1 | /* |
2 | * Copyright (c) 2007 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /*- |
29 | * Copyright (c) 1999-2002 Robert N. M. Watson |
30 | * Copyright (c) 2001-2005 Networks Associates Technology, Inc. |
31 | * Copyright (c) 2005-2007 SPARTA, Inc. |
32 | * All rights reserved. |
33 | * |
34 | * This software was developed by Robert Watson for the TrustedBSD Project. |
35 | * |
36 | * This software was developed for the FreeBSD Project in part by Network |
37 | * Associates Laboratories, the Security Research Division of Network |
38 | * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), |
39 | * as part of the DARPA CHATS research program. |
40 | * |
41 | * This software was enhanced by SPARTA ISSO under SPAWAR contract |
42 | * N66001-04-C-6019 ("SEFOS"). |
43 | * |
44 | * Redistribution and use in source and binary forms, with or without |
45 | * modification, are permitted provided that the following conditions |
46 | * are met: |
47 | * 1. Redistributions of source code must retain the above copyright |
48 | * notice, this list of conditions and the following disclaimer. |
49 | * 2. Redistributions in binary form must reproduce the above copyright |
50 | * notice, this list of conditions and the following disclaimer in the |
51 | * documentation and/or other materials provided with the distribution. |
52 | * |
53 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND |
54 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
55 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
56 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
57 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
58 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
59 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
60 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
61 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
62 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
63 | * SUCH DAMAGE. |
64 | * |
65 | * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $ |
66 | * |
67 | */ |
68 | /* |
69 | * Kernel interface for Mandatory Access Control -- how kernel services |
70 | * interact with the TrustedBSD MAC Framework. |
71 | */ |
72 | |
73 | #ifndef _SECURITY_MAC_FRAMEWORK_H_ |
74 | #define _SECURITY_MAC_FRAMEWORK_H_ |
75 | |
76 | #ifndef KERNEL |
77 | #error "no user-serviceable parts inside" |
78 | #endif |
79 | |
80 | #ifndef PRIVATE |
81 | #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" |
82 | #endif |
83 | |
84 | struct attrlist; |
85 | struct auditinfo; |
86 | struct bpf_d; |
87 | struct componentname; |
88 | struct cs_blob; |
89 | struct devnode; |
90 | struct exception_action; |
91 | struct flock; |
92 | struct fdescnode; |
93 | struct fileglob; |
94 | struct fileproc; |
95 | struct ifnet; |
96 | struct ifreq; |
97 | struct image_params; |
98 | struct inpcb; |
99 | struct ipc_port; |
100 | struct ipq; |
101 | struct knote; |
102 | struct m_tag; |
103 | struct mac; |
104 | struct mac_module_data; |
105 | struct mbuf; |
106 | struct msg; |
107 | struct msqid_kernel; |
108 | struct mount; |
109 | struct pipe; |
110 | struct proc; |
111 | struct pseminfo; |
112 | struct pshminfo; |
113 | struct semid_kernel; |
114 | struct shmid_kernel; |
115 | struct sockaddr; |
116 | struct sockopt; |
117 | struct socket; |
118 | struct task; |
119 | struct thread; |
120 | struct timespec; |
121 | struct tty; |
122 | struct ucred; |
123 | struct uio; |
124 | struct uthread; |
125 | struct vfs_attr; |
126 | struct vfs_context; |
127 | struct vnode; |
128 | struct vnode_attr; |
129 | struct vop_setlabel_args; |
130 | |
131 | #include <sys/kauth.h> |
132 | #include <sys/kernel_types.h> |
133 | |
134 | #if CONFIG_MACF |
135 | |
136 | #ifndef __IOKIT_PORTS_DEFINED__ |
137 | #define __IOKIT_PORTS_DEFINED__ |
138 | #ifdef __cplusplus |
139 | class OSObject; |
140 | typedef OSObject *io_object_t; |
141 | #else |
142 | struct OSObject; |
143 | typedef struct OSObject *io_object_t; |
144 | #endif |
145 | #endif /* __IOKIT_PORTS_DEFINED__ */ |
146 | |
147 | /*@ macros */ |
148 | #define VNODE_LABEL_CREATE 1 |
149 | |
150 | /*@ === */ |
151 | int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode, |
152 | void *args, int error, int retval, int mac_forced); |
153 | int mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode, |
154 | void *args); |
