1 /* 2 * Copyright (c) 2007 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 /*- 29 * Copyright (c) 1999-2002 Robert N. M. Watson 30 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 31 * Copyright (c) 2005-2007 SPARTA, Inc. 32 * All rights reserved. 33 * 34 * This software was developed by Robert Watson for the TrustedBSD Project. 35 * 36 * This software was developed for the FreeBSD Project in part by Network 37 * Associates Laboratories, the Security Research Division of Network 38 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 39 * as part of the DARPA CHATS research program. 40 * 41 * This software was enhanced by SPARTA ISSO under SPAWAR contract 42 * N66001-04-C-6019 ("SEFOS"). 43 * 44 * Redistribution and use in source and binary forms, with or without 45 * modification, are permitted provided that the following conditions 46 * are met: 47 * 1. Redistributions of source code must retain the above copyright 48 * notice, this list of conditions and the following disclaimer. 49 * 2. Redistributions in binary form must reproduce the above copyright 50 * notice, this list of conditions and the following disclaimer in the 51 * documentation and/or other materials provided with the distribution. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $ 66 * 67 */ 68 /* 69 * Kernel interface for Mandatory Access Control -- how kernel services 70 * interact with the TrustedBSD MAC Framework. 71 */ 72 73 #ifndef _SECURITY_MAC_FRAMEWORK_H_ 74 #define _SECURITY_MAC_FRAMEWORK_H_ 75 76 #ifndef KERNEL 77 #error "no user-serviceable parts inside" 78 #endif 79 80 #ifndef PRIVATE 81 #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" 82 #endif 83 84 struct attrlist; 85 struct auditinfo; 86 struct componentname; 87 struct cs_blob; 88 struct devnode; 89 struct exception_action; 90 struct flock; 91 struct fdescnode; 92 struct fileglob; 93 struct fileproc; 94 struct ifreq; 95 struct image_params; 96 struct ipc_port; 97 struct knote; 98 struct mac; 99 struct msg; 100 struct msqid_kernel; 101 struct mount; 102 struct pipe; 103 struct proc; 104 struct pseminfo; 105 struct pshminfo; 106 struct semid_kernel; 107 struct shmid_kernel; 108 struct sockaddr; 109 struct sockopt; 110 struct socket; 111 struct task; 112 struct thread; 113 struct timespec; 114 struct tty; 115 struct ucred; 116 struct uio; 117 struct uthread; 118 struct vfs_attr; 119 struct vfs_context; 120 struct vnode; 121 struct vnode_attr; 122 struct vop_setlabel_args; 123 124 #include <stdbool.h> 125 #include <sys/kauth.h> 126 #include <sys/kernel_types.h> 127 #include <sys/reason.h> 128 #include <sys/cdefs.h> 129 130 #if CONFIG_MACF 131 132 #ifndef __IOKIT_PORTS_DEFINED__ 133 #define __IOKIT_PORTS_DEFINED__ 134 #ifdef __cplusplus 135 class OSObject; 136 typedef OSObject *io_object_t; 137 #else 138 struct OSObject; 139 typedef struct OSObject *io_object_t; 140 #endif 141 #endif /* __IOKIT_PORTS_DEFINED__ */ 142 143 __BEGIN_DECLS 144 145 /*@ macros */ 146 #define VNODE_LABEL_CREATE 1 147 148 /*@ === */ 149 int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode, 150 void *args, int error, int retval, int mac_forced) __result_use_check; 151 int mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode, 152 void *args) __result_use_check; 153 int mac_cred_check_label_update(kauth_cred_t cred, 154 struct label *newlabel) __result_use_check; 155 int mac_cred_check_label_update_execve(vfs_context_t ctx, 156 struct vnode *vp, off_t offset, struct vnode *scriptvp, 157 struct label *scriptvnodelabel, struct label *execlabel, 158 proc_t proc, void *macextensions) __result_use_check; 159 int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2) __result_use_check; 160 struct label *mac_cred_label_alloc(void); 161 void mac_cred_label_associate(kauth_cred_t cred_parent, 162 kauth_cred_t cred_child); 163 void mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child); 164 void mac_cred_label_associate_kernel(kauth_cred_t cred); 165 void mac_cred_label_associate_user(kauth_cred_t cred); 166 void mac_cred_label_destroy(kauth_cred_t cred); 167 struct label *mac_cred_label(kauth_cred_t cred); 168 int mac_cred_label_externalize_audit(proc_t p, struct mac *mac) __result_use_check; 169 void mac_cred_label_free(struct label *label); 170 void mac_cred_label_init(kauth_cred_t cred); 171 void mac_cred_label_seal(kauth_cred_t cred); 172 bool mac_cred_label_is_equal(const struct label *a, const struct label *b) __result_use_check; 173 uint32_t mac_cred_label_hash_update(const struct label *a, uint32_t hash); 174 void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel); 