1/*
2 * Copyright (c) 2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*-
29 * Copyright (c) 1999-2002 Robert N. M. Watson
30 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
31 * Copyright (c) 2005-2007 SPARTA, Inc.
32 * All rights reserved.
33 *
34 * This software was developed by Robert Watson for the TrustedBSD Project.
35 *
36 * This software was developed for the FreeBSD Project in part by Network
37 * Associates Laboratories, the Security Research Division of Network
38 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
39 * as part of the DARPA CHATS research program.
40 *
41 * This software was enhanced by SPARTA ISSO under SPAWAR contract
42 * N66001-04-C-6019 ("SEFOS").
43 *
44 * Redistribution and use in source and binary forms, with or without
45 * modification, are permitted provided that the following conditions
46 * are met:
47 * 1. Redistributions of source code must retain the above copyright
48 * notice, this list of conditions and the following disclaimer.
49 * 2. Redistributions in binary form must reproduce the above copyright
50 * notice, this list of conditions and the following disclaimer in the
51 * documentation and/or other materials provided with the distribution.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $
66 *
67 */
68/*
69 * Kernel interface for Mandatory Access Control -- how kernel services
70 * interact with the TrustedBSD MAC Framework.
71 */
72
73#ifndef _SECURITY_MAC_FRAMEWORK_H_
74#define _SECURITY_MAC_FRAMEWORK_H_
75
76#ifndef KERNEL
77#error "no user-serviceable parts inside"
78#endif
79
80#ifndef PRIVATE
81#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
82#endif
83
84struct attrlist;
85struct auditinfo;
86struct componentname;
87struct cs_blob;
88struct devnode;
89struct exception_action;
90struct flock;
91struct fdescnode;
92struct fileglob;
93struct fileproc;
94struct ifreq;
95struct image_params;
96struct ipc_port;
97struct knote;
98struct mac;
99struct msg;
100struct msqid_kernel;
101struct mount;
102struct pipe;
103struct proc;
104struct pseminfo;
105struct pshminfo;
106struct semid_kernel;
107struct shmid_kernel;
108struct sockaddr;
109struct sockopt;
110struct socket;
111struct task;
112struct thread;
113struct timespec;
114struct tty;
115struct ucred;
116struct uio;
117struct uthread;
118struct vfs_attr;
119struct vfs_context;
120struct vnode;
121struct vnode_attr;
122struct vop_setlabel_args;
123
124#include <stdbool.h>
125#include <sys/kauth.h>
126#include <sys/kernel_types.h>
127#include <sys/reason.h>
128#include <sys/cdefs.h>
129
130#if CONFIG_MACF
131
132#ifndef __IOKIT_PORTS_DEFINED__
133#define __IOKIT_PORTS_DEFINED__
134#ifdef __cplusplus
135class OSObject;
136typedef OSObject *io_object_t;
137#else
138struct OSObject;
139typedef struct OSObject *io_object_t;
140#endif
141#endif /* __IOKIT_PORTS_DEFINED__ */
142
143__BEGIN_DECLS
144
145/*@ macros */
146#define VNODE_LABEL_CREATE 1
147
148/*@ === */
149int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode,
150 void *args, int error, int retval, int mac_forced) __result_use_check;
151int mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode,
152 void *args) __result_use_check;
153int mac_cred_check_label_update(kauth_cred_t cred,
154 struct label *newlabel) __result_use_check;
155int mac_cred_check_label_update_execve(vfs_context_t ctx,
156 struct vnode *vp, off_t offset, struct vnode *scriptvp,
157 struct label *scriptvnodelabel, struct label *execlabel,
158 proc_t proc, void *macextensions) __result_use_check;
159int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2) __result_use_check;
160struct label *mac_cred_label_alloc(void);
161void mac_cred_label_associate(kauth_cred_t cred_parent,
162 kauth_cred_t cred_child);
163void mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child);
164void mac_cred_label_associate_kernel(kauth_cred_t cred);
165void mac_cred_label_associate_user(kauth_cred_t cred);
166void mac_cred_label_destroy(kauth_cred_t cred);
167struct label *mac_cred_label(kauth_cred_t cred);
168int mac_cred_label_externalize_audit(proc_t p, struct mac *mac) __result_use_check;
169void mac_cred_label_free(struct label *label);
170void mac_cred_label_init(kauth_cred_t cred);
171void mac_cred_label_seal(kauth_cred_t cred);
172bool mac_cred_label_is_equal(const struct label *a, const struct label *b) __result_use_check;
