1/*
2 * Copyright (c) 2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*-
29 * Copyright (c) 1999-2002 Robert N. M. Watson
30 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
31 * Copyright (c) 2005-2007 SPARTA, Inc.
32 * All rights reserved.
33 *
34 * This software was developed by Robert Watson for the TrustedBSD Project.
35 *
36 * This software was developed for the FreeBSD Project in part by Network
37 * Associates Laboratories, the Security Research Division of Network
38 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
39 * as part of the DARPA CHATS research program.
40 *
41 * This software was enhanced by SPARTA ISSO under SPAWAR contract
42 * N66001-04-C-6019 ("SEFOS").
43 *
44 * Redistribution and use in source and binary forms, with or without
45 * modification, are permitted provided that the following conditions
46 * are met:
47 * 1. Redistributions of source code must retain the above copyright
48 * notice, this list of conditions and the following disclaimer.
49 * 2. Redistributions in binary form must reproduce the above copyright
50 * notice, this list of conditions and the following disclaimer in the
51 * documentation and/or other materials provided with the distribution.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $
66 *
67 */
68/*
69 * Kernel interface for Mandatory Access Control -- how kernel services
70 * interact with the TrustedBSD MAC Framework.
71 */
72
73#ifndef _SECURITY_MAC_FRAMEWORK_H_
74#define _SECURITY_MAC_FRAMEWORK_H_
75
76#ifndef KERNEL
77#error "no user-serviceable parts inside"
78#endif
79
80#ifndef PRIVATE
81#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
82#endif
83
84struct attrlist;
85struct auditinfo;
86struct bpf_d;
87struct componentname;
88struct cs_blob;
89struct devnode;
90struct exception_action;
91struct flock;
92struct fdescnode;
93struct fileglob;
94struct fileproc;
95struct ifnet;
96struct ifreq;
97struct image_params;
98struct inpcb;
99struct ipc_port;
100struct ipq;
101struct knote;
102struct m_tag;
103struct mac;
104struct mac_module_data;
105struct mbuf;
106struct msg;
107struct msqid_kernel;
108struct mount;
109struct pipe;
110struct proc;
111struct pseminfo;
112struct pshminfo;
113struct semid_kernel;
114struct shmid_kernel;
115struct sockaddr;
116struct sockopt;
117struct socket;
118struct task;
119struct thread;
120struct timespec;
121struct tty;
122struct ucred;
123struct uio;
124struct uthread;
125struct vfs_attr;
126struct vfs_context;
127struct vnode;
128struct vnode_attr;
129struct vop_setlabel_args;
130
131#include <sys/kauth.h>
132#include <sys/kernel_types.h>
133
134#if CONFIG_MACF
135
136#ifndef __IOKIT_PORTS_DEFINED__
137#define __IOKIT_PORTS_DEFINED__
138#ifdef __cplusplus
139class OSObject;
140typedef OSObject *io_object_t;
141#else
142struct OSObject;
143typedef struct OSObject *io_object_t;
144#endif
145#endif /* __IOKIT_PORTS_DEFINED__ */
146
147/*@ macros */
148#define VNODE_LABEL_CREATE 1
149
150/*@ === */
151int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode,
152 void *args, int error, int retval, int mac_forced);
153int mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode,
154 void *args);
155int mac_bpfdesc_check_receive(struct bpf_d *bpf_d, struct ifnet *ifp);
156void mac_bpfdesc_label_destroy(struct bpf_d *bpf_d);
157void mac_bpfdesc_label_init(struct bpf_d *bpf_d);
158void mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d);
159int mac_cred_check_label_update(kauth_cred_t cred,
160 struct label *newlabel);
161int mac_cred_check_label_update_execve(vfs_context_t ctx,
162 struct vnode *vp, off_t offset, struct vnode *scriptvp,
163 struct label *scriptvnodelabel, struct label *execlabel,
164 proc_t proc, void *macextensions);
165int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2);
166struct label *mac_cred_label_alloc(void);
167void mac_cred_label_associate(kauth_cred_t cred_parent,
168 kauth_cred_t cred_child);
169void mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child);
170void mac_cred_label_associate_kernel(kauth_cred_t cred);
171void mac_cred_label_associate_user(kauth_cred_t cred);
172void mac_cred_label_destroy(kauth_cred_t cred);
173int mac_cred_label_externalize_audit(proc_t p, struct mac *mac);
174void mac_cred_label_free(struct label *label);
175void mac_cred_label_init(kauth_cred_t cred);
176int mac_cred_label_compare(struct label *a, struct label *b);
177void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
178void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