155 | int mac_bpfdesc_check_receive(struct bpf_d *bpf_d, struct ifnet *ifp); |
156 | void mac_bpfdesc_label_destroy(struct bpf_d *bpf_d); |
157 | void mac_bpfdesc_label_init(struct bpf_d *bpf_d); |
158 | void mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d); |
159 | int mac_cred_check_label_update(kauth_cred_t cred, |
160 | struct label *newlabel); |
161 | int mac_cred_check_label_update_execve(vfs_context_t ctx, |
162 | struct vnode *vp, off_t offset, struct vnode *scriptvp, |
163 | struct label *scriptvnodelabel, struct label *execlabel, |
164 | proc_t proc, void *macextensions); |
165 | int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2); |
166 | struct label *mac_cred_label_alloc(void); |
167 | void mac_cred_label_associate(kauth_cred_t cred_parent, |
168 | kauth_cred_t cred_child); |
169 | void mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child); |
170 | void mac_cred_label_associate_kernel(kauth_cred_t cred); |
171 | void mac_cred_label_associate_user(kauth_cred_t cred); |
172 | void mac_cred_label_destroy(kauth_cred_t cred); |
173 | int mac_cred_label_externalize_audit(proc_t p, struct mac *mac); |
174 | void mac_cred_label_free(struct label *label); |
175 | void mac_cred_label_init(kauth_cred_t cred); |
176 | int mac_cred_label_compare(struct label *a, struct label *b); |
177 | void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel); |
178 | void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred, |
179 | struct vnode *vp, off_t offset, struct vnode *scriptvp, |
180 | struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags, |
181 | void *macextensions, int *disjoint, int *labelupdateerror); |
182 | void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, |
183 | const char *fullpath); |
184 | void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, |
185 | struct devnode *de, const char *fullpath); |
186 | void mac_devfs_label_copy(struct label *, struct label *label); |
187 | void mac_devfs_label_destroy(struct devnode *de); |
188 | void mac_devfs_label_init(struct devnode *de); |
189 | void mac_devfs_label_update(struct mount *mp, struct devnode *de, |
190 | struct vnode *vp); |
191 | int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp); |
192 | int mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg); |
193 | int mac_file_check_create(kauth_cred_t cred); |
194 | int mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd); |
195 | int mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd, |
196 | user_long_t arg); |
197 | int mac_file_check_get(kauth_cred_t cred, struct fileglob *fg, |
198 | char *elements, int len); |
199 | int mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg); |
200 | int mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg); |
201 | int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg, |
202 | unsigned int cmd); |
203 | int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op, |
204 | struct flock *fl); |
205 | int mac_file_check_library_validation(struct proc *proc, |
206 | struct fileglob *fg, off_t slice_offset, |
207 | user_long_t error_message, size_t error_message_size); |
208 | int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg, |
209 | int prot, int flags, uint64_t file_pos, int *maxprot); |
210 | void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg, |
211 | int *prot); |
212 | int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg); |
213 | int mac_file_check_set(kauth_cred_t cred, struct fileglob *fg, |
214 | char *bufp, int buflen); |
215 | void mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg); |
216 | void mac_file_label_destroy(struct fileglob *fg); |
217 | void mac_file_label_init(struct fileglob *fg); |
218 | int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf, |
219 | int family, int type); |
220 | void mac_ifnet_label_associate(struct ifnet *ifp); |
221 | void mac_ifnet_label_destroy(struct ifnet *ifp); |
222 | int mac_ifnet_label_get(kauth_cred_t cred, struct ifreq *ifr, |
223 | struct ifnet *ifp); |
224 | void mac_ifnet_label_init(struct ifnet *ifp); |
225 | void mac_ifnet_label_recycle(struct ifnet *ifp); |
226 | int mac_ifnet_label_set(kauth_cred_t cred, struct ifreq *ifr, |
227 | struct ifnet *ifp); |
228 | int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf, |
229 | int family, int type); |