173uint32_t mac_cred_label_hash_update(const struct label *a, uint32_t hash);
174void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel);
175void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred,
176 struct vnode *vp, off_t offset, struct vnode *scriptvp,
177 struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags,
178 void *macextensions, int *disjoint, int *labelupdateerror);
179void mac_devfs_label_associate_device(dev_t dev, struct devnode *de,
180 const char *fullpath);
181void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen,
182 struct devnode *de, const char *fullpath);
183void mac_devfs_label_copy(struct label *, struct label *label);
184void mac_devfs_label_destroy(struct devnode *de);
185void mac_devfs_label_init(struct devnode *de);
186struct label *mac_devfs_label(struct devnode *de);
187void mac_devfs_label_update(struct mount *mp, struct devnode *de,
188 struct vnode *vp);
189int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp) __result_use_check;
190int mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
191int mac_file_check_create(kauth_cred_t cred) __result_use_check;
192int mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd) __result_use_check;
193int mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd,
194 user_long_t arg) __result_use_check;
195int mac_file_check_get(kauth_cred_t cred, struct fileglob *fg,
196 char *elements, size_t len) __result_use_check;
197int mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
198int mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
199int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg,
200 unsigned long cmd) __result_use_check;
201int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op,
202 struct flock *fl) __result_use_check;
203int mac_file_check_library_validation(struct proc *proc,
204 struct fileglob *fg, off_t slice_offset,
205 user_long_t error_message, size_t error_message_size) __result_use_check;
206int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg,
207 int prot, int flags, uint64_t file_pos, int *maxprot) __result_use_check;
208void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg,
209 int *prot);
210int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg) __result_use_check;
211int mac_file_check_set(kauth_cred_t cred, struct fileglob *fg,
212 char *bufp, size_t buflen) __result_use_check;
213void mac_file_notify_close(struct ucred *cred, struct fileglob *fg);
214int mac_iokit_check_open_service(kauth_cred_t cred, io_object_t service, unsigned int user_client_type) __result_use_check;
215int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type) __result_use_check;
216int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties) __result_use_check;
217int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry) __result_use_check;
218int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name) __result_use_check;
219#ifdef KERNEL_PRIVATE
220int mac_iokit_check_hid_control(kauth_cred_t cred) __result_use_check;
221#endif
222int mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp,
223 unsigned long cmd) __result_use_check;
224int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp,
225 struct vfs_attr *vfa) __result_use_check;
226int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp) __result_use_check;
227int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp,
228 struct componentname *cnp, const char *vfc_name) __result_use_check;
229int mac_mount_check_mount_late(vfs_context_t ctx, struct mount *mp) __result_use_check;
230int mac_mount_check_quotactl(vfs_context_t ctx, struct mount *mp,
231 int cmd, int id) __result_use_check;
232int mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp,
233 const char *name) __result_use_check;
234int mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp,
235 const char *name) __result_use_check;
236#ifdef KERNEL_PRIVATE
237int mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp,
238 struct vnode *vp, struct componentname *cnp, const char *name,
239 const char *vfc_name) __result_use_check;
240#endif
241int mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp,
242 const char *name) __result_use_check;
243int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) __result_use_check;
244int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp,
245 struct vfs_attr *vfa) __result_use_check;