179 struct vnode *vp, off_t offset, struct vnode *scriptvp,
180 struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags,
181 void *macextensions, int *disjoint, int *labelupdateerror);
182void mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
183 const char *fullpath);
184void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
185 struct devnode *de, const char *fullpath);
186void mac_devfs_label_copy(struct label *, struct label *label);
187void mac_devfs_label_destroy(struct devnode *de);
188void mac_devfs_label_init(struct devnode *de);
189void mac_devfs_label_update(struct mount *mp, struct devnode *de,
190 struct vnode *vp);
191int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp);
192int mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg);
193int mac_file_check_create(kauth_cred_t cred);
194int mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd);
195int mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd,
196 user_long_t arg);
197int mac_file_check_get(kauth_cred_t cred, struct fileglob *fg,
198 char *elements, int len);
199int mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg);
200int mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg);
201int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg,
202 unsigned int cmd);
203int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op,
204 struct flock *fl);
205int mac_file_check_library_validation(struct proc *proc,
206 struct fileglob *fg, off_t slice_offset,
207 user_long_t error_message, size_t error_message_size);
208int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg,
209 int prot, int flags, uint64_t file_pos, int *maxprot);
210void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg,
211 int *prot);
212int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg);
213int mac_file_check_set(kauth_cred_t cred, struct fileglob *fg,
214 char *bufp, int buflen);
215void mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg);
216void mac_file_label_destroy(struct fileglob *fg);
217void mac_file_label_init(struct fileglob *fg);
218int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf,
219 int family, int type);
220void mac_ifnet_label_associate(struct ifnet *ifp);
221void mac_ifnet_label_destroy(struct ifnet *ifp);
222int mac_ifnet_label_get(kauth_cred_t cred, struct ifreq *ifr,
223 struct ifnet *ifp);
224void mac_ifnet_label_init(struct ifnet *ifp);
225void mac_ifnet_label_recycle(struct ifnet *ifp);
226int mac_ifnet_label_set(kauth_cred_t cred, struct ifreq *ifr,
227 struct ifnet *ifp);
228int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf,
229 int family, int type);
230void mac_inpcb_label_associate(struct socket *so, struct inpcb *inp);
231void mac_inpcb_label_destroy(struct inpcb *inp);
232int mac_inpcb_label_init(struct inpcb *inp, int flag);
233void mac_inpcb_label_recycle(struct inpcb *inp);
234void mac_inpcb_label_update(struct socket *so);
235int mac_iokit_check_device(char *devtype, struct mac_module_data *mdata);
236int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type);
237int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties);
238int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry);
239int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name);
240int mac_iokit_check_hid_control(kauth_cred_t cred);
241void mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq);
242int mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq);
243void mac_ipq_label_destroy(struct ipq *ipq);
244int mac_ipq_label_init(struct ipq *ipq, int flag);
245void mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq);
246void mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m);
247void mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m);
248void mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m);
249void mac_mbuf_label_associate_ipq(struct ipq *ipq, struct mbuf *mbuf);
250void mac_mbuf_label_associate_linklayer(struct ifnet *ifp, struct mbuf *m);
251void mac_mbuf_label_associate_multicast_encap(struct mbuf *oldmbuf,
252 struct ifnet *ifp, struct mbuf *newmbuf);
253void mac_mbuf_label_associate_netlayer(struct mbuf *oldmbuf,
254 struct mbuf *newmbuf);
255void mac_mbuf_label_associate_socket(struct socket *so, struct mbuf *m);
256void mac_mbuf_label_copy(struct mbuf *m_from, struct mbuf *m_to);
257void mac_mbuf_label_destroy(struct mbuf *m);
258int mac_mbuf_label_init(struct mbuf *m, int flag);
259void mac_mbuf_tag_copy(struct m_tag *m, struct m_tag *mtag);
260void mac_mbuf_tag_destroy(struct m_tag *mtag);