175 void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred, 176 struct vnode *vp, off_t offset, struct vnode *scriptvp, 177 struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags, 178 void *macextensions, int *disjoint, int *labelupdateerror); 179 void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, 180 const char *fullpath); 181 void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, 182 struct devnode *de, const char *fullpath); 183 void mac_devfs_label_copy(struct label *, struct label *label); 184 void mac_devfs_label_destroy(struct devnode *de); 185 void mac_devfs_label_init(struct devnode *de); 186 struct label *mac_devfs_label(struct devnode *de); 187 void mac_devfs_label_update(struct mount *mp, struct devnode *de, 188 struct vnode *vp); 189 int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp) __result_use_check; 190 int mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check; 191 int mac_file_check_create(kauth_cred_t cred) __result_use_check; 192 int mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd) __result_use_check; 193 int mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd, 194 user_long_t arg) __result_use_check; 195 int mac_file_check_get(kauth_cred_t cred, struct fileglob *fg, 196 char *elements, size_t len) __result_use_check; 197 int mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check; 198 int mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg) __result_use_check; 199 int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg, 200 unsigned long cmd) __result_use_check; 201 int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op, 202 struct flock *fl) __result_use_check; 203 int mac_file_check_library_validation(struct proc *proc, 204 struct fileglob *fg, off_t slice_offset, 205 user_long_t error_message, size_t error_message_size) __result_use_check; 206 int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg, 207 int prot, int flags, uint64_t file_pos, int *maxprot) __result_use_check; 208 void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg, 209 int *prot); 210 int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg) __result_use_check; 211 int mac_file_check_set(kauth_cred_t cred, struct fileglob *fg, 212 char *bufp, size_t buflen) __result_use_check; 213 void mac_file_notify_close(struct ucred *cred, struct fileglob *fg); 214 int mac_iokit_check_open_service(kauth_cred_t cred, io_object_t service, unsigned int user_client_type) __result_use_check; 215 int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type) __result_use_check; 216 int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties) __result_use_check; 217 int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry) __result_use_check; 218 int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name) __result_use_check; 219 #ifdef KERNEL_PRIVATE 220 int mac_iokit_check_hid_control(kauth_cred_t cred) __result_use_check; 221 #endif 222 int mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, 223 unsigned long cmd) __result_use_check; 224 int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, 225 struct vfs_attr *vfa) __result_use_check; 226 int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp) __result_use_check; 227 int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, 228 struct componentname *cnp, const char *vfc_name) __result_use_check; 229 int mac_mount_check_mount_late(vfs_context_t ctx, struct mount *mp) __result_use_check; 230 int mac_mount_check_quotactl(vfs_context_t ctx, struct mount *mp, 231 int cmd, int id) __result_use_check; 232 int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp, 233 const char *name) __result_use_check; 234 int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp, 235 const char *name) __result_use_check; 236 #ifdef KERNEL_PRIVATE 237 int mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp, 238 struct vnode *vp, struct componentname *cnp, const char *name, 239 const char *vfc_name) __result_use_check; 240 #endif 241 int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp, 242 const char *name) __result_use_check; 243 int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp, int flags) __result_use_check; 244 int mac_mount_check_remount_with_flags(vfs_context_t ctx, struct mount *mp, int *flagsp) __result_use_check; 245 int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, 246 struct vfs_attr *vfa) __result_use_check; 247 int mac_mount_check_stat(vfs_context_t ctx, struct mount *mp) __result_use_check; 248 int mac_mount_check_umount(vfs_context_t ctx, struct mount *mp) __result_use_check; 249 void mac_mount_label_associate(vfs_context_t ctx, struct mount *mp); 250 void mac_mount_label_destroy(struct mount *mp); 251 int mac_mount_label_externalize(struct label *label, char *elements, 252 char *outbuf, size_t outbuflen) __result_use_check; 253 int mac_mount_label_get(struct mount *mp, user_addr_t mac_p) __result_use_check; 254 void mac_mount_label_init(struct mount *); 255 struct label *mac_mount_label(struct mount *); 256 int mac_mount_label_internalize(struct label *, char *string) __result_use_check; 257 void mac_mount_notify_mount(vfs_context_t ctx, struct mount *mp); 258 int mac_necp_check_open(proc_t proc, int flags) __result_use_check; 259 int mac_necp_check_client_action(proc_t proc, struct fileglob *fg, uint32_t action) __result_use_check; 260 int mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe, 261 unsigned long cmd) __result_use_check; 262 int mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn, 263 struct pipe *cpipe) __result_use_check; 264 int mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe) __result_use_check; 265 int mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe, 266 int which) __result_use_check; 267 int mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe) __result_use_check; 268 int mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe) __result_use_check; 269 void mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe); 270 void mac_pipe_label_destroy(struct pipe *cpipe); 271 void mac_pipe_label_free(struct label *label); 272 void mac_pipe_label_init(struct pipe *cpipe); 273 struct label *mac_pipe_label(struct pipe *cpipe); 274 void mac_pipe_set_label(struct pipe *cpipe, struct label *label); 275 void mac_policy_initbsd(void); 276 int mac_posixsem_check_create(kauth_cred_t cred, const char *name) __result_use_check; 277 int mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem) __result_use_check; 278 int mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem) __result_use_check; 279 int mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem, 280 const char *name) __result_use_check; 281 int mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem) __result_use_check; 282 void mac_posixsem_vnode_label_associate(kauth_cred_t cred, 283 struct pseminfo *psem, struct label *plabel, 284 vnode_t vp, struct label *vlabel); 285 void mac_posixsem_label_associate(kauth_cred_t cred, 286 struct pseminfo *psem, const char *name); 287 void mac_posixsem_label_destroy(struct pseminfo *psem); 288 void mac_posixsem_label_init(struct pseminfo *psem); 289 struct label *mac_posixsem_label(struct pseminfo *psem); 290 int mac_posixshm_check_create(kauth_cred_t cred, const char *name) __result_use_check; 291 int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm, 292 int prot, int flags) __result_use_check; 293 int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm, 294 int fflags) __result_use_check; 295 int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm) __result_use_check; 296 int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm, 297 off_t s) __result_use_check; 298 int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm, 299 const char *name) __result_use_check; 300 void mac_posixshm_vnode_label_associate(kauth_cred_t cred, 301 struct pshminfo *pshm, struct label *plabel, 302 vnode_t vp, struct label *vlabel); 303 void mac_posixshm_label_associate(kauth_cred_t cred, 304 struct pshminfo *pshm, const char *name); 305 void mac_posixshm_label_destroy(struct pshminfo *pshm); 306 void mac_posixshm_label_init(struct pshminfo *pshm); 307 struct label *mac_posixshm_label(struct pshminfo *pshm); 308 int mac_priv_check(kauth_cred_t cred, int priv) __result_use_check; 309 int mac_priv_grant(kauth_cred_t cred, int priv) __result_use_check; 310 int mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident) __result_use_check; 311 int mac_proc_check_dump_core(proc_t proc) __result_use_check; 312 int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor) __result_use_check; 313 int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check; 314 int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check; 315 int mac_proc_check_fork(proc_t proc) __result_use_check; 316 int mac_proc_check_suspend_resume(proc_t proc, int sr) __result_use_check; 317 int mac_proc_check_get_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check; 318 int mac_proc_check_expose_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check; 319 int mac_proc_check_get_movable_control_port(void) __result_use_check; 320 