230 | void mac_inpcb_label_associate(struct socket *so, struct inpcb *inp); |
231 | void mac_inpcb_label_destroy(struct inpcb *inp); |
232 | int mac_inpcb_label_init(struct inpcb *inp, int flag); |
233 | void mac_inpcb_label_recycle(struct inpcb *inp); |
234 | void mac_inpcb_label_update(struct socket *so); |
235 | int mac_iokit_check_device(char *devtype, struct mac_module_data *mdata); |
236 | int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type); |
237 | int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties); |
238 | int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry); |
239 | int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name); |
240 | int mac_iokit_check_hid_control(kauth_cred_t cred); |
241 | void mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq); |
242 | int mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq); |
243 | void mac_ipq_label_destroy(struct ipq *ipq); |
244 | int mac_ipq_label_init(struct ipq *ipq, int flag); |
245 | void mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq); |
246 | void mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); |
247 | void mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m); |
248 | void mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m); |
249 | void mac_mbuf_label_associate_ipq(struct ipq *ipq, struct mbuf *mbuf); |
250 | void mac_mbuf_label_associate_linklayer(struct ifnet *ifp, struct mbuf *m); |
251 | void mac_mbuf_label_associate_multicast_encap(struct mbuf *oldmbuf, |
252 | struct ifnet *ifp, struct mbuf *newmbuf); |
253 | void mac_mbuf_label_associate_netlayer(struct mbuf *oldmbuf, |
254 | struct mbuf *newmbuf); |
255 | void mac_mbuf_label_associate_socket(struct socket *so, struct mbuf *m); |
256 | void mac_mbuf_label_copy(struct mbuf *m_from, struct mbuf *m_to); |
257 | void mac_mbuf_label_destroy(struct mbuf *m); |
258 | int mac_mbuf_label_init(struct mbuf *m, int flag); |
259 | void mac_mbuf_tag_copy(struct m_tag *m, struct m_tag *mtag); |
260 | void mac_mbuf_tag_destroy(struct m_tag *mtag); |
261 | int mac_mbuf_tag_init(struct m_tag *, int how); |
262 | int mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, |
263 | unsigned int cmd); |
264 | int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, |
265 | struct vfs_attr *vfa); |
266 | int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp); |
267 | int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, |
268 | struct componentname *cnp, const char *vfc_name); |
269 | int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp, |
270 | const char *name); |
271 | int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp, |
272 | const char *name); |
273 | int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp, |
274 | const char *name); |
275 | int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp); |
276 | int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, |
277 | struct vfs_attr *vfa); |
278 | int mac_mount_check_stat(vfs_context_t ctx, struct mount *mp); |
279 | int mac_mount_check_umount(vfs_context_t ctx, struct mount *mp); |
280 | void mac_mount_label_associate(vfs_context_t ctx, struct mount *mp); |
281 | void mac_mount_label_destroy(struct mount *mp); |
282 | int mac_mount_label_externalize(struct label *label, char *elements, |
283 | char *outbuf, size_t outbuflen); |
284 | int mac_mount_label_get(struct mount *mp, user_addr_t mac_p); |
285 | void mac_mount_label_init(struct mount *); |
286 | int mac_mount_label_internalize(struct label *, char *string); |
287 | void mac_netinet_fragment(struct mbuf *datagram, struct mbuf *fragment); |
288 | void mac_netinet_icmp_reply(struct mbuf *m); |
289 | void mac_netinet_tcp_reply(struct mbuf *m); |
290 | int mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe, |
291 | unsigned int cmd); |
292 | int mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn, |
293 | struct pipe *cpipe); |
294 | int mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe); |
295 | int mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe, |
296 | int which); |
297 | int mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe); |
298 | int mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe); |
299 | struct label *mac_pipe_label_alloc(void); |
300 | void mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe); |
301 | void mac_pipe_label_copy(struct label *src, struct label *dest); |