261int mac_mbuf_tag_init(struct m_tag *, int how);
262int mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp,
263 unsigned int cmd);
264int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp,
265 struct vfs_attr *vfa);
266int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp);
267int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp,
268 struct componentname *cnp, const char *vfc_name);
269int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp,
270 const char *name);
271int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp,
272 const char *name);
273int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp,
274 const char *name);
275int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp);
276int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp,
277 struct vfs_attr *vfa);
278int mac_mount_check_stat(vfs_context_t ctx, struct mount *mp);
279int mac_mount_check_umount(vfs_context_t ctx, struct mount *mp);
280void mac_mount_label_associate(vfs_context_t ctx, struct mount *mp);
281void mac_mount_label_destroy(struct mount *mp);
282int mac_mount_label_externalize(struct label *label, char *elements,
283 char *outbuf, size_t outbuflen);
284int mac_mount_label_get(struct mount *mp, user_addr_t mac_p);
285void mac_mount_label_init(struct mount *);
286int mac_mount_label_internalize(struct label *, char *string);
287void mac_netinet_fragment(struct mbuf *datagram, struct mbuf *fragment);
288void mac_netinet_icmp_reply(struct mbuf *m);
289void mac_netinet_tcp_reply(struct mbuf *m);
290int mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe,
291 unsigned int cmd);
292int mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn,
293 struct pipe *cpipe);
294int mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe);
295int mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe,
296 int which);
297int mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe);
298int mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe);
299struct label *mac_pipe_label_alloc(void);
300void mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe);
301void mac_pipe_label_copy(struct label *src, struct label *dest);
302void mac_pipe_label_destroy(struct pipe *cpipe);
303void mac_pipe_label_free(struct label *label);
304void mac_pipe_label_init(struct pipe *cpipe);
305int mac_pipe_label_update(kauth_cred_t cred, struct pipe *cpipe,
306 struct label *label);
307void mac_policy_initbsd(void);
308int mac_posixsem_check_create(kauth_cred_t cred, const char *name);
309int mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem);
310int mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem);
311int mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem,
312 const char *name);
313int mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem);
314void mac_posixsem_vnode_label_associate(kauth_cred_t cred,
315 struct pseminfo *psem, struct label *plabel,
316 vnode_t vp, struct label *vlabel);
317void mac_posixsem_label_associate(kauth_cred_t cred,
318 struct pseminfo *psem, const char *name);
319void mac_posixsem_label_destroy(struct pseminfo *psem);
320void mac_posixsem_label_init(struct pseminfo *psem);
321int mac_posixshm_check_create(kauth_cred_t cred, const char *name);
322int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm,
323 int prot, int flags);
324int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm,
325 int fflags);
326int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm);
327int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm,
328 off_t s);
329int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm,
330 const char *name);
331void mac_posixshm_vnode_label_associate(kauth_cred_t cred,
332 struct pshminfo *pshm, struct label *plabel,
333 vnode_t vp, struct label *vlabel);
334void mac_posixshm_label_associate(kauth_cred_t cred,
335 struct pshminfo *pshm, const char *name);
336void mac_posixshm_label_destroy(struct pshminfo *pshm);
337void mac_posixshm_label_init(struct pshminfo *pshm);
338int mac_priv_check(kauth_cred_t cred, int priv);
339int mac_priv_grant(kauth_cred_t cred, int priv);
340int mac_proc_check_debug(proc_t proc1, proc_t proc2);
341int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor);
342int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op);
343int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op);
344int mac_proc_check_fork(proc_t proc);
345int mac_proc_check_suspend_resume(proc_t proc, int sr);
346int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p);