246int mac_mount_check_stat(vfs_context_t ctx, struct mount *mp) __result_use_check;
247int mac_mount_check_umount(vfs_context_t ctx, struct mount *mp) __result_use_check;
248void mac_mount_label_associate(vfs_context_t ctx, struct mount *mp);
249void mac_mount_label_destroy(struct mount *mp);
250int mac_mount_label_externalize(struct label *label, char *elements,
251 char *outbuf, size_t outbuflen) __result_use_check;
252int mac_mount_label_get(struct mount *mp, user_addr_t mac_p) __result_use_check;
253void mac_mount_label_init(struct mount *);
254struct label *mac_mount_label(struct mount *);
255int mac_mount_label_internalize(struct label *, char *string) __result_use_check;
256int mac_necp_check_open(proc_t proc, int flags) __result_use_check;
257int mac_necp_check_client_action(proc_t proc, struct fileglob *fg, uint32_t action) __result_use_check;
258int mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe,
259 unsigned long cmd) __result_use_check;
260int mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn,
261 struct pipe *cpipe) __result_use_check;
262int mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe) __result_use_check;
263int mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe,
264 int which) __result_use_check;
265int mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe) __result_use_check;
266int mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe) __result_use_check;
267void mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe);
268void mac_pipe_label_destroy(struct pipe *cpipe);
269void mac_pipe_label_free(struct label *label);
270void mac_pipe_label_init(struct pipe *cpipe);
271struct label *mac_pipe_label(struct pipe *cpipe);
272void mac_pipe_set_label(struct pipe *cpipe, struct label *label);
273void mac_policy_initbsd(void);
274int mac_posixsem_check_create(kauth_cred_t cred, const char *name) __result_use_check;
275int mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem) __result_use_check;
276int mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem) __result_use_check;
277int mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem,
278 const char *name) __result_use_check;
279int mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem) __result_use_check;
280void mac_posixsem_vnode_label_associate(kauth_cred_t cred,
281 struct pseminfo *psem, struct label *plabel,
282 vnode_t vp, struct label *vlabel);
283void mac_posixsem_label_associate(kauth_cred_t cred,
284 struct pseminfo *psem, const char *name);
285void mac_posixsem_label_destroy(struct pseminfo *psem);
286void mac_posixsem_label_init(struct pseminfo *psem);
287struct label *mac_posixsem_label(struct pseminfo *psem);
288int mac_posixshm_check_create(kauth_cred_t cred, const char *name) __result_use_check;
289int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm,
290 int prot, int flags) __result_use_check;
291int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm,
292 int fflags) __result_use_check;
293int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm) __result_use_check;
294int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm,
295 off_t s) __result_use_check;
296int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm,
297 const char *name) __result_use_check;
298void mac_posixshm_vnode_label_associate(kauth_cred_t cred,
299 struct pshminfo *pshm, struct label *plabel,
300 vnode_t vp, struct label *vlabel);
301void mac_posixshm_label_associate(kauth_cred_t cred,
302 struct pshminfo *pshm, const char *name);
303void mac_posixshm_label_destroy(struct pshminfo *pshm);
304void mac_posixshm_label_init(struct pshminfo *pshm);
305struct label *mac_posixshm_label(struct pshminfo *pshm);
306int mac_priv_check(kauth_cred_t cred, int priv) __result_use_check;
307int mac_priv_grant(kauth_cred_t cred, int priv) __result_use_check;
308int mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident) __result_use_check;
309int mac_proc_check_dump_core(proc_t proc) __result_use_check;
310int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor) __result_use_check;
311int mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check;
312int mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op) __result_use_check;
313int mac_proc_check_fork(proc_t proc) __result_use_check;
314int mac_proc_check_suspend_resume(proc_t proc, int sr) __result_use_check;
315int mac_proc_check_get_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check;