int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp) __result_use_check; 321 int mac_proc_check_iopolicysys(struct proc *p, kauth_cred_t cred, int cmd, int type, int scope, int policy) __result_use_check; 322 int mac_proc_check_getaudit(proc_t proc) __result_use_check; 323 int mac_proc_check_getauid(proc_t proc) __result_use_check; 324 int mac_proc_check_dyld_process_info_notify_register(void) __result_use_check; 325 int mac_proc_check_ledger(proc_t curp, proc_t target, int op) __result_use_check; 326 int mac_proc_check_map_anon(proc_t proc, kauth_cred_t cred, user_addr_t u_addr, 327 user_size_t u_size, int prot, int flags, int *maxprot) __result_use_check; 328 int mac_proc_check_memorystatus_control(proc_t proc, uint32_t command, pid_t pid) __result_use_check; 329 int mac_proc_check_mprotect(proc_t proc, 330 user_addr_t addr, user_size_t size, int prot) __result_use_check; 331 int mac_proc_check_run_cs_invalid(proc_t proc) __result_use_check; 332 void mac_proc_notify_cs_invalidated(proc_t proc); 333 int mac_proc_check_sched(proc_t proc, proc_t proc2) __result_use_check; 334 int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai) __result_use_check; 335 int mac_proc_check_setauid(proc_t proc, uid_t auid) __result_use_check; 336 int mac_proc_check_seteuid(proc_t curp, kauth_cred_t cred, uid_t euid) __result_use_check; 337 int mac_proc_check_setegid(proc_t curp, kauth_cred_t cred, gid_t egid) __result_use_check; 338 int mac_proc_check_setuid(proc_t curp, kauth_cred_t cred, uid_t uid) __result_use_check; 339 int mac_proc_check_setgid(proc_t curp, kauth_cred_t cred, gid_t gid) __result_use_check; 340 int mac_proc_check_setreuid(proc_t curp, kauth_cred_t cred, uid_t ruid, uid_t euid) __result_use_check; 341 int mac_proc_check_setregid(proc_t curp, kauth_cred_t cred, gid_t rgid, gid_t egid) __result_use_check; 342 int mac_proc_check_settid(proc_t curp, uid_t uid, gid_t gid) __result_use_check; 343 int mac_proc_check_signal(proc_t curp, proc_ident_t instigator, proc_ident_t target, 344 int signum) __result_use_check; 345 int mac_proc_check_syscall_unix(proc_t proc, int scnum) __result_use_check; 346 int mac_proc_check_wait(proc_t proc1, proc_t proc2) __result_use_check; 347 void mac_proc_notify_exit(proc_t proc); 348 int mac_proc_check_launch_constraints(proc_t curp, struct image_params *imgp, os_reason_t *reasonp) __result_use_check; 349 int mac_socket_check_accept(kauth_cred_t cred, struct socket *so) __result_use_check; 350 int mac_socket_check_accepted(kauth_cred_t cred, struct socket *so) __result_use_check; 351 int mac_socket_check_bind(kauth_cred_t cred, struct socket *so, 352 struct sockaddr *addr) __result_use_check; 353 int mac_socket_check_connect(kauth_cred_t cred, struct socket *so, 354 struct sockaddr *addr) __result_use_check; 355 int mac_socket_check_create(kauth_cred_t cred, int domain, 356 int type, int protocol) __result_use_check; 357 int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so, 358 unsigned long cmd) __result_use_check; 359 int mac_socket_check_listen(kauth_cred_t cred, struct socket *so) __result_use_check; 360 int mac_socket_check_receive(kauth_cred_t cred, struct socket *so) __result_use_check; 361 int mac_socket_check_received(kauth_cred_t cred, struct socket *so, 362 struct sockaddr *saddr) __result_use_check; 363 int mac_socket_check_send(kauth_cred_t cred, struct socket *so, 364 struct sockaddr *addr) __result_use_check; 365 int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so, 366 struct sockopt *sopt) __result_use_check; 367 int mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so, 368 struct sockopt *sopt) __result_use_check; 369 int mac_socket_check_stat(kauth_cred_t cred, struct socket *so) __result_use_check; 370 void mac_socket_label_associate(kauth_cred_t cred, struct socket *so); 371 void mac_socket_label_associate_accept(struct socket *oldsocket, 372 struct socket *newsocket); 373 void mac_socket_label_copy(struct label *from, struct label *to); 374 void mac_socket_label_destroy(struct socket *); 375 int mac_socket_label_get(kauth_cred_t cred, struct socket *so, 376 struct mac *extmac) __result_use_check; 377 int mac_socket_label_init(struct socket *, int waitok) __result_use_check; 378 void mac_socketpeer_label_associate_socket(struct socket *peersocket, 379 struct socket *socket_to_modify); 380 int mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so, 381 struct mac *extmac) __result_use_check; 382 int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp) __result_use_check; 383 int mac_system_check_audit(kauth_cred_t cred, void *record, int