1 | /* |
2 | * Copyright (c) 2010 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /*- |
29 | * Copyright (c) 2006 nCircle Network Security, Inc. |
30 | * Copyright (c) 2009 Robert N. M. Watson |
31 | * All rights reserved. |
32 | * |
33 | * This software was developed by Robert N. M. Watson for the TrustedBSD |
34 | * Project under contract to nCircle Network Security, Inc. |
35 | * |
36 | * This software was developed at the University of Cambridge Computer |
37 | * Laboratory with support from a grant from Google, Inc. |
38 | * |
39 | * Redistribution and use in source and binary forms, with or without |
40 | * modification, are permitted provided that the following conditions |
41 | * are met: |
42 | * 1. Redistributions of source code must retain the above copyright |
43 | * notice, this list of conditions and the following disclaimer. |
44 | * 2. Redistributions in binary form must reproduce the above copyright |
45 | * notice, this list of conditions and the following disclaimer in the |
46 | * documentation and/or other materials provided with the distribution. |
47 | * |
48 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND |
49 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
51 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY, |
52 | * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
53 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED |
54 | * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
55 | * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
56 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
57 | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
58 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
59 | */ |
60 | |
61 | /* |
62 | * MAC checks for system privileges. |
63 | */ |
64 | |
65 | #include <sys/param.h> |
66 | #include <sys/kernel.h> |
67 | |
68 | #include <security/mac_internal.h> |
69 | |
70 | /* |
71 | * The MAC Framework interacts with kernel privilege checks in two ways: it |
72 | * may restrict the granting of privilege to a subject, and it may grant |
73 | * additional privileges to the subject. Policies may implement none, one, |
74 | * or both of these entry points. Restriction of privilege by any policy |
75 | * always overrides granting of privilege by any policy or other privilege |
76 | * mechanism. See kern_priv.c:priv_check_cred() for details of the |
77 | * composition. |
78 | */ |
79 | |
80 | /* |
81 | * Restrict access to a privilege for a credential. Return failure if any |
82 | * policy denies access. |
83 | */ |
84 | int |
85 | mac_priv_check(kauth_cred_t cred, int priv) |
86 | { |
87 | int error; |
88 | |
89 | if (!mac_cred_check_enforce(cred)) { |
90 | return 0; |
91 | } |
92 | |
93 | MAC_CHECK(priv_check, cred, priv); |
94 | |
95 | return error; |
96 | } |
97 | |
98 | /* |
99 | * Grant access to a privilege for a credential. Return success if any |
100 | * policy grants access. |
101 | */ |
102 | int |
103 | mac_priv_grant(kauth_cred_t cred, int priv) |
104 | { |
105 | int error; |
106 | |
107 | if (!mac_cred_check_enforce(cred)) { |
108 | return 0; |
109 | } |
110 | |
111 | MAC_GRANT(priv_grant, cred, priv); |
112 | |
113 | return error; |
114 | } |
115 | |