1*43a90889SApple OSS Distributions /*
2*43a90889SApple OSS Distributions * Copyright (c) 2021 Apple Inc. All rights reserved.
3*43a90889SApple OSS Distributions *
4*43a90889SApple OSS Distributions * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5*43a90889SApple OSS Distributions *
6*43a90889SApple OSS Distributions * This file contains Original Code and/or Modifications of Original Code
7*43a90889SApple OSS Distributions * as defined in and that are subject to the Apple Public Source License
8*43a90889SApple OSS Distributions * Version 2.0 (the 'License'). You may not use this file except in
9*43a90889SApple OSS Distributions * compliance with the License. The rights granted to you under the License
10*43a90889SApple OSS Distributions * may not be used to create, or enable the creation or redistribution of,
11*43a90889SApple OSS Distributions * unlawful or unlicensed copies of an Apple operating system, or to
12*43a90889SApple OSS Distributions * circumvent, violate, or enable the circumvention or violation of, any
13*43a90889SApple OSS Distributions * terms of an Apple operating system software license agreement.
14*43a90889SApple OSS Distributions *
15*43a90889SApple OSS Distributions * Please obtain a copy of the License at
16*43a90889SApple OSS Distributions * http://www.opensource.apple.com/apsl/ and read it before using this file.
17*43a90889SApple OSS Distributions *
18*43a90889SApple OSS Distributions * The Original Code and all software distributed under the License are
19*43a90889SApple OSS Distributions * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20*43a90889SApple OSS Distributions * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21*43a90889SApple OSS Distributions * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22*43a90889SApple OSS Distributions * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23*43a90889SApple OSS Distributions * Please see the License for the specific language governing rights and
24*43a90889SApple OSS Distributions * limitations under the License.
25*43a90889SApple OSS Distributions *
26*43a90889SApple OSS Distributions * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27*43a90889SApple OSS Distributions */
28*43a90889SApple OSS Distributions
29*43a90889SApple OSS Distributions #include <sys/param.h>
30*43a90889SApple OSS Distributions #include <sys/proc.h>
31*43a90889SApple OSS Distributions #include <sys/kauth.h>
32*43a90889SApple OSS Distributions #include <security/mac_framework.h>
33*43a90889SApple OSS Distributions #include <security/mac_internal.h>
34*43a90889SApple OSS Distributions
35*43a90889SApple OSS Distributions int
mac_necp_check_open(proc_t proc,int flags)36*43a90889SApple OSS Distributions mac_necp_check_open(proc_t proc, int flags)
37*43a90889SApple OSS Distributions {
38*43a90889SApple OSS Distributions int error;
39*43a90889SApple OSS Distributions
40*43a90889SApple OSS Distributions #if SECURITY_MAC_CHECK_ENFORCE
41*43a90889SApple OSS Distributions /* 21167099 - only check if we allow write */
42*43a90889SApple OSS Distributions if (!mac_proc_enforce) {
43*43a90889SApple OSS Distributions return 0;
44*43a90889SApple OSS Distributions }
45*43a90889SApple OSS Distributions #endif
46*43a90889SApple OSS Distributions
47*43a90889SApple OSS Distributions if (!mac_proc_check_enforce(proc)) {
48*43a90889SApple OSS Distributions return 0;
49*43a90889SApple OSS Distributions }
50*43a90889SApple OSS Distributions
51*43a90889SApple OSS Distributions MAC_CHECK(necp_check_open, current_cached_proc_cred(proc), flags);
52*43a90889SApple OSS Distributions return error;
53*43a90889SApple OSS Distributions }
54*43a90889SApple OSS Distributions
55*43a90889SApple OSS Distributions int
mac_necp_check_client_action(proc_t proc,struct fileglob * fg,uint32_t action)56*43a90889SApple OSS Distributions mac_necp_check_client_action(proc_t proc, struct fileglob *fg, uint32_t action)
57*43a90889SApple OSS Distributions {
58*43a90889SApple OSS Distributions int error;
59*43a90889SApple OSS Distributions
60*43a90889SApple OSS Distributions #if SECURITY_MAC_CHECK_ENFORCE
61*43a90889SApple OSS Distributions /* 21167099 - only check if we allow write */
62*43a90889SApple OSS Distributions if (!mac_proc_enforce) {
63*43a90889SApple OSS Distributions return 0;
64*43a90889SApple OSS Distributions }
65*43a90889SApple OSS Distributions #endif
66*43a90889SApple OSS Distributions
67*43a90889SApple OSS Distributions if (!mac_proc_check_enforce(proc)) {
68*43a90889SApple OSS Distributions return 0;
69*43a90889SApple OSS Distributions }
70*43a90889SApple OSS Distributions
71*43a90889SApple OSS Distributions MAC_CHECK(necp_check_client_action, current_cached_proc_cred(proc), fg, action);
72*43a90889SApple OSS Distributions return error;
73*43a90889SApple OSS Distributions }
74