1 /* 2 * Copyright (c) 2018 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _SYS_GUARDED_H_ 30 #define _SYS_GUARDED_H_ 31 32 #include <sys/types.h> 33 #include <sys/cdefs.h> 34 35 #include <sys/_types/_iovec_t.h> 36 #ifdef PRIVATE 37 38 __BEGIN_DECLS 39 40 #if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE) 41 42 #ifndef _GUARDID_T 43 #define _GUARDID_T 44 typedef __uint64_t guardid_t; 45 #endif /* _GUARDID_T */ 46 47 #if !defined(KERNEL) 48 extern int guarded_open_np(const char *path, 49 const guardid_t *guard, u_int guardflags, int flags, ...); 50 extern int guarded_open_dprotected_np(const char *path, 51 const guardid_t *guard, u_int guardflags, int flags, 52 int dpclass, int dpflags, ...); 53 extern int guarded_kqueue_np(const guardid_t *guard, u_int guardflags); 54 extern int guarded_close_np(int fd, const guardid_t *guard); 55 extern int change_fdguard_np(int fd, const guardid_t *guard, u_int guardflags, 56 const guardid_t *nguard, u_int nguardflags, int *fdflagsp); 57 extern ssize_t guarded_write_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte); 58 extern ssize_t guarded_pwrite_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte, off_t offset); 59 extern ssize_t guarded_writev_np(int fd, const guardid_t *guard, const struct iovec *iovp, int iovcnt); 60 #endif /* KERNEL */ 61 62 #ifndef GUARD_TYPE_FD 63 /* temporary source compat: use <kern/exc_guard.h> instead */ 64 #define GUARD_TYPE_FD 0x2 65 #endif 66 67 /* 68 * File descriptor guard flavors. 69 */ 70 71 /* 72 * Forbid close(2), and the implicit close() that a dup2(2) may do. 73 * Forces close-on-fork to be set immutably too. 74 */ 75 #define GUARD_CLOSE (1u << 0) 76 77 /* 78 * Forbid dup(2), dup2(2), and fcntl(2) subcodes F_DUPFD, F_DUPFD_CLOEXEC 79 * on a guarded fd. Also forbids open's of a guarded fd via /dev/fd/ 80 * (an implicit dup.) 81 */ 82 #define GUARD_DUP (1u << 1) 83 84 /* 85 * Forbid sending a guarded fd via a socket 86 */ 87 #define GUARD_SOCKET_IPC (1u << 2) 88 89 /* 90 * Forbid creating a fileport from a guarded fd 91 */ 92 #define GUARD_FILEPORT (1u << 3) 93 94 /* 95 * Forbid writes on a guarded fd 96 */ 97 #define GUARD_WRITE (1u << 4) 98 99 /* 100 * Violating a guard results in an error (EPERM), and potentially 101 * an exception with one or more of the following bits set. 102 */ 103 enum guard_fd_exception_codes { 104 kGUARD_EXC_CLOSE = 1u << 0, /* close of a guarded fd */ 105 kGUARD_EXC_DUP = 1u << 1, /* dup of a guarded fd */ 106 kGUARD_EXC_NOCLOEXEC = 1u << 2, /* clear close-on-exec */ 107 kGUARD_EXC_SOCKET_IPC = 1u << 3, /* sendmsg of a guarded fd */ 108 kGUARD_EXC_FILEPORT = 1u << 4, /* fileport_makeport .. */ 109 kGUARD_EXC_MISMATCH = 1u << 5, /* wrong guard for guarded fd */ 110 kGUARD_EXC_WRITE = 1u << 6 /* write on a guarded fd */ 111 }; 112 113 /* 114 * Experimental guarded vnode support 115 */ 116 #define VNG_RENAME_TO (1u << 0) 117 #define VNG_RENAME_FROM (1u << 1) 118 #define VNG_UNLINK (1u << 2) 119 #define VNG_WRITE_OTHER (1u << 3) 120 #define VNG_TRUNC_OTHER (1u << 4) 121 #define VNG_LINK (1u << 5) 122 #define VNG_EXCHDATA (1u << 6) 123 124 #define VNG_ALL \ 125 (VNG_RENAME_TO | VNG_RENAME_FROM | VNG_UNLINK | VNG_LINK | \ 126 VNG_WRITE_OTHER | VNG_TRUNC_OTHER | VNG_EXCHDATA) 127 128 struct vnguard_set { 129 int vns_fd; 130 unsigned vns_attrs; 131 guardid_t vns_guard; 132 }; 133 134 struct vnguard_getattr { 135 int vga_fd; /* in */ 136 unsigned vga_attrs; /* out */ 137 guardid_t vga_guard; /* in */ 138 }; 139 140 #define VNG_SYSC_PING 0 141 #define VNG_SYSC_SET_GUARD 1 142 #define VNG_SYSC_GET_ATTR 2 143 144 #define VNG_POLICY_NAME "vnguard" 145 146 /* 147 * Violating a guard may result in an error (EPERM), and potentially 148 * an exception with one or more of the following bits set. 149 */ 150 enum guard_vn_exception_codes { 151 kGUARD_EXC_RENAME_TO = VNG_RENAME_TO, 152 kGUARD_EXC_RENAME_FROM = VNG_RENAME_FROM, 153 kGUARD_EXC_UNLINK = VNG_UNLINK, 154 kGUARD_EXC_WRITE_OTHER = VNG_WRITE_OTHER, 155 kGUARD_EXC_TRUNC_OTHER = VNG_TRUNC_OTHER, 156 kGUARD_EXC_LINK = VNG_LINK, 157 kGUARD_EXC_EXCHDATA = VNG_EXCHDATA, 158 }; 159 160 /* Guard violation behaviors: not all combinations make sense */ 161 162 #define kVNG_POLICY_LOGMSG (1u << 0) 163 #define kVNG_POLICY_EPERM (1u << 1) 164 #define kVNG_POLICY_EXC (1u << 2) 165 #define kVNG_POLICY_EXC_CORPSE (1u << 3) 166 #define kVNG_POLICY_SIGKILL (1u << 4) 167 #define kVNG_POLICY_UPRINTMSG (1u << 5) 168 169 #if BSD_KERNEL_PRIVATE 170 struct fileglob; 171 extern int vnguard_exceptions_active(void); 172 extern void vnguard_policy_init(void); 173 #if CONFIG_MACF && CONFIG_VNGUARD 174 extern void vng_file_label_destroy(struct fileglob *fg); 175 #endif /* CONFIG_MACF && CONFIG_VNGUARD */ 176 #endif /* BSD_KERNEL_PRIVATE */ 177 178 #endif /* (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */ 179 180 __END_DECLS 181 182 #endif /* PRIVATE */ 183 184 #endif /* !_SYS_GUARDED_H_ */ 185