302 | void mac_pipe_label_destroy(struct pipe *cpipe); |
303 | void mac_pipe_label_free(struct label *label); |
304 | void mac_pipe_label_init(struct pipe *cpipe); |
305 | int mac_pipe_label_update(kauth_cred_t cred, struct pipe *cpipe, |
306 | struct label *label); |
307 | void mac_policy_initbsd(void); |
308 | int mac_posixsem_check_create(kauth_cred_t cred, const char *name); |
309 | int mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem); |
310 | int mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem); |
311 | int mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem, |
312 | const char *name); |
313 | int mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem); |
314 | void mac_posixsem_vnode_label_associate(kauth_cred_t cred, |
315 | struct pseminfo *psem, struct label *plabel, |
316 | vnode_t vp, struct label *vlabel); |
317 | void mac_posixsem_label_associate(kauth_cred_t cred, |
318 | struct pseminfo *psem, const char *name); |
319 | void mac_posixsem_label_destroy(struct pseminfo *psem); |
320 | void mac_posixsem_label_init(struct pseminfo *psem); |
321 | int mac_posixshm_check_create(kauth_cred_t cred, const char *name); |
322 | int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm, |
323 | int prot, int flags); |
324 | int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm, |
325 | int fflags); |
326 | int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm); |
327 | int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm, |
328 | off_t s); |
329 | int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm, |
330 | const char *name); |
331 | void mac_posixshm_vnode_label_associate(kauth_cred_t cred, |
332 | struct pshminfo *pshm, struct label *plabel, |
333 | vnode_t vp, struct label *vlabel); |
334 | void mac_posixshm_label_associate(kauth_cred_t cred, |
335 | struct pshminfo *pshm, const char *name); |
336 | void mac_posixshm_label_destroy(struct pshminfo *pshm); |
337 | void mac_posixshm_label_init(struct pshminfo *pshm); |
338 | int mac_priv_check(kauth_cred_t cred, int priv); |
339 | int mac_priv_grant(kauth_cred_t cred, int priv); |
340 | int mac_proc_check_debug(proc_t proc1, proc_t proc2); |
341 | int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor); |
342 | int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op); |
343 | int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op); |
344 | int mac_proc_check_fork(proc_t proc); |
345 | int mac_proc_check_suspend_resume(proc_t proc, int sr); |
346 | int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p); |
347 | int mac_proc_check_get_task(kauth_cred_t cred, struct proc *p); |
348 | int mac_proc_check_expose_task(kauth_cred_t cred, struct proc *p); |
349 | int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp); |
350 | int mac_proc_check_getaudit(proc_t proc); |
351 | int mac_proc_check_getauid(proc_t proc); |
352 | int mac_proc_check_getlcid(proc_t proc1, proc_t proc2, |
353 | pid_t pid); |
354 | int mac_proc_check_ledger(proc_t curp, proc_t target, int op); |
355 | int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr, |
356 | user_size_t u_size, int prot, int flags, int *maxprot); |
357 | int mac_proc_check_mprotect(proc_t proc, |
358 | user_addr_t addr, user_size_t size, int prot); |
359 | int mac_proc_check_run_cs_invalid(proc_t proc); |
360 | int mac_proc_check_sched(proc_t proc, proc_t proc2); |
361 | int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai); |
362 | int mac_proc_check_setauid(proc_t proc, uid_t auid); |
363 | int mac_proc_check_setlcid(proc_t proc1, proc_t proc2, |
364 | pid_t pid1, pid_t pid2); |
365 | int mac_proc_check_signal(proc_t proc1, proc_t proc2, |
366 | int signum); |
367 | int mac_proc_check_wait(proc_t proc1, proc_t proc2); |
368 | void mac_proc_notify_exit(proc_t proc); |
369 | int mac_setsockopt_label(kauth_cred_t cred, struct socket *so, |
370 | struct mac *extmac); |
371 | int mac_socket_check_accept(kauth_cred_t cred, struct socket *so); |
372 | int mac_socket_check_accepted(kauth_cred_t cred, struct socket *so); |
373 | int mac_socket_check_bind(kauth_cred_t cred, struct socket *so, |
374 | struct sockaddr *addr); |
375 | int mac_socket_check_connect(kauth_cred_t cred, struct socket *so, |
376 | struct sockaddr *addr); |
377 | int mac_socket_check_create(kauth_cred_t cred, int domain, |