length) __result_use_check; 384 int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp) __result_use_check; 385 int mac_system_check_auditon(kauth_cred_t cred, int cmd) __result_use_check; 386 int mac_system_check_host_priv(kauth_cred_t cred) __result_use_check; 387 int mac_system_check_info(kauth_cred_t, const char *info_type) __result_use_check; 388 int mac_system_check_nfsd(kauth_cred_t cred) __result_use_check; 389 int mac_system_check_reboot(kauth_cred_t cred, int howto) __result_use_check; 390 int mac_system_check_settime(kauth_cred_t cred) __result_use_check; 391 int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp) __result_use_check; 392 int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp) __result_use_check; 393 int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name, 394 size_t namelen, user_addr_t oldctl, size_t oldlen, 395 user_addr_t newctl, size_t newlen) __result_use_check; 396 int mac_system_check_kas_info(kauth_cred_t cred, int selector) __result_use_check; 397 void mac_sysvmsg_label_associate(kauth_cred_t cred, 398 struct msqid_kernel *msqptr, struct msg *msgptr); 399 void mac_sysvmsg_label_init(struct msg *msgptr); 400 struct label *mac_sysvmsg_label(struct msg *msgptr); 401 void mac_sysvmsg_label_recycle(struct msg *msgptr); 402 int mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr, 403 struct msqid_kernel *msqptr) __result_use_check; 404 int mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr) __result_use_check; 405 int mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr) __result_use_check; 406 int mac_sysvmsq_check_msqctl(kauth_cred_t cred, 407 struct msqid_kernel *msqptr, int cmd) __result_use_check; 408 int mac_sysvmsq_check_msqget(kauth_cred_t cred, 409 struct msqid_kernel *msqptr) __result_use_check; 410 int mac_sysvmsq_check_msqrcv(kauth_cred_t cred, 411 struct msqid_kernel *msqptr) __result_use_check; 412 int mac_sysvmsq_check_msqsnd(kauth_cred_t cred, 413 struct msqid_kernel *msqptr) __result_use_check; 414 void mac_sysvmsq_label_associate(kauth_cred_t cred, 415 struct msqid_kernel *msqptr); 416 void mac_sysvmsq_label_init(struct msqid_kernel *msqptr); 417 struct label *mac_sysvmsq_label(struct msqid_kernel *msqptr); 418 void mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr); 419 int mac_sysvsem_check_semctl(kauth_cred_t cred, 420 struct semid_kernel *semakptr, int cmd) __result_use_check; 421 int mac_sysvsem_check_semget(kauth_cred_t cred, 422 struct semid_kernel *semakptr) __result_use_check; 423 int mac_sysvsem_check_semop(kauth_cred_t cred, 424 struct semid_kernel *semakptr, size_t accesstype) __result_use_check; 425 void mac_sysvsem_label_associate(kauth_cred_t cred, 426 struct semid_kernel *semakptr); 427 void mac_sysvsem_label_destroy(struct semid_kernel *semakptr); 428 void mac_sysvsem_label_init(struct semid_kernel *semakptr); 429 struct label *mac_sysvsem_label(struct semid_kernel *semakptr); 430 void mac_sysvsem_label_recycle(struct semid_kernel *semakptr); 431 int mac_sysvshm_check_shmat(kauth_cred_t cred, 432 struct shmid_kernel *shmsegptr, int shmflg) __result_use_check; 433 int mac_sysvshm_check_shmctl(kauth_cred_t cred, 434 struct shmid_kernel *shmsegptr, int cmd) __result_use_check; 435 int mac_sysvshm_check_shmdt(kauth_cred_t cred, 436 struct shmid_kernel *shmsegptr) __result_use_check; 437 int mac_sysvshm_check_shmget(kauth_cred_t cred, 438 struct shmid_kernel *shmsegptr, int shmflg) __result_use_check; 439 void mac_sysvshm_label_associate(kauth_cred_t cred, 440 struct shmid_kernel *shmsegptr); 441 void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr); 442 void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr); 443 struct label *mac_sysvshm_label(struct shmid_kernel *shmsegptr); 444 void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr); 445 int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, 446 int acc_mode) __result_use_check; 447 int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) __result_use_check; 448 int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, 449 struct componentname *cnp) __result_use_check; 450 int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp, 451 struct vnode *vp, struct componentname *cnp) __result_use_check; 452 int mac_vnode_check_copyfile(vfs_context_t ctx, struct vnode *dvp, 453 struct vnode *tvp, struct vnode *fvp, struct componentname *cnp, 454 mode_t mode, int flags) __result_use_check; 455 int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, 456 struct componentname *cnp, struct vnode_attr *vap) __result_use_check; 457 