blob;
 struct devnode;
@@ -92,17 +91,11 @@ struct flock;
 struct fdescnode;
 struct fileglob;
 struct fileproc;
-struct ifnet;
 struct ifreq;
 struct image_params;
-struct inpcb;
 struct ipc_port;
-struct ipq;
 struct knote;
-struct m_tag;
 struct mac;
-struct mac_module_data;
-struct mbuf;
 struct msg;
 struct msqid_kernel;
 struct mount;
@@ -152,10 +145,6 @@ int     mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode,
     void *args, int error, int retval, int mac_forced);
 int     mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode,
     void *args);
-int     mac_bpfdesc_check_receive(struct bpf_d *bpf_d, struct ifnet *ifp);
-void    mac_bpfdesc_label_destroy(struct bpf_d *bpf_d);
-void    mac_bpfdesc_label_init(struct bpf_d *bpf_d);
-void    mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d);
 int     mac_cred_check_label_update(kauth_cred_t cred,
     struct label *newlabel);
 int     mac_cred_check_label_update_execve(vfs_context_t ctx,
@@ -195,11 +184,11 @@ int     mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd);
 int     mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd,
     user_long_t arg);
 int     mac_file_check_get(kauth_cred_t cred, struct fileglob *fg,
-    char *elements, int len);
+    char *elements, size_t len);
 int     mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg);
 int     mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg);
 int     mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg,
-    unsigned int cmd);
+    unsigned long cmd);
 int     mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op,
     struct flock *fl);
 int     mac_file_check_library_validation(struct proc *proc,
@@ -211,56 +200,20 @@ void    mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg,
     int *prot);
 int     mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg);
 int     mac_file_check_set(kauth_cred_t cred, struct fileglob *fg,
-    char *bufp, int buflen);
+    char *bufp, size_t buflen);
+void    mac_file_notify_close(struct ucred *cred, struct fileglob *fg);
 void    mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg);
 void    mac_file_label_destroy(struct fileglob *fg);
 void    mac_file_label_init(struct fileglob *fg);
-int     mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf,
-    int family, int type);
-void    mac_ifnet_label_associate(struct ifnet *ifp);
-void    mac_ifnet_label_destroy(struct ifnet *ifp);
-int     mac_ifnet_label_get(kauth_cred_t cred, struct ifreq *ifr,
-    struct ifnet *ifp);
-void    mac_ifnet_label_init(struct ifnet *ifp);
-void    mac_ifnet_label_recycle(struct ifnet *ifp);
-int     mac_ifnet_label_set(kauth_cred_t cred, struct ifreq *ifr,
-    struct ifnet *ifp);
-int     mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf,
-    int family, int type);
-void    mac_inpcb_label_associate(struct socket *so, struct inpcb *inp);
-void    mac_inpcb_label_destroy(struct inpcb *inp);
-int     mac_inpcb_label_init(struct inpcb *inp, int flag);
-void    mac_inpcb_label_recycle(struct inpcb *inp);
-void    mac_inpcb_label_update(struct socket *so);
-int     mac_iokit_check_device(char *devtype, struct mac_module_data *mdata);
 int     mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type);
 int     mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties);
 int     mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry);
 int     mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name);
+#ifdef KERNEL_PRIVATE
 int     mac_iokit_check_hid_control(kauth_cred_t cred);
-void    mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq);
-int     mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq);
-void    mac_ipq_label_destroy(struct ipq *ipq);
-int     mac_ipq_label_init(struct ipq *ipq, int flag);
-void    mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq);
-void    mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m);
-void    mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m);
-void    mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m);
-void    mac_mbuf_label_associate_ipq(struct ipq *ipq, struct mbuf *mbuf);
-void    mac_mbuf_label_associate_linklayer(struct ifnet *ifp, struct mbuf *m);
-void    mac_mbuf_label_associate_multicast_encap(struct mbuf *oldmbuf,
-    struct ifnet *ifp, struct mbuf *newmbuf);
-void    mac_mbuf_label_associate_netlayer(struct mbuf *oldmbuf,
-    struct mbuf *newmbuf);
-void    mac_mbuf_label_associate_socket(struct socket *so, struct mbuf *m);
-void    mac_mbuf_label_copy(struct mbuf *m_from, struct mbuf *m_to);
-void    mac_mbuf_label_destroy(struct mbuf *m);
-int     mac_mbuf_label_init(struct mbuf *m, int flag);