378 | int type, int protocol); |
379 | int mac_socket_check_deliver(struct socket *so, struct mbuf *m); |
380 | int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so, |
381 | unsigned int cmd); |
382 | int mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn, |
383 | struct socket *so); |
384 | int mac_socket_check_listen(kauth_cred_t cred, struct socket *so); |
385 | int mac_socket_check_receive(kauth_cred_t cred, struct socket *so); |
386 | int mac_socket_check_received(kauth_cred_t cred, struct socket *so, |
387 | struct sockaddr *saddr); |
388 | int mac_socket_check_select(kauth_cred_t cred, struct socket *so, |
389 | int which); |
390 | int mac_socket_check_send(kauth_cred_t cred, struct socket *so, |
391 | struct sockaddr *addr); |
392 | int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so, |
393 | struct sockopt *sopt); |
394 | int mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so, |
395 | struct sockopt *sopt); |
396 | int mac_socket_check_stat(kauth_cred_t cred, struct socket *so); |
397 | void mac_socket_label_associate(kauth_cred_t cred, struct socket *so); |
398 | void mac_socket_label_associate_accept(struct socket *oldsocket, |
399 | struct socket *newsocket); |
400 | void mac_socket_label_copy(struct label *from, struct label *to); |
401 | void mac_socket_label_destroy(struct socket *); |
402 | int mac_socket_label_get(kauth_cred_t cred, struct socket *so, |
403 | struct mac *extmac); |
404 | int mac_socket_label_init(struct socket *, int waitok); |
405 | void mac_socketpeer_label_associate_mbuf(struct mbuf *m, struct socket *so); |
406 | void mac_socketpeer_label_associate_socket(struct socket *peersocket, |
407 | struct socket *socket_to_modify); |
408 | int mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so, |
409 | struct mac *extmac); |
410 | int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp); |
411 | int mac_system_check_audit(kauth_cred_t cred, void *record, int length); |
412 | int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp); |
413 | int mac_system_check_auditon(kauth_cred_t cred, int cmd); |
414 | int mac_system_check_chud(kauth_cred_t cred); |
415 | int mac_system_check_host_priv(kauth_cred_t cred); |
416 | int mac_system_check_info(kauth_cred_t, const char *info_type); |
417 | int mac_system_check_nfsd(kauth_cred_t cred); |
418 | int mac_system_check_reboot(kauth_cred_t cred, int howto); |
419 | int mac_system_check_settime(kauth_cred_t cred); |
420 | int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp); |
421 | int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp); |
422 | int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name, |
423 | u_int namelen, user_addr_t oldctl, size_t oldlen, |
424 | user_addr_t newctl, size_t newlen); |
425 | int mac_system_check_kas_info(kauth_cred_t cred, int selector); |
426 | void mac_sysvmsg_label_associate(kauth_cred_t cred, |
427 | struct msqid_kernel *msqptr, struct msg *msgptr); |
428 | void mac_sysvmsg_label_init(struct msg *msgptr); |
429 | void mac_sysvmsg_label_recycle(struct msg *msgptr); |
430 | int mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr, |
431 | struct msqid_kernel *msqptr); |
432 | int mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr); |
433 | int mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr); |
434 | int mac_sysvmsq_check_msqctl(kauth_cred_t cred, |
435 | struct msqid_kernel *msqptr, int cmd); |
436 | int mac_sysvmsq_check_msqget(kauth_cred_t cred, |
437 | struct msqid_kernel *msqptr); |
438 | int mac_sysvmsq_check_msqrcv(kauth_cred_t cred, |
439 | struct msqid_kernel *msqptr); |
440 | int mac_sysvmsq_check_msqsnd(kauth_cred_t cred, |
441 | struct msqid_kernel *msqptr); |
442 | void mac_sysvmsq_label_associate(kauth_cred_t cred, |
443 | struct msqid_kernel *msqptr); |
444 | void mac_sysvmsq_label_init(struct msqid_kernel *msqptr); |
445 | void mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr); |
446 | int mac_sysvsem_check_semctl(kauth_cred_t cred, |
447 | struct semid_kernel *semakptr, int cmd); |
448 | int mac_sysvsem_check_semget(kauth_cred_t cred, |
449 | struct semid_kernel *semakptr); |
450 | int mac_sysvsem_check_semop(kauth_cred_t cred, |
451 | struct semid_kernel *semakptr, size_t accesstype); |
452 | void mac_sysvsem_label_associate(kauth_cred_t cred, |