int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, 458 const char *name) __result_use_check; 459 int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, 460 struct vnode *v2) __result_use_check; 461 int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, 462 struct image_params *imgp) __result_use_check; 463 int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp) __result_use_check; 464 int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred, 465 struct vnode *vp, struct vnode_attr *va) __result_use_check; 466 int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, 467 struct attrlist *alist, uint64_t options) __result_use_check; 468 int mac_vnode_check_getattrlistbulk(vfs_context_t ctx, struct vnode *dvp, 469 struct attrlist *alist, uint64_t options) __result_use_check; 470 int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, 471 const char *name, struct uio *uio) __result_use_check; 472 int mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, 473 unsigned long cmd) __result_use_check; 474 int mac_vnode_check_kqfilter(vfs_context_t ctx, 475 kauth_cred_t file_cred, struct knote *kn, struct vnode *vp) __result_use_check; 476 int mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp, 477 struct label *newlabel); __result_use_check 478 int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, 479 struct vnode *vp, struct componentname *cnp) __result_use_check; 480 int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp) __result_use_check; 481 int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, 482 struct componentname *cnp) __result_use_check; 483 int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp, 484 const char *path, size_t pathlen) __result_use_check; 485 #ifdef KERNEL_PRIVATE 486 int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, 487 int acc_mode) __result_use_check; 488 #endif 489 int mac_vnode_check_read(vfs_context_t ctx, 490 kauth_cred_t file_cred, struct vnode *vp) __result_use_check; 491 int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp) __result_use_check; 492 int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp) __result_use_check; 493 int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *fdvp, 494 struct vnode *fvp, struct componentname *fcnp, struct vnode *tdvp, 495 struct vnode *tvp, struct componentname *tcnp) __result_use_check; 496 int mac_vnode_check_rename_swap(vfs_context_t ctx, struct vnode *fdvp, 497 struct vnode *fvp, struct componentname *fcnp, struct vnode *tdvp, 498 struct vnode *tvp, struct componentname *tcnp) __result_use_check; 499 int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp) __result_use_check; 500 int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, 501 struct attrlist *returnattrs, struct attrlist *searchattrs) __result_use_check; 502 int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, 503 int which) __result_use_check; 504 int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, 505 struct kauth_acl *acl) __result_use_check; 506 int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp, 507 struct attrlist *alist) __result_use_check; 508 int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, 509 const char *name, struct uio *uio) __result_use_check; 510 int mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, 511 u_long flags) __result_use_check; 512 int mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, 513 mode_t mode) __result_use_check; 514 int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, 515 uid_t uid, gid_t gid) __result_use_check; 516 int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, 517 struct timespec atime, struct timespec mtime) __result_use_check; 518 int mac_vnode_check_signature(struct vnode *vp, 519 struct cs_blob *cs_blob, struct image_params *imgp, 520 unsigned int *cs_flags, unsigned int *signer_type, 521 int flags, unsigned int platform) __result_use_check; 522 int mac_vnode_check_supplemental_signature(struct vnode *vp, 523 struct cs_blob *cs_blob, struct vnode *linked_vp, 524 struct cs_blob *linked_cs_blob, unsigned int *signer_type) __result_use_check; 525 int mac_vnode_check_stat(vfs_context_t ctx, 526 kauth_cred_t file_cred, struct vnode *vp) __result_use_check; 527 #ifdef KERNEL_PRIVATE 528 int mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp, 529 struct componentname *cnp) __result_use_check; 530 #endif 531 int mac_vnode_check_truncate(vfs_context_t ctx, 532 kauth_cred_t file_cred, struct vnode *vp) __result_use_check; 533 int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, 534 struct componentname *cnp, struct vnode_attr *vap) __result_use_check; 535 int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so) __result_use_check; 536 int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, 537 struct vnode *vp, struct componentname *cnp) __result_use_check; 538 int mac_vnode_check_write(vfs_context_t ctx, 539 kauth_cred_t file_cred, struct vnode *vp) __result_use_check; 540 struct label *mac_vnode_label_alloc(struct vnode *vp); 541 int mac_vnode_label_associate(struct mount *mp, struct vnode *vp, 542 vfs_context_t ctx) __result_use_check; 543 void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de, 544 struct vnode *vp); 545 int mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp) __result_use_check; 546 int mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, 547 struct vnode *vp, vfs_context_t ctx) __result_use_check; 548 void mac_vnode_label_associate_singlelabel(struct mount *mp, 549 struct vnode *vp); 550 void mac_vnode_label_copy(struct label *l1, struct label *l2); 551 void mac_vnode_label_destroy(struct vnode *vp); 552 int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac) __result_use_check; 553 void mac_vnode_label_free(struct label *label); 554 void mac_vnode_label_init(struct vnode *vp); 555 int mac_vnode_label_init_needed(struct vnode *vp) __result_use_check; 556 struct label *mac_vnode_label(struct vnode *vp); 557 #ifdef KERNEL_PRIVATE 558 struct label *mac_vnode_label_allocate(vnode_t vp); 559 #endif 560 void mac_vnode_label_recycle(struct vnode *vp); 561 void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, 562 struct label *newlabel); 563 void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, 564 const char *name); 565 int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, 566 struct vnode *dvp, struct vnode *vp, struct componentname *cnp) __result_use_check; 567 void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name); 568 void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, 569 struct vnode *dvp, struct componentname *cnp); 570 void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); 571 void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *fvp, 572 struct vnode *tdvp, struct componentname *tcnp); 573 void mac_vnode_notify_rename_swap(vfs_context_t ctx, struct vnode *fvp, 574 struct vnode *fdvp, struct componentname *fcnp, struct vnode *tvp, 575 struct vnode *tdvp, struct componentname *tcnp); 576 void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl); 577 void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); 578 void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio); 579 void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags); 580 void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode); 581 void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid); 582 void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime); 583 void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); 584 int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho) __result_use_check; 585 int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, 586 struct componentname *cnp, int flags, vfs_context_t ctx) __result_use_check; 587 void vnode_relabel(struct vnode *vp); 588 void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label); 589 void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label); 590 int mac_kext_check_load(kauth_cred_t cred, const char *identifier) __result_use_check; 591 int mac_kext_check_unload(kauth_cred_t cred, const char *identifier) __result_use_check; 592 int mac_kext_check_query(kauth_cred_t cred) __result_use_check; 593 int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check; 594 int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check; 595 void mac_vnode_notify_reclaim(vnode_t vp); 596 void mac_vnode_notify_unlink(vfs_context_t ctx, struct vnode *dvp, 597 struct vnode *vp, struct componentname *cnp); 598 int mac_vnode_check_dataprotect_set(vfs_context_t ctx, struct vnode *vp, uint32_t *dataprotect_class) __result_use_check; 599 int mac_graft_check_graft(vfs_context_t ctx, struct vnode *graft_dir_vp) __result_use_check; 600 int mac_graft_check_ungraft(vfs_context_t ctx, struct vnode *graft_dir_vp) __result_use_check; 601 void mac_graft_notify_graft(vfs_context_t ctx, struct vnode *graft_dir_vp); 602 void mac_graft_notify_ungraft(vfs_context_t ctx, struct vnode *graft_dir_vp); 603 604 void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); 605 void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); 606 607 __END_DECLS 608 609 #endif /* CONFIG_MACF */ 610 611 #endif /* !_SECURITY_MAC_FRAMEWORK_H_ */ 612