-void    mac_mbuf_tag_copy(struct m_tag *m, struct m_tag *mtag);
-void    mac_mbuf_tag_destroy(struct m_tag *mtag);
-int     mac_mbuf_tag_init(struct m_tag *, int how);
+#endif
 int     mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp,
-    unsigned int cmd);
+    unsigned long cmd);
 int     mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp,
     struct vfs_attr *vfa);
 int     mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp);
@@ -271,6 +224,11 @@ int     mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp,
     const char *name);
 int     mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp,
     const char *name);
+#ifdef KERNEL_PRIVATE
+int     mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp,
+    struct vnode *vp, struct componentname *cnp, const char *name,
+    const char *vfc_name);
+#endif
 int     mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp,
     const char *name);
 int     mac_mount_check_remount(vfs_context_t ctx, struct mount *mp);
@@ -285,11 +243,8 @@ int     mac_mount_label_externalize(struct label *label, char *elements,
 int     mac_mount_label_get(struct mount *mp, user_addr_t mac_p);
 void    mac_mount_label_init(struct mount *);
 int     mac_mount_label_internalize(struct label *, char *string);
-void    mac_netinet_fragment(struct mbuf *datagram, struct mbuf *fragment);
-void    mac_netinet_icmp_reply(struct mbuf *m);
-void    mac_netinet_tcp_reply(struct mbuf *m);
 int     mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe,
-    unsigned int cmd);
+    unsigned long cmd);
 int     mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn,
     struct pipe *cpipe);
 int     mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe);
@@ -299,12 +254,9 @@ int     mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe);
 int     mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe);
 struct label    *mac_pipe_label_alloc(void);
 void    mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe);
-void    mac_pipe_label_copy(struct label *src, struct label *dest);
 void    mac_pipe_label_destroy(struct pipe *cpipe);
 void    mac_pipe_label_free(struct label *label);
 void    mac_pipe_label_init(struct pipe *cpipe);
-int     mac_pipe_label_update(kauth_cred_t cred, struct pipe *cpipe,
-    struct label *label);
 void    mac_policy_initbsd(void);
 int     mac_posixsem_check_create(kauth_cred_t cred, const char *name);
 int     mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem);
@@ -338,16 +290,16 @@ void    mac_posixshm_label_destroy(struct pshminfo *pshm);
 void    mac_posixshm_label_init(struct pshminfo *pshm);
 int     mac_priv_check(kauth_cred_t cred, int priv);
 int     mac_priv_grant(kauth_cred_t cred, int priv);
-int     mac_proc_check_debug(proc_t proc1, proc_t proc2);
+int     mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident);
 int     mac_proc_check_dump_core(proc_t proc);
 int     mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);
 int     mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op);
 int     mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op);
 int     mac_proc_check_fork(proc_t proc);
 int     mac_proc_check_suspend_resume(proc_t proc, int sr);
-int     mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
-int     mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
-int     mac_proc_check_expose_task(kauth_cred_t cred, struct proc *p);
+int     mac_proc_check_get_task_name(kauth_cred_t cred, proc_ident_t pident);
+int     mac_proc_check_get_task(kauth_cred_t cred, proc_ident_t pident);
+int     mac_proc_check_expose_task(kauth_cred_t cred, proc_ident_t pident);
 int     mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp);
 int     mac_proc_check_getaudit(proc_t proc);
 int     mac_proc_check_getauid(proc_t proc);
@@ -359,6 +311,7 @@ int     mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
 int     mac_proc_check_mprotect(proc_t proc,
     user_addr_t addr, user_size_t size, int prot);
 int     mac_proc_check_run_cs_invalid(proc_t proc);
+void    mac_proc_notify_cs_invalidated(proc_t proc);
 int     mac_proc_check_sched(proc_t proc, proc_t proc2);
 int     mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai);
 int     mac_proc_check_setauid(proc_t proc, uid_t auid);
@@ -369,8 +322,6 @@ int     mac_proc_check_signal(proc_t proc1, proc_t proc2,
 int     mac_proc_check_syscall_unix(proc_t proc, int scnum);
 int     mac_proc_check_wait(proc_t proc1, proc_t proc2);
 void    mac_proc_notify_exit(proc_t proc);
-int     mac_setsockopt_label(kauth_cred_t cred, struct socket *so,
-    struct mac *extmac);
