1 | /* |
2 | * Copyright (c) 2021 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <sys/param.h> |
30 | #include <sys/proc.h> |
31 | #include <sys/kauth.h> |
32 | #include <security/mac_framework.h> |
33 | #include <security/mac_internal.h> |
34 | |
35 | int |
36 | mac_necp_check_open(proc_t proc, int flags) |
37 | { |
38 | int error; |
39 | |
40 | #if SECURITY_MAC_CHECK_ENFORCE |
41 | /* 21167099 - only check if we allow write */ |
42 | if (!mac_proc_enforce) { |
43 | return 0; |
44 | } |
45 | #endif |
46 | |
47 | if (!mac_proc_check_enforce(p: proc)) { |
48 | return 0; |
49 | } |
50 | |
51 | MAC_CHECK(necp_check_open, current_cached_proc_cred(proc), flags); |
52 | return error; |
53 | } |
54 | |
55 | int |
56 | mac_necp_check_client_action(proc_t proc, struct fileglob *fg, uint32_t action) |
57 | { |
58 | int error; |
59 | |
60 | #if SECURITY_MAC_CHECK_ENFORCE |
61 | /* 21167099 - only check if we allow write */ |
62 | if (!mac_proc_enforce) { |
63 | return 0; |
64 | } |
65 | #endif |
66 | |
67 | if (!mac_proc_check_enforce(p: proc)) { |
68 | return 0; |
69 | } |
70 | |
71 | MAC_CHECK(necp_check_client_action, current_cached_proc_cred(proc), fg, action); |
72 | return error; |
73 | } |
74 | |