1 | /* |
2 | * Copyright (c) 2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _SYS_GUARDED_H_ |
30 | #define _SYS_GUARDED_H_ |
31 | |
32 | #include <sys/types.h> |
33 | #include <sys/cdefs.h> |
34 | |
35 | #include <sys/_types/_iovec_t.h> |
36 | #ifdef PRIVATE |
37 | |
38 | __BEGIN_DECLS |
39 | |
40 | #if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE) |
41 | |
42 | #ifndef _GUARDID_T |
43 | #define _GUARDID_T |
44 | typedef __uint64_t guardid_t; |
45 | #endif /* _GUARDID_T */ |
46 | |
47 | #if !defined(KERNEL) |
48 | extern int guarded_open_np(const char *path, |
49 | const guardid_t *guard, u_int guardflags, int flags, ...); |
50 | extern int guarded_open_dprotected_np(const char *path, |
51 | const guardid_t *guard, u_int guardflags, int flags, |
52 | int dpclass, int dpflags, ...); |
53 | extern int guarded_kqueue_np(const guardid_t *guard, u_int guardflags); |
54 | extern int guarded_close_np(int fd, const guardid_t *guard); |
55 | extern int change_fdguard_np(int fd, const guardid_t *guard, u_int guardflags, |
56 | const guardid_t *nguard, u_int nguardflags, int *fdflagsp); |
57 | extern ssize_t guarded_write_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte); |
58 | extern ssize_t guarded_pwrite_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte, off_t offset); |
59 | extern ssize_t guarded_writev_np(int fd, const guardid_t *guard, const struct iovec *iovp, int iovcnt); |
60 | #endif /* KERNEL */ |
61 | |
62 | #ifndef GUARD_TYPE_FD |
63 | /* temporary source compat: use <kern/exc_guard.h> instead */ |
64 | #define GUARD_TYPE_FD 0x2 |
65 | #endif |
66 | |
67 | /* |
68 | * File descriptor guard flavors. |
69 | */ |
70 | |
71 | /* |
72 | * Forbid close(2), and the implicit close() that a dup2(2) may do. |
73 | * Forces close-on-fork to be set immutably too. |
74 | */ |
75 | #define GUARD_CLOSE (1u << 0) |
76 | |
77 | /* |
78 | * Forbid dup(2), dup2(2), and fcntl(2) subcodes F_DUPFD, F_DUPFD_CLOEXEC |
79 | * on a guarded fd. Also forbids open's of a guarded fd via /dev/fd/ |
80 | * (an implicit dup.) |
81 | */ |
82 | #define GUARD_DUP (1u << 1) |
83 | |
84 | /* |
85 | * Forbid sending a guarded fd via a socket |
86 | */ |
87 | #define GUARD_SOCKET_IPC (1u << 2) |
88 | |
89 | /* |
90 | * Forbid creating a fileport from a guarded fd |
91 | */ |
92 | #define GUARD_FILEPORT (1u << 3) |
93 | |
94 | /* |
95 | * Forbid writes on a guarded fd |
96 | */ |
97 | #define GUARD_WRITE (1u << 4) |
98 | |
99 | /* |
100 | * Violating a guard results in an error (EPERM), and potentially |
101 | * an exception with one or more of the following bits set. |
102 | */ |
103 | enum guard_fd_exception_codes { |
104 | kGUARD_EXC_CLOSE = 1u << 0, /* close of a guarded fd */ |
105 | kGUARD_EXC_DUP = 1u << 1, /* dup of a guarded fd */ |
106 | kGUARD_EXC_NOCLOEXEC = 1u << 2, /* clear close-on-exec */ |
107 | kGUARD_EXC_SOCKET_IPC = 1u << 3, /* sendmsg of a guarded fd */ |
108 | kGUARD_EXC_FILEPORT = 1u << 4, /* fileport_makeport .. */ |
109 | kGUARD_EXC_MISMATCH = 1u << 5, /* wrong guard for guarded fd */ |
110 | kGUARD_EXC_WRITE = 1u << 6 /* write on a guarded fd */ |
111 | }; |
112 | |
113 | /* |
114 | * Experimental guarded vnode support |
115 | */ |
116 | #define VNG_RENAME_TO (1u << 0) |
117 | #define VNG_RENAME_FROM (1u << 1) |
118 | #define VNG_UNLINK (1u << 2) |
119 | #define VNG_WRITE_OTHER (1u << 3) |
120 | #define VNG_TRUNC_OTHER (1u << 4) |
121 | #define VNG_LINK (1u << 5) |
122 | #define VNG_EXCHDATA (1u << 6) |
123 | |
124 | #define VNG_ALL \ |
125 | (VNG_RENAME_TO | VNG_RENAME_FROM | VNG_UNLINK | VNG_LINK | \ |
126 | VNG_WRITE_OTHER | VNG_TRUNC_OTHER | VNG_EXCHDATA) |
127 | |
128 | struct vnguard_set { |
129 | int vns_fd; |
130 | unsigned vns_attrs; |
131 | guardid_t vns_guard; |
132 | }; |
133 | |
134 | #define VNG_SYSC_PING 0 |
135 | #define VNG_SYSC_SET_GUARD 1 |
136 | |
137 | #define VNG_POLICY_NAME "vnguard" |
138 | |
139 | /* |
140 | * Violating a guard may result in an error (EPERM), and potentially |
141 | * an exception with one or more of the following bits set. |
142 | */ |
143 | enum guard_vn_exception_codes { |
144 | kGUARD_EXC_RENAME_TO = VNG_RENAME_TO, |
145 | kGUARD_EXC_RENAME_FROM = VNG_RENAME_FROM, |
146 | kGUARD_EXC_UNLINK = VNG_UNLINK, |
147 | kGUARD_EXC_WRITE_OTHER = VNG_WRITE_OTHER, |
148 | kGUARD_EXC_TRUNC_OTHER = VNG_TRUNC_OTHER, |
149 | kGUARD_EXC_LINK = VNG_LINK, |
150 | kGUARD_EXC_EXCHDATA = VNG_EXCHDATA, |
151 | }; |
152 | |
153 | /* Guard violation behaviors: not all combinations make sense */ |
154 | |
155 | #define kVNG_POLICY_LOGMSG (1u << 0) |
156 | #define kVNG_POLICY_EPERM (1u << 1) |
157 | #define kVNG_POLICY_EXC (1u << 2) |
158 | #define kVNG_POLICY_EXC_CORPSE (1u << 3) |
159 | #define kVNG_POLICY_SIGKILL (1u << 4) |
160 | #define kVNG_POLICY_UPRINTMSG (1u << 5) |
161 | |
162 | #if defined(KERNEL) |
163 | extern int vnguard_exceptions_active(void); |
164 | extern void vnguard_policy_init(void); |
165 | #endif /* KERNEL */ |
166 | |
167 | #endif /* (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */ |
168 | |
169 | __END_DECLS |
170 | |
171 | #endif /* PRIVATE */ |
172 | |
173 | #endif /* !_SYS_GUARDED_H_ */ |
174 | |