 int     mac_socket_check_accept(kauth_cred_t cred, struct socket *so);
 int     mac_socket_check_accepted(kauth_cred_t cred, struct socket *so);
 int     mac_socket_check_bind(kauth_cred_t cred, struct socket *so,
@@ -379,17 +330,12 @@ int     mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
     struct sockaddr *addr);
 int     mac_socket_check_create(kauth_cred_t cred, int domain,
     int type, int protocol);
-int     mac_socket_check_deliver(struct socket *so, struct mbuf *m);
 int     mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
-    unsigned int cmd);
-int     mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
-    struct socket *so);
+    unsigned long cmd);
 int     mac_socket_check_listen(kauth_cred_t cred, struct socket *so);
 int     mac_socket_check_receive(kauth_cred_t cred, struct socket *so);
 int     mac_socket_check_received(kauth_cred_t cred, struct socket *so,
     struct sockaddr *saddr);
-int     mac_socket_check_select(kauth_cred_t cred, struct socket *so,
-    int which);
 int     mac_socket_check_send(kauth_cred_t cred, struct socket *so,
     struct sockaddr *addr);
 int     mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
@@ -405,7 +351,6 @@ void    mac_socket_label_destroy(struct socket *);
 int     mac_socket_label_get(kauth_cred_t cred, struct socket *so,
     struct mac *extmac);
 int     mac_socket_label_init(struct socket *, int waitok);
-void    mac_socketpeer_label_associate_mbuf(struct mbuf *m, struct socket *so);
 void    mac_socketpeer_label_associate_socket(struct socket *peersocket,
     struct socket *socket_to_modify);
 int     mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so,
@@ -422,7 +367,7 @@ int     mac_system_check_settime(kauth_cred_t cred);
 int     mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp);
 int     mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp);
 int     mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name,
-    u_int namelen, user_addr_t oldctl, size_t oldlen,
+    size_t namelen, user_addr_t oldctl, size_t oldlen,
     user_addr_t newctl, size_t newlen);
 int     mac_system_check_kas_info(kauth_cred_t cred, int selector);
 void    mac_sysvmsg_label_associate(kauth_cred_t cred,
@@ -492,7 +437,7 @@ int     mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
 int     mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
     const char *name, struct uio *uio);
 int     mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp,
-    unsigned int cmd);
+    unsigned long cmd);
 int     mac_vnode_check_kqfilter(vfs_context_t ctx,
     kauth_cred_t file_cred, struct knote *kn, struct vnode *vp);
 int     mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp,
@@ -535,11 +480,16 @@ int     mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
 int     mac_vnode_check_signature(struct vnode *vp,
     struct cs_blob *cs_blob, struct image_params *imgp,
     unsigned int *cs_flags, unsigned int *signer_type,
-    int flags);
+    int flags, unsigned int platform);
+int     mac_vnode_check_supplemental_signature(struct vnode *vp,
+    struct cs_blob *cs_blob, struct vnode *linked_vp,
+    struct cs_blob *linked_cs_blob, unsigned int *signer_type);
 int     mac_vnode_check_stat(vfs_context_t ctx,
     kauth_cred_t file_cred, struct vnode *vp);
+#ifdef KERNEL_PRIVATE
 int     mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp,
     struct componentname *cnp);
+#endif
 int     mac_vnode_check_truncate(vfs_context_t ctx,
     kauth_cred_t file_cred, struct vnode *vp);
 int     mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
@@ -565,7 +515,9 @@ int     mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac);
 void    mac_vnode_label_free(struct label *label);
 void    mac_vnode_label_init(struct vnode *vp);
 int     mac_vnode_label_init_needed(struct vnode *vp);
+#ifdef KERNEL_PRIVATE
 struct label *mac_vnode_label_allocate(vnode_t vp);
+#endif
 void    mac_vnode_label_recycle(struct vnode *vp);
 void    mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
     struct label *newlabel);
@@ -598,15 +550,11 @@ int     mac_kext_check_unload(kauth_cred_t cred, const char *identifier);
 int     mac_kext_check_query(kauth_cred_t cred);
 int     mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol);
 int     mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol);
+void    mac_vnode_notify_reclaim(vnode_t vp);
 
 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
 
-#if CONFIG_MACF_NET
-struct label *mac_bpfdesc_label_get(struct bpf_d *d);
-void mac_bpfdesc_label_set(struct bpf_d *d, struct label *label);
-#endif
-
 #endif  /* CONFIG_MACF */
 
 #endif /* !_SECURITY_MAC_FRAMEWORK_H_ */