1/* 2 * Copyright (c) 2007 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/*- 29 * Copyright (c) 1999-2002 Robert N. M. Watson 30 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 31 * Copyright (c) 2005-2007 SPARTA, Inc. 32 * All rights reserved. 33 * 34 * This software was developed by Robert Watson for the TrustedBSD Project. 35 * 36 * This software was developed for the FreeBSD Project in part by Network 37 * Associates Laboratories, the Security Research Division of Network 38 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 39 * as part of the DARPA CHATS research program. 40 * 41 * This software was enhanced by SPARTA ISSO under SPAWAR contract 42 * N66001-04-C-6019 ("SEFOS"). 43 * 44 * Redistribution and use in source and binary forms, with or without 45 * modification, are permitted provided that the following conditions 46 * are met: 47 * 1. Redistributions of source code must retain the above copyright 48 * notice, this list of conditions and the following disclaimer. 49 * 2. Redistributions in binary form must reproduce the above copyright 50 * notice, this list of conditions and the following disclaimer in the 51 * documentation and/or other materials provided with the distribution. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * $FreeBSD: src/sys/sys/mac.h,v 1.40 2003/04/18 19:57:37 rwatson Exp $ 66 * 67 */ 68/* 69 * Kernel interface for Mandatory Access Control -- how kernel services 70 * interact with the TrustedBSD MAC Framework. 71 */ 72 73#ifndef _SECURITY_MAC_FRAMEWORK_H_ 74#define _SECURITY_MAC_FRAMEWORK_H_ 75 76#ifndef KERNEL 77#error "no user-serviceable parts inside" 78#endif 79 80#ifndef PRIVATE 81#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version" 82#endif 83 84struct attrlist; 85struct auditinfo; 86struct bpf_d; 87struct componentname; 88struct devnode; 89struct flock; 90struct fdescnode; 91struct fileglob; 92struct fileproc; 93struct ifnet; 94struct ifreq; 95struct image_params; 96struct inpcb; 97struct ipq; 98struct knote; 99struct lctx; 100struct m_tag; 101struct mac; 102struct mac_module_data; 103struct mbuf; 104struct msg; 105struct msqid_kernel; 106struct mount; 107struct pipe; 108struct proc; 109struct pseminfo; 110struct pshminfo; 111struct semid_kernel; 112struct shmid_kernel; 113struct sockaddr; 114struct sockopt; 115struct socket; 116struct task; 117struct thread; 118struct timespec; 119struct tty; 120struct ucred; 121struct uio; 122struct uthread; 123struct vfs_attr; 124struct vfs_context; 125struct vnode; 126struct vnode_attr; 127struct vop_setlabel_args; 128 129#if CONFIG_MACF 130 131#ifndef __IOKIT_PORTS_DEFINED__ 132#define __IOKIT_PORTS_DEFINED__ 133#ifdef __cplusplus 134class OSObject; 135typedef OSObject *io_object_t; 136#else 137struct OSObject; 138typedef struct OSObject *io_object_t; 139#endif 140#endif /* __IOKIT_PORTS_DEFINED__ */ 141 142/*@ macros */ 143#define VNODE_LABEL_CREATE 1 144 145/*@ === */ 146int mac_audit_check_postselect(kauth_cred_t cred, unsigned short syscode, 147 void *args, int error, int retval, int mac_forced); 148int mac_audit_check_preselect(kauth_cred_t cred, unsigned short syscode, 149 void *args); 150int mac_bpfdesc_check_receive(struct bpf_d *bpf_d, struct ifnet *ifp); 151void mac_bpfdesc_label_destroy(struct bpf_d *bpf_d); 