1 | /* |
2 | * Copyright (c) 2007 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /*- |
29 | * Copyright (c) 2006 SPARTA, Inc. |
30 | * All rights reserved. |
31 | * |
32 | * Redistribution and use in source and binary forms, with or without |
33 | * modification, are permitted provided that the following conditions |
34 | * are met: |
35 | * 1. Redistributions of source code must retain the above copyright |
36 | * notice, this list of conditions and the following disclaimer. |
37 | * 2. Redistributions in binary form must reproduce the above copyright |
38 | * notice, this list of conditions and the following disclaimer in the |
39 | * documentation and/or other materials provided with the distribution. |
40 | * |
41 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND |
42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
51 | * SUCH DAMAGE. |
52 | */ |
53 | |
54 | #ifndef _SECURITY_MAC_DATA_H_ |
55 | #define _SECURITY_MAC_DATA_H_ |
56 | |
57 | #ifndef PRIVATE |
58 | #warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" |
59 | #endif |
60 | |
61 | /** |
62 | * @brief Mac policy module data |
63 | * |
64 | * This structure specifies module data that is passed in to the |
65 | * TrustedBSD MAC policy module by the kernel module loader. The |
66 | * data is made of up key/value pairs where the key is always a |
67 | * string and the value is a string, binary data or array. An array |
68 | * may be a list of values (actually a similar set of key/value pairs, |
69 | * but in this case the keys are always null), and may also consist of |
70 | * a set of dictionaries, which in turn are made up of a list of key/value |
71 | * pairs. |
72 | * |
73 | * Module data may be specified in the MAC policy module's |
74 | * Info.plist file as part of the OSModuleData dictionary. |
75 | * |
76 | * E.g. |
77 | * |
78 | * <key>OSModuleData</key> |
79 | * <dict> |
80 | * <key>foo</key> |
81 | * <string>bar</string> |
82 | * <key>Beers</key> |
83 | * <array> |
84 | * <dict> |
85 | * <key>type</key> |
86 | * <string>lager</string> |
87 | * <key>Name</key> |
88 | * <string>Anchor Steam</string> |
89 | * </dict> |
90 | * <dict> |
91 | * <key>type</key> |
92 | * <string>ale</string> |
93 | * <key>Name</key> |
94 | * <string>Sierra Nevada Pale Ale</string> |
95 | * </dict> |
96 | * </array> |
97 | * </dict> |
98 | * |
99 | */ |
100 | struct mac_module_data_element { |
101 | unsigned int key_size; |
102 | unsigned int value_size; |
103 | unsigned int value_type; |
104 | char *key; |
105 | char *value; |
106 | }; |
107 | struct mac_module_data_list { |
108 | unsigned int count; |
109 | unsigned int type; |
110 | struct mac_module_data_element list[1]; |
111 | }; |
112 | struct mac_module_data { |
113 | void *base_addr; /* Orig base address, for ptr fixup. */ |
114 | unsigned int size; |
115 | unsigned int count; |
116 | struct mac_module_data_element data[1]; /* actually bigger */ |
117 | }; |
118 | |
119 | #define MAC_DATA_TYPE_PRIMITIVE 0 /* Primitive type (int, string, etc.) */ |
120 | #define MAC_DATA_TYPE_ARRAY 1 /* Array type. */ |
121 | #define MAC_DATA_TYPE_DICT 2 /* Dictionary type. */ |
122 | |
123 | #ifdef _SECURITY_MAC_POLICY_H_ |
124 | /* XXX mac_policy_handle_t is defined in mac_policy.h, move prototype there? */ |
125 | int mac_find_policy_data(const mac_policy_handle_t, const char *key, |
126 | void **valp, size_t *sizep); |
127 | int mac_find_module_data(struct mac_module_data *mmd, const char *key, |
128 | void **valp, size_t *sizep); |
129 | |
130 | /* |
131 | * This is a routine to fix up pointers in a mac_module_data_element when the |
132 | * mac_module_data has been copied to a new area. It depends on the pointers |
133 | * all being offset from base_addr. |
134 | */ |
135 | static __inline void |
136 | mmd_fixup_ele(struct mac_module_data *oldbase, |
137 | struct mac_module_data *newbase, struct mac_module_data_element *ele) |
138 | { |
139 | if (ele->key != NULL) { /* Array elements have no keys. */ |
140 | ele->key -= (uintptr_t)oldbase; |
141 | ele->key += (uintptr_t)newbase; |
142 | } |
143 | ele->value -= (uintptr_t)oldbase; |
144 | ele->value += (uintptr_t)newbase; |
145 | } |
146 | |
147 | #endif |
148 | |
149 | #endif /* !_SECURITY_MAC_DATA_H_ */ |
150 | |