453 | struct semid_kernel *semakptr); |
454 | void mac_sysvsem_label_destroy(struct semid_kernel *semakptr); |
455 | void mac_sysvsem_label_init(struct semid_kernel *semakptr); |
456 | void mac_sysvsem_label_recycle(struct semid_kernel *semakptr); |
457 | int mac_sysvshm_check_shmat(kauth_cred_t cred, |
458 | struct shmid_kernel *shmsegptr, int shmflg); |
459 | int mac_sysvshm_check_shmctl(kauth_cred_t cred, |
460 | struct shmid_kernel *shmsegptr, int cmd); |
461 | int mac_sysvshm_check_shmdt(kauth_cred_t cred, |
462 | struct shmid_kernel *shmsegptr); |
463 | int mac_sysvshm_check_shmget(kauth_cred_t cred, |
464 | struct shmid_kernel *shmsegptr, int shmflg); |
465 | void mac_sysvshm_label_associate(kauth_cred_t cred, |
466 | struct shmid_kernel *shmsegptr); |
467 | void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr); |
468 | void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr); |
469 | void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr); |
470 | int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, |
471 | int acc_mode); |
472 | int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp); |
473 | int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, |
474 | struct componentname *cnp); |
475 | int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp, |
476 | struct vnode *vp, struct componentname *cnp); |
477 | int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, |
478 | struct componentname *cnp, struct vnode_attr *vap); |
479 | int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, |
480 | const char *name); |
481 | int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, |
482 | struct vnode *v2); |
483 | int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, |
484 | struct image_params *imgp); |
485 | int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp); |
486 | int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred, |
487 | struct vnode *vp, struct vnode_attr *va); |
488 | int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, |
489 | struct attrlist *alist); |
490 | int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, |
491 | const char *name, struct uio *uio); |
492 | int mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, |
493 | unsigned int cmd); |
494 | int mac_vnode_check_kqfilter(vfs_context_t ctx, |
495 | kauth_cred_t file_cred, struct knote *kn, struct vnode *vp); |
496 | int mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp, |
497 | struct label *newlabel); |
498 | int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, |
499 | struct vnode *vp, struct componentname *cnp); |
500 | int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp); |
501 | int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, |
502 | struct componentname *cnp); |
503 | int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp, |
504 | const char *path, size_t pathlen); |
505 | int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, |
506 | int acc_mode); |
507 | int mac_vnode_check_read(vfs_context_t ctx, |
508 | kauth_cred_t file_cred, struct vnode *vp); |
509 | int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp); |
510 | int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp); |
511 | int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp, |
512 | struct vnode *vp, struct componentname *cnp, struct vnode *tdvp, |
513 | struct vnode *tvp, struct componentname *tcnp); |
514 | int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp); |
515 | int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, |
516 | struct attrlist *alist); |
517 | int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, |
518 | int which); |
519 | int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, |
520 | struct kauth_acl *acl); |
521 | int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp, |
522 | struct attrlist *alist); |
523 | int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, |
524 | const char *name, struct uio *uio); |
525 | int mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, |
526 | u_long flags); |
527 | int mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, |
528 | mode_t mode); |
529 | int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, |
530 | uid_t uid, gid_t gid); |
531 | int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, |
532 | struct timespec atime, struct timespec mtime); |