347int mac_proc_check_get_task(kauth_cred_t cred, struct proc *p);
348int mac_proc_check_expose_task(kauth_cred_t cred, struct proc *p);
349int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp);
350int mac_proc_check_getaudit(proc_t proc);
351int mac_proc_check_getauid(proc_t proc);
352int mac_proc_check_getlcid(proc_t proc1, proc_t proc2,
353 pid_t pid);
354int mac_proc_check_ledger(proc_t curp, proc_t target, int op);
355int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr,
356 user_size_t u_size, int prot, int flags, int *maxprot);
357int mac_proc_check_mprotect(proc_t proc,
358 user_addr_t addr, user_size_t size, int prot);
359int mac_proc_check_run_cs_invalid(proc_t proc);
360int mac_proc_check_sched(proc_t proc, proc_t proc2);
361int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai);
362int mac_proc_check_setauid(proc_t proc, uid_t auid);
363int mac_proc_check_setlcid(proc_t proc1, proc_t proc2,
364 pid_t pid1, pid_t pid2);
365int mac_proc_check_signal(proc_t proc1, proc_t proc2,
366 int signum);
367int mac_proc_check_wait(proc_t proc1, proc_t proc2);
368void mac_proc_notify_exit(proc_t proc);
369int mac_setsockopt_label(kauth_cred_t cred, struct socket *so,
370 struct mac *extmac);
371int mac_socket_check_accept(kauth_cred_t cred, struct socket *so);
372int mac_socket_check_accepted(kauth_cred_t cred, struct socket *so);
373int mac_socket_check_bind(kauth_cred_t cred, struct socket *so,
374 struct sockaddr *addr);
375int mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
376 struct sockaddr *addr);
377int mac_socket_check_create(kauth_cred_t cred, int domain,
378 int type, int protocol);
379int mac_socket_check_deliver(struct socket *so, struct mbuf *m);
380int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
381 unsigned int cmd);
382int mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
383 struct socket *so);
384int mac_socket_check_listen(kauth_cred_t cred, struct socket *so);
385int mac_socket_check_receive(kauth_cred_t cred, struct socket *so);
386int mac_socket_check_received(kauth_cred_t cred, struct socket *so,
387 struct sockaddr *saddr);
388int mac_socket_check_select(kauth_cred_t cred, struct socket *so,
389 int which);
390int mac_socket_check_send(kauth_cred_t cred, struct socket *so,
391 struct sockaddr *addr);
392int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
393 struct sockopt *sopt);
394int mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
395 struct sockopt *sopt);
396int mac_socket_check_stat(kauth_cred_t cred, struct socket *so);
397void mac_socket_label_associate(kauth_cred_t cred, struct socket *so);
398void mac_socket_label_associate_accept(struct socket *oldsocket,
399 struct socket *newsocket);
400void mac_socket_label_copy(struct label *from, struct label *to);
401void mac_socket_label_destroy(struct socket *);
402int mac_socket_label_get(kauth_cred_t cred, struct socket *so,
403 struct mac *extmac);
404int mac_socket_label_init(struct socket *, int waitok);
405void mac_socketpeer_label_associate_mbuf(struct mbuf *m, struct socket *so);
406void mac_socketpeer_label_associate_socket(struct socket *peersocket,
407 struct socket *socket_to_modify);
408int mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so,
409 struct mac *extmac);
410int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp);
411int mac_system_check_audit(kauth_cred_t cred, void *record, int length);
412int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp);
413int mac_system_check_auditon(kauth_cred_t cred, int cmd);
414int mac_system_check_chud(kauth_cred_t cred);
415int mac_system_check_host_priv(kauth_cred_t cred);
416int mac_system_check_info(kauth_cred_t, const char *info_type);
417int mac_system_check_nfsd(kauth_cred_t cred);
418int mac_system_check_reboot(kauth_cred_t cred, int howto);
419int mac_system_check_settime(kauth_cred_t cred);
420int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp);
421int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp);
422int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name,
423 u_int namelen, user_addr_t oldctl, size_t oldlen,
424 user_addr_t newctl, size_t newlen);
425int mac_system_check_kas_info(kauth_cred_t cred, int selector);
426void mac_sysvmsg_label_associate(kauth_cred_t cred,
427 struct msqid_kernel *msqptr, struct msg *msgptr);
428void mac_sysvmsg_label_init(struct msg *msgptr);
429void mac_sysvmsg_label_recycle(struct msg *msgptr);
430int mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr,