316int mac_proc_check_expose_task(kauth_cred_t cred, proc_ident_t pident, mach_task_flavor_t flavor) __result_use_check;
317int mac_proc_check_get_movable_control_port(void) __result_use_check;
318int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp) __result_use_check;
319int mac_proc_check_getaudit(proc_t proc) __result_use_check;
320int mac_proc_check_getauid(proc_t proc) __result_use_check;
321int mac_proc_check_dyld_process_info_notify_register(void) __result_use_check;
322int mac_proc_check_ledger(proc_t curp, proc_t target, int op) __result_use_check;
323int mac_proc_check_map_anon(proc_t proc, kauth_cred_t cred, user_addr_t u_addr,
324 user_size_t u_size, int prot, int flags, int *maxprot) __result_use_check;
325int mac_proc_check_memorystatus_control(proc_t proc, uint32_t command, pid_t pid) __result_use_check;
326int mac_proc_check_mprotect(proc_t proc,
327 user_addr_t addr, user_size_t size, int prot) __result_use_check;
328int mac_proc_check_run_cs_invalid(proc_t proc) __result_use_check;
329void mac_proc_notify_cs_invalidated(proc_t proc);
330int mac_proc_check_sched(proc_t proc, proc_t proc2) __result_use_check;
331int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai) __result_use_check;
332int mac_proc_check_setauid(proc_t proc, uid_t auid) __result_use_check;
333int mac_proc_check_seteuid(proc_t curp, kauth_cred_t cred, uid_t euid) __result_use_check;
334int mac_proc_check_setegid(proc_t curp, kauth_cred_t cred, gid_t egid) __result_use_check;
335int mac_proc_check_setuid(proc_t curp, kauth_cred_t cred, uid_t uid) __result_use_check;
336int mac_proc_check_setgid(proc_t curp, kauth_cred_t cred, gid_t gid) __result_use_check;
337int mac_proc_check_setreuid(proc_t curp, kauth_cred_t cred, uid_t ruid, uid_t euid) __result_use_check;
338int mac_proc_check_setregid(proc_t curp, kauth_cred_t cred, gid_t rgid, gid_t egid) __result_use_check;
339int mac_proc_check_settid(proc_t curp, uid_t uid, gid_t gid) __result_use_check;
340int mac_proc_check_signal(proc_t proc1, proc_t proc2,
341 int signum) __result_use_check;
342int mac_proc_check_syscall_unix(proc_t proc, int scnum) __result_use_check;
343int mac_proc_check_wait(proc_t proc1, proc_t proc2) __result_use_check;
344void mac_proc_notify_exit(proc_t proc);
345int mac_proc_check_launch_constraints(proc_t curp, struct image_params *imgp, os_reason_t *reasonp) __result_use_check;
346int mac_socket_check_accept(kauth_cred_t cred, struct socket *so) __result_use_check;
347int mac_socket_check_accepted(kauth_cred_t cred, struct socket *so) __result_use_check;
348int mac_socket_check_bind(kauth_cred_t cred, struct socket *so,
349 struct sockaddr *addr) __result_use_check;
350int mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
351 struct sockaddr *addr) __result_use_check;
352int mac_socket_check_create(kauth_cred_t cred, int domain,
353 int type, int protocol) __result_use_check;
354int mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
355 unsigned long cmd) __result_use_check;
356int mac_socket_check_listen(kauth_cred_t cred, struct socket *so) __result_use_check;
357int mac_socket_check_receive(kauth_cred_t cred, struct socket *so) __result_use_check;
358int mac_socket_check_received(kauth_cred_t cred, struct socket *so,
359 struct sockaddr *saddr) __result_use_check;
360int mac_socket_check_send(kauth_cred_t cred, struct socket *so,
361 struct sockaddr *addr) __result_use_check;
362int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
363 struct sockopt *sopt) __result_use_check;
364int mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
365 struct sockopt *sopt) __result_use_check;
366int mac_socket_check_stat(kauth_cred_t cred, struct socket *so) __result_use_check;
367void mac_socket_label_associate(kauth_cred_t cred, struct socket *so);
368void mac_socket_label_associate_accept(struct socket *oldsocket,
369 struct socket *newsocket);
370void mac_socket_label_copy(struct label *from, struct label *to);
371void mac_socket_label_destroy(struct socket *);
372int mac_socket_label_get(kauth_cred_t cred, struct socket *so,
373 struct mac *extmac) __result_use_check;
374int mac_socket_label_init(struct socket *, int waitok) __result_use_check;
375void mac_socketpeer_label_associate_socket(struct socket *peersocket,
376 struct socket *socket_to_modify);
377int mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so,
378 struct mac *extmac) __result_use_check;
379int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp) __result_use_check;
380int mac_system_check_audit(kauth_cred_t cred, void *record, int length) __result_use_check;
381int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp) __result_use_check;
382int mac_system_check_auditon(kauth_cred_t cred, int cmd) __result_use_check;
383int mac_system_check_host_priv(kauth_cred_t cred) __result_use_check;
384int mac_system_check_info(kauth_cred_t, const char *info_type) __result_use_check;
385int mac_system_check_nfsd(kauth_cred_t cred) __result_use_check;
386int mac_system_check_reboot(kauth_cred_t cred, int howto) __result_use_check;
387int mac_system_check_settime(kauth_cred_t cred) __result_use_check;
388int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp) __result_use_check;
389int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp) __result_use_check;
390int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name,
391 size_t namelen, user_addr_t oldctl, size_t oldlen,
392 user_addr_t newctl, size_t newlen) __result_use_check;
393int mac_system_check_kas_info(kauth_cred_t cred, int selector) __result_use_check;
394void mac_sysvmsg_label_associate(kauth_cred_t cred,
395 struct msqid_kernel *msqptr, struct msg *msgptr);
396void mac_sysvmsg_label_init(struct msg *msgptr);
397struct label *mac_sysvmsg_label(struct msg *msgptr);
398void mac_sysvmsg_label_recycle(struct msg *msgptr);
399int mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr,
400 struct msqid_kernel *msqptr) __result_use_check;
401int mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr) __result_use_check;
402int mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr) __result_use_check;
403int mac_sysvmsq_check_msqctl(kauth_cred_t cred,
404 struct msqid_kernel *msqptr, int cmd) __result_use_check;
405int mac_sysvmsq_check_msqget(kauth_cred_t cred,
406 struct msqid_kernel *msqptr) __result_use_check;
407int mac_sysvmsq_check_msqrcv(kauth_cred_t cred,
408 struct msqid_kernel *msqptr) __result_use_check;
409int mac_sysvmsq_check_msqsnd(kauth_cred_t cred,
410 struct msqid_kernel *msqptr) __result_use_check;
411void mac_sysvmsq_label_associate(kauth_cred_t cred,
412 struct msqid_kernel *msqptr);
413void mac_sysvmsq_label_init(struct msqid_kernel *msqptr);
414struct label *mac_sysvmsq_label(struct msqid_kernel *msqptr);
415void mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr);
416int mac_sysvsem_check_semctl(kauth_cred_t cred,
417 struct semid_kernel *semakptr, int cmd) __result_use_check;
418int mac_sysvsem_check_semget(kauth_cred_t cred,
419 struct semid_kernel *semakptr) __result_use_check;
420int mac_sysvsem_check_semop(kauth_cred_t cred,
421 struct semid_kernel *semakptr, size_t accesstype) __result_use_check;
422void mac_sysvsem_label_associate(kauth_cred_t cred,
423 struct semid_kernel *semakptr);
424void mac_sysvsem_label_destroy(struct semid_kernel *semakptr);
425void mac_sysvsem_label_init(struct semid_kernel *semakptr);
426struct label *mac_sysvsem_label(struct semid_kernel *semakptr);
427void mac_sysvsem_label_recycle(struct semid_kernel *semakptr);
428int mac_sysvshm_check_shmat(kauth_cred_t cred,
429 struct shmid_kernel *shmsegptr, int shmflg) __result_use_check;
430int mac_sysvshm_check_shmctl(kauth_cred_t cred,
431 struct shmid_kernel *shmsegptr, int cmd) __result_use_check;
432int mac_sysvshm_check_shmdt(kauth_cred_t cred,
433 struct shmid_kernel *shmsegptr) __result_use_check;
434int mac_sysvshm_check_shmget(kauth_cred_t cred,
435 struct shmid_kernel *shmsegptr, int shmflg) __result_use_check;
436void mac_sysvshm_label_associate(kauth_cred_t cred,
437 struct shmid_kernel *shmsegptr);
438void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr);
439void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr);
440struct label *mac_sysvshm_label(struct shmid_kernel *shmsegptr);
441void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr);
442int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp,
443 int acc_mode) __result_use_check;
444int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) __result_use_check;
445int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp,
446 struct componentname *cnp) __result_use_check;
447int mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp,
448 struct vnode *vp, struct componentname *cnp) __result_use_check;