533 | int mac_vnode_check_signature(struct vnode *vp, |
534 | struct cs_blob *cs_blob, struct image_params *imgp, |
535 | unsigned int *cs_flags, unsigned int *signer_type, |
536 | int flags); |
537 | int mac_vnode_check_stat(vfs_context_t ctx, |
538 | kauth_cred_t file_cred, struct vnode *vp); |
539 | int mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp, |
540 | struct componentname *cnp); |
541 | int mac_vnode_check_truncate(vfs_context_t ctx, |
542 | kauth_cred_t file_cred, struct vnode *vp); |
543 | int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, |
544 | struct componentname *cnp, struct vnode_attr *vap); |
545 | int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so); |
546 | int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, |
547 | struct vnode *vp, struct componentname *cnp); |
548 | int mac_vnode_check_write(vfs_context_t ctx, |
549 | kauth_cred_t file_cred, struct vnode *vp); |
550 | struct label *mac_vnode_label_alloc(void); |
551 | int mac_vnode_label_associate(struct mount *mp, struct vnode *vp, |
552 | vfs_context_t ctx); |
553 | void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de, |
554 | struct vnode *vp); |
555 | int mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp); |
556 | int mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, |
557 | struct vnode *vp, vfs_context_t ctx); |
558 | void mac_vnode_label_associate_singlelabel(struct mount *mp, |
559 | struct vnode *vp); |
560 | void mac_vnode_label_copy(struct label *l1, struct label *l2); |
561 | void mac_vnode_label_destroy(struct vnode *vp); |
562 | int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac); |
563 | void mac_vnode_label_free(struct label *label); |
564 | void mac_vnode_label_init(struct vnode *vp); |
565 | int mac_vnode_label_init_needed(struct vnode *vp); |
566 | void mac_vnode_label_recycle(struct vnode *vp); |
567 | void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, |
568 | struct label *newlabel); |
569 | void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, |
570 | const char *name); |
571 | int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, |
572 | struct vnode *dvp, struct vnode *vp, struct componentname *cnp); |
573 | void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name); |
574 | void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, |
575 | struct vnode *dvp, struct componentname *cnp); |
576 | void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); |
577 | void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, |
578 | struct vnode *dvp, struct componentname *cnp); |
579 | void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl); |
580 | void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist); |
581 | void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio); |
582 | void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags); |
583 | void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode); |
584 | void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid); |
585 | void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime); |
586 | void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp); |
587 | int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho); |
588 | int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, |
589 | struct componentname *cnp, int flags, vfs_context_t ctx); |
590 | void vnode_relabel(struct vnode *vp); |
591 | void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label); |
592 | void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label); |
593 | int mac_kext_check_load(kauth_cred_t cred, const char *identifier); |
594 | int mac_kext_check_unload(kauth_cred_t cred, const char *identifier); |
595 | int mac_kext_check_query(kauth_cred_t cred); |
596 | int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol); |
597 | int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol); |
598 | |
599 | void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); |
600 | void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); |
601 | |
602 | #if CONFIG_MACF_NET |
603 | struct label *mac_bpfdesc_label_get(struct bpf_d *d); |
604 | void mac_bpfdesc_label_set(struct bpf_d *d, struct label *label); |
605 | #endif |
606 | |
607 | #endif /* CONFIG_MACF */ |
608 | |
609 | #endif /* !_SECURITY_MAC_FRAMEWORK_H_ */ |
610 | |