431 struct msqid_kernel *msqptr);
432int mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr);
433int mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr);
434int mac_sysvmsq_check_msqctl(kauth_cred_t cred,
435 struct msqid_kernel *msqptr, int cmd);
436int mac_sysvmsq_check_msqget(kauth_cred_t cred,
437 struct msqid_kernel *msqptr);
438int mac_sysvmsq_check_msqrcv(kauth_cred_t cred,
439 struct msqid_kernel *msqptr);
440int mac_sysvmsq_check_msqsnd(kauth_cred_t cred,
441 struct msqid_kernel *msqptr);
442void mac_sysvmsq_label_associate(kauth_cred_t cred,
443 struct msqid_kernel *msqptr);
444void mac_sysvmsq_label_init(struct msqid_kernel *msqptr);
445void mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr);
446int mac_sysvsem_check_semctl(kauth_cred_t cred,
447 struct semid_kernel *semakptr, int cmd);
448int mac_sysvsem_check_semget(kauth_cred_t cred,
449 struct semid_kernel *semakptr);
450int mac_sysvsem_check_semop(kauth_cred_t cred,
451 struct semid_kernel *semakptr, size_t accesstype);
452void mac_sysvsem_label_associate(kauth_cred_t cred,
453 struct semid_kernel *semakptr);
454void mac_sysvsem_label_destroy(struct semid_kernel *semakptr);
455void mac_sysvsem_label_init(struct semid_kernel *semakptr);
456void mac_sysvsem_label_recycle(struct semid_kernel *semakptr);
457int mac_sysvshm_check_shmat(kauth_cred_t cred,
458 struct shmid_kernel *shmsegptr, int shmflg);
459int mac_sysvshm_check_shmctl(kauth_cred_t cred,
460 struct shmid_kernel *shmsegptr, int cmd);
461int mac_sysvshm_check_shmdt(kauth_cred_t cred,
462 struct shmid_kernel *shmsegptr);
463int mac_sysvshm_check_shmget(kauth_cred_t cred,
464 struct shmid_kernel *shmsegptr, int shmflg);
465void mac_sysvshm_label_associate(kauth_cred_t cred,
466 struct shmid_kernel *shmsegptr);
467void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr);
468void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr);
469void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr);
470int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
471 int acc_mode);
472int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp);
473int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp,
474 struct componentname *cnp);
475int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp,
476 struct vnode *vp, struct componentname *cnp);
477int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp,
478 struct componentname *cnp, struct vnode_attr *vap);
479int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp,
480 const char *name);
481int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1,
482 struct vnode *v2);
483int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
484 struct image_params *imgp);
485int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp);
486int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred,
487 struct vnode *vp, struct vnode_attr *va);
488int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
489 struct attrlist *alist);
490int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
491 const char *name, struct uio *uio);
492int mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp,
493 unsigned int cmd);
494int mac_vnode_check_kqfilter(vfs_context_t ctx,
495 kauth_cred_t file_cred, struct knote *kn, struct vnode *vp);
496int mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp,
497 struct label *newlabel);
498int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp,
499 struct vnode *vp, struct componentname *cnp);
500int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp);
501int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp,
502 struct componentname *cnp);
503int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp,
504 const char *path, size_t pathlen);
505int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp,
506 int acc_mode);
507int mac_vnode_check_read(vfs_context_t ctx,
508 kauth_cred_t file_cred, struct vnode *vp);
509int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp);
510int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp);
511int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp,
512 struct vnode *vp, struct componentname *cnp, struct vnode *tdvp,
513 struct vnode *tvp, struct componentname *tcnp);
514int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp);
515int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp,
516 struct attrlist *alist);
517int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp,
518 int which);
519int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp,