449int mac_vnode_check_copyfile(vfs_context_t ctx, struct vnode *dvp,
450 struct vnode *tvp, struct vnode *fvp, struct componentname *cnp,
451 mode_t mode, int flags) __result_use_check;
452int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp,
453 struct componentname *cnp, struct vnode_attr *vap) __result_use_check;
454int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp,
455 const char *name) __result_use_check;
456int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1,
457 struct vnode *v2) __result_use_check;
458int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp,
459 struct image_params *imgp) __result_use_check;
460int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp) __result_use_check;
461int mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred,
462 struct vnode *vp, struct vnode_attr *va) __result_use_check;
463int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp,
464 struct attrlist *alist, uint64_t options) __result_use_check;
465int mac_vnode_check_getattrlistbulk(vfs_context_t ctx, struct vnode *dvp,
466 struct attrlist *alist, uint64_t options) __result_use_check;
467int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp,
468 const char *name, struct uio *uio) __result_use_check;
469int mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp,
470 unsigned long cmd) __result_use_check;
471int mac_vnode_check_kqfilter(vfs_context_t ctx,
472 kauth_cred_t file_cred, struct knote *kn, struct vnode *vp) __result_use_check;
473int mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp,
474 struct label *newlabel); __result_use_check
475int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp,
476 struct vnode *vp, struct componentname *cnp) __result_use_check;
477int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp) __result_use_check;
478int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp,
479 struct componentname *cnp) __result_use_check;
480int mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp,
481 const char *path, size_t pathlen) __result_use_check;
482#ifdef KERNEL_PRIVATE
483int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp,
484 int acc_mode) __result_use_check;
485#endif
486int mac_vnode_check_read(vfs_context_t ctx,
487 kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
488int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp) __result_use_check;
489int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp) __result_use_check;
490int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp,
491 struct vnode *vp, struct componentname *cnp, struct vnode *tdvp,
492 struct vnode *tvp, struct componentname *tcnp) __result_use_check;
493int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp) __result_use_check;
494int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp,
495 struct attrlist *returnattrs, struct attrlist *searchattrs) __result_use_check;
496int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp,
497 int which) __result_use_check;
498int mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp,
499 struct kauth_acl *acl) __result_use_check;
500int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp,
501 struct attrlist *alist) __result_use_check;
502int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp,
503 const char *name, struct uio *uio) __result_use_check;
504int mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp,
505 u_long flags) __result_use_check;
506int mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp,
507 mode_t mode) __result_use_check;
508int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp,
509 uid_t uid, gid_t gid) __result_use_check;
510int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp,
511 struct timespec atime, struct timespec mtime) __result_use_check;
512int mac_vnode_check_signature(struct vnode *vp,
513 struct cs_blob *cs_blob, struct image_params *imgp,
514 unsigned int *cs_flags, unsigned int *signer_type,
515 int flags, unsigned int platform) __result_use_check;
516int mac_vnode_check_supplemental_signature(struct vnode *vp,
517 struct cs_blob *cs_blob, struct vnode *linked_vp,
518 struct cs_blob *linked_cs_blob, unsigned int *signer_type) __result_use_check;
519int mac_vnode_check_stat(vfs_context_t ctx,
520 kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
521#ifdef KERNEL_PRIVATE
522int mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp,
523 struct componentname *cnp) __result_use_check;
524#endif
525int mac_vnode_check_truncate(vfs_context_t ctx,
526 kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
527int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp,
528 struct componentname *cnp, struct vnode_attr *vap) __result_use_check;
529int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so) __result_use_check;
530int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp,
531 struct vnode *vp, struct componentname *cnp) __result_use_check;
532int mac_vnode_check_write(vfs_context_t ctx,
533 kauth_cred_t file_cred, struct vnode *vp) __result_use_check;
534struct label *mac_vnode_label_alloc(struct vnode *vp);
535int mac_vnode_label_associate(struct mount *mp, struct vnode *vp,
536 vfs_context_t ctx) __result_use_check;
537void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de,
538 struct vnode *vp);
539int mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp) __result_use_check;
540int mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp,
541 struct vnode *vp, vfs_context_t ctx) __result_use_check;
542void mac_vnode_label_associate_singlelabel(struct mount *mp,
543 struct vnode *vp);
544void mac_vnode_label_copy(struct label *l1, struct label *l2);
545void mac_vnode_label_destroy(struct vnode *vp);
546int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac) __result_use_check;
547void mac_vnode_label_free(struct label *label);
548void mac_vnode_label_init(struct vnode *vp);
549int mac_vnode_label_init_needed(struct vnode *vp) __result_use_check;
550struct label *mac_vnode_label(struct vnode *vp);
551#ifdef KERNEL_PRIVATE
552struct label *mac_vnode_label_allocate(vnode_t vp);
553#endif
554void mac_vnode_label_recycle(struct vnode *vp);
555void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp,
556 struct label *newlabel);
557void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp,
558 const char *name);
559int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp,
560 struct vnode *dvp, struct vnode *vp, struct componentname *cnp) __result_use_check;
561void mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name);
562void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp,
563 struct vnode *dvp, struct componentname *cnp);
564void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags);
565void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *fvp,
566 struct vnode *fdvp, struct componentname *fcnp, struct vnode *tvp,
567 struct vnode *tdvp, struct componentname *tcnp, bool swap);
568void mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl);
569void mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist);
570void mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio);
571void mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags);
572void mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode);
573void mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid);
574void mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime);
575void mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp);
576int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho) __result_use_check;
577int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
578 struct componentname *cnp, int flags, vfs_context_t ctx) __result_use_check;
579void vnode_relabel(struct vnode *vp);
580void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label);
581void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label);
582int mac_kext_check_load(kauth_cred_t cred, const char *identifier) __result_use_check;
583int mac_kext_check_unload(kauth_cred_t cred, const char *identifier) __result_use_check;
584int mac_kext_check_query(kauth_cred_t cred) __result_use_check;
585int mac_skywalk_flow_check_connect(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check;
586int mac_skywalk_flow_check_listen(proc_t p, void *flow, const struct sockaddr *addr, int type, int protocol) __result_use_check;
587void mac_vnode_notify_reclaim(vnode_t vp);
588void mac_vnode_notify_unlink(vfs_context_t ctx, struct vnode *dvp,
589 struct vnode *vp, struct componentname *cnp);
590
591void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
592void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx);
593
594__END_DECLS
595
596#endif /* CONFIG_MACF */
597
598#endif /* !_SECURITY_MAC_FRAMEWORK_H_ */
599