1*c54f35caSApple OSS Distributions /*
2*c54f35caSApple OSS Distributions * Copyright (c) 2021 Apple Inc. All rights reserved.
3*c54f35caSApple OSS Distributions *
4*c54f35caSApple OSS Distributions * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5*c54f35caSApple OSS Distributions *
6*c54f35caSApple OSS Distributions * This file contains Original Code and/or Modifications of Original Code
7*c54f35caSApple OSS Distributions * as defined in and that are subject to the Apple Public Source License
8*c54f35caSApple OSS Distributions * Version 2.0 (the 'License'). You may not use this file except in
9*c54f35caSApple OSS Distributions * compliance with the License. The rights granted to you under the License
10*c54f35caSApple OSS Distributions * may not be used to create, or enable the creation or redistribution of,
11*c54f35caSApple OSS Distributions * unlawful or unlicensed copies of an Apple operating system, or to
12*c54f35caSApple OSS Distributions * circumvent, violate, or enable the circumvention or violation of, any
13*c54f35caSApple OSS Distributions * terms of an Apple operating system software license agreement.
14*c54f35caSApple OSS Distributions *
15*c54f35caSApple OSS Distributions * Please obtain a copy of the License at
16*c54f35caSApple OSS Distributions * http://www.opensource.apple.com/apsl/ and read it before using this file.
17*c54f35caSApple OSS Distributions *
18*c54f35caSApple OSS Distributions * The Original Code and all software distributed under the License are
19*c54f35caSApple OSS Distributions * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20*c54f35caSApple OSS Distributions * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21*c54f35caSApple OSS Distributions * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22*c54f35caSApple OSS Distributions * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23*c54f35caSApple OSS Distributions * Please see the License for the specific language governing rights and
24*c54f35caSApple OSS Distributions * limitations under the License.
25*c54f35caSApple OSS Distributions *
26*c54f35caSApple OSS Distributions * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27*c54f35caSApple OSS Distributions */
28*c54f35caSApple OSS Distributions
29*c54f35caSApple OSS Distributions #include <sys/param.h>
30*c54f35caSApple OSS Distributions #include <sys/proc.h>
31*c54f35caSApple OSS Distributions #include <sys/kauth.h>
32*c54f35caSApple OSS Distributions #include <security/mac_framework.h>
33*c54f35caSApple OSS Distributions #include <security/mac_internal.h>
34*c54f35caSApple OSS Distributions
35*c54f35caSApple OSS Distributions int
mac_necp_check_open(proc_t proc,int flags)36*c54f35caSApple OSS Distributions mac_necp_check_open(proc_t proc, int flags)
37*c54f35caSApple OSS Distributions {
38*c54f35caSApple OSS Distributions kauth_cred_t cred;
39*c54f35caSApple OSS Distributions int error;
40*c54f35caSApple OSS Distributions
41*c54f35caSApple OSS Distributions #if SECURITY_MAC_CHECK_ENFORCE
42*c54f35caSApple OSS Distributions /* 21167099 - only check if we allow write */
43*c54f35caSApple OSS Distributions if (!mac_proc_enforce) {
44*c54f35caSApple OSS Distributions return 0;
45*c54f35caSApple OSS Distributions }
46*c54f35caSApple OSS Distributions #endif
47*c54f35caSApple OSS Distributions
48*c54f35caSApple OSS Distributions if (!mac_proc_check_enforce(proc)) {
49*c54f35caSApple OSS Distributions return 0;
50*c54f35caSApple OSS Distributions }
51*c54f35caSApple OSS Distributions
52*c54f35caSApple OSS Distributions cred = kauth_cred_proc_ref(proc);
53*c54f35caSApple OSS Distributions MAC_CHECK(necp_check_open, cred, flags);
54*c54f35caSApple OSS Distributions kauth_cred_unref(&cred);
55*c54f35caSApple OSS Distributions
56*c54f35caSApple OSS Distributions return error;
57*c54f35caSApple OSS Distributions }
58*c54f35caSApple OSS Distributions
59*c54f35caSApple OSS Distributions int
mac_necp_check_client_action(proc_t proc,struct fileglob * fg,uint32_t action)60*c54f35caSApple OSS Distributions mac_necp_check_client_action(proc_t proc, struct fileglob *fg, uint32_t action)
61*c54f35caSApple OSS Distributions {
62*c54f35caSApple OSS Distributions kauth_cred_t cred;
63*c54f35caSApple OSS Distributions int error;
64*c54f35caSApple OSS Distributions
65*c54f35caSApple OSS Distributions #if SECURITY_MAC_CHECK_ENFORCE
66*c54f35caSApple OSS Distributions /* 21167099 - only check if we allow write */
67*c54f35caSApple OSS Distributions if (!mac_proc_enforce) {
68*c54f35caSApple OSS Distributions return 0;
69*c54f35caSApple OSS Distributions }
70*c54f35caSApple OSS Distributions #endif
71*c54f35caSApple OSS Distributions
72*c54f35caSApple OSS Distributions if (!mac_proc_check_enforce(proc)) {
73*c54f35caSApple OSS Distributions return 0;
74*c54f35caSApple OSS Distributions }
75*c54f35caSApple OSS Distributions
76*c54f35caSApple OSS Distributions cred = kauth_cred_proc_ref(proc);
77*c54f35caSApple OSS Distributions MAC_CHECK(necp_check_client_action, cred, fg, action);
78*c54f35caSApple OSS Distributions kauth_cred_unref(&cred);
79*c54f35caSApple OSS Distributions
80*c54f35caSApple OSS Distributions return error;
81*c54f35caSApple OSS Distributions }
82