520 struct kauth_acl *acl);
521int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp,
522 struct attrlist *alist);
523int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp,
524 const char *name, struct uio *uio);
525int mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp,
526 u_long flags);
527int mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp,
528 mode_t mode);
529int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp,
530 uid_t uid, gid_t gid);
531int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
532 struct timespec atime, struct timespec mtime);
533int mac_vnode_check_signature(struct vnode *vp,
534 struct cs_blob *cs_blob, struct image_params *imgp,
535 unsigned int *cs_flags, unsigned int *signer_type,
536 int flags);
537int mac_vnode_check_stat(vfs_context_t ctx,
538 kauth_cred_t file_cred, struct vnode *vp);
539int mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp,
540 struct componentname *cnp);
541int mac_vnode_check_truncate(vfs_context_t ctx,
542 kauth_cred_t file_cred, struct vnode *vp);
543int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
544 struct componentname *cnp, struct vnode_attr *vap);
545int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so);
546int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
547 struct vnode *vp, struct componentname *cnp);
548int mac_vnode_check_write(vfs_context_t ctx,
549 kauth_cred_t file_cred, struct vnode *vp);
550struct label *mac_vnode_label_alloc(void);
551int mac_vnode_label_associate(struct mount *mp, struct vnode *vp,
552 vfs_context_t ctx);
553void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de,
554 struct vnode *vp);
555int mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp);
556int mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp,
557 struct vnode *vp, vfs_context_t ctx);
558void mac_vnode_label_associate_singlelabel(struct mount *mp,
559 struct vnode *vp);
560void mac_vnode_label_copy(struct label *l1, struct label *l2);
561void mac_vnode_label_destroy(struct vnode *vp);
562int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac);
563void mac_vnode_label_free(struct label *label);
564void mac_vnode_label_init(struct vnode *vp);
565int mac_vnode_label_init_needed(struct vnode *vp);
566void mac_vnode_label_recycle(struct vnode *vp);
567void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
568 struct label *newlabel);
569void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp,
570 const char *name);
571int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
572 struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
573void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name);
574void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
575 struct vnode *dvp, struct componentname *cnp);
576void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
577void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp,
578 struct vnode *dvp, struct componentname *cnp);
579void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl);
580void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist);
581void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio);
582void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags);
583void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode);
584void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid);
585void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime);
586void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp);
587int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho);
588int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
589 struct componentname *cnp, int flags, vfs_context_t ctx);
590void vnode_relabel(struct vnode *vp);
591void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
592void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
593int mac_kext_check_load(kauth_cred_t cred, const char *identifier);
594int mac_kext_check_unload(kauth_cred_t cred, const char *identifier);
595int mac_kext_check_query(kauth_cred_t cred);
596int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol);
597int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol);
598
599void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
600void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
601
602#if CONFIG_MACF_NET
603struct label *mac_bpfdesc_label_get(struct bpf_d *d);
604void mac_bpfdesc_label_set(struct bpf_d *d, struct label *label);
605#endif
606
607#endif /* CONFIG_MACF */
608
609#endif /* !_SECURITY_MAC_FRAMEWORK_H_ */
610