1/*
2 * Copyright (c) 2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#ifndef _SYS_GUARDED_H_
30#define _SYS_GUARDED_H_
31
32#include <sys/types.h>
33#include <sys/cdefs.h>
34
35#include <sys/_types/_iovec_t.h>
36#ifdef PRIVATE
37
38__BEGIN_DECLS
39
40#if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE)
41
42#ifndef _GUARDID_T
43#define _GUARDID_T
44typedef __uint64_t guardid_t;
45#endif /* _GUARDID_T */
46
47#if !defined(KERNEL)
48extern int guarded_open_np(const char *path,
49 const guardid_t *guard, u_int guardflags, int flags, ...);
50extern int guarded_open_dprotected_np(const char *path,
51 const guardid_t *guard, u_int guardflags, int flags,
52 int dpclass, int dpflags, ...);
53extern int guarded_kqueue_np(const guardid_t *guard, u_int guardflags);
54extern int guarded_close_np(int fd, const guardid_t *guard);
55extern int change_fdguard_np(int fd, const guardid_t *guard, u_int guardflags,
56 const guardid_t *nguard, u_int nguardflags, int *fdflagsp);
57extern ssize_t guarded_write_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte);
58extern ssize_t guarded_pwrite_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte, off_t offset);
59extern ssize_t guarded_writev_np(int fd, const guardid_t *guard, const struct iovec *iovp, int iovcnt);
60#endif /* KERNEL */
61
62#ifndef GUARD_TYPE_FD
63/* temporary source compat: use <kern/exc_guard.h> instead */
64#define GUARD_TYPE_FD 0x2
65#endif
66
67/*
68 * File descriptor guard flavors.
69 */
70
71/*
72 * Forbid close(2), and the implicit close() that a dup2(2) may do.
73 * Forces close-on-fork to be set immutably too.
74 */
75#define GUARD_CLOSE (1u << 0)
76
77/*
78 * Forbid dup(2), dup2(2), and fcntl(2) subcodes F_DUPFD, F_DUPFD_CLOEXEC
79 * on a guarded fd. Also forbids open's of a guarded fd via /dev/fd/
80 * (an implicit dup.)
81 */
82#define GUARD_DUP (1u << 1)
83
84/*
85 * Forbid sending a guarded fd via a socket
86 */
87#define GUARD_SOCKET_IPC (1u << 2)
88
89/*
90 * Forbid creating a fileport from a guarded fd
91 */
92#define GUARD_FILEPORT (1u << 3)
93
94/*
95 * Forbid writes on a guarded fd
96 */
97#define GUARD_WRITE (1u << 4)
98
99/*
100 * Violating a guard results in an error (EPERM), and potentially
101 * an exception with one or more of the following bits set.
102 */
103enum guard_fd_exception_codes {
104 kGUARD_EXC_CLOSE = 1u << 0, /* close of a guarded fd */
105 kGUARD_EXC_DUP = 1u << 1, /* dup of a guarded fd */
106 kGUARD_EXC_NOCLOEXEC = 1u << 2, /* clear close-on-exec */
107 kGUARD_EXC_SOCKET_IPC = 1u << 3, /* sendmsg of a guarded fd */
108 kGUARD_EXC_FILEPORT = 1u << 4, /* fileport_makeport .. */
109 kGUARD_EXC_MISMATCH = 1u << 5, /* wrong guard for guarded fd */
110 kGUARD_EXC_WRITE = 1u << 6 /* write on a guarded fd */
111};
112
113/*
114 * Experimental guarded vnode support
115 */
116#define VNG_RENAME_TO (1u << 0)
117#define VNG_RENAME_FROM (1u << 1)
118#define VNG_UNLINK (1u << 2)
119#define VNG_WRITE_OTHER (1u << 3)
120#define VNG_TRUNC_OTHER (1u << 4)
121#define VNG_LINK (1u << 5)
122#define VNG_EXCHDATA (1u << 6)
123
124#define VNG_ALL \
125 (VNG_RENAME_TO | VNG_RENAME_FROM | VNG_UNLINK | VNG_LINK | \
126 VNG_WRITE_OTHER | VNG_TRUNC_OTHER | VNG_EXCHDATA)
127
128struct vnguard_set {
129 int vns_fd;
130 unsigned vns_attrs;
131 guardid_t vns_guard;
132};
133
134struct vnguard_getattr {
135 int vga_fd; /* in */
136 unsigned vga_attrs; /* out */
137 guardid_t vga_guard; /* in */
138};
139
140#define VNG_SYSC_PING 0
141#define VNG_SYSC_SET_GUARD 1
142#define VNG_SYSC_GET_ATTR 2
143
144#define VNG_POLICY_NAME "vnguard"
145
146/*
147 * Violating a guard may result in an error (EPERM), and potentially
148 * an exception with one or more of the following bits set.
149 */
150enum guard_vn_exception_codes {
151 kGUARD_EXC_RENAME_TO = VNG_RENAME_TO,
152 kGUARD_EXC_RENAME_FROM = VNG_RENAME_FROM,
153 kGUARD_EXC_UNLINK = VNG_UNLINK,
154 kGUARD_EXC_WRITE_OTHER = VNG_WRITE_OTHER,
155 kGUARD_EXC_TRUNC_OTHER = VNG_TRUNC_OTHER,
156 kGUARD_EXC_LINK = VNG_LINK,
157 kGUARD_EXC_EXCHDATA = VNG_EXCHDATA,
158};
159
160/* Guard violation behaviors: not all combinations make sense */
161
162#define kVNG_POLICY_LOGMSG (1u << 0)
163#define kVNG_POLICY_EPERM (1u << 1)
164#define kVNG_POLICY_EXC (1u << 2)
165#define kVNG_POLICY_EXC_CORPSE (1u << 3)
166#define kVNG_POLICY_SIGKILL (1u << 4)
167#define kVNG_POLICY_UPRINTMSG (1u << 5)
168
169#if BSD_KERNEL_PRIVATE
170struct fileglob;
171extern int vnguard_exceptions_active(void);
172extern void vnguard_policy_init(void);
173#if CONFIG_MACF && CONFIG_VNGUARD
174extern void vng_file_label_destroy(struct fileglob *fg);
175#endif /* CONFIG_MACF && CONFIG_VNGUARD */
176#endif /* BSD_KERNEL_PRIVATE */
177
178#endif /* (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */
179
180__END_DECLS
181
182#endif /* PRIVATE */
183
184#endif /* !_SYS_GUARDED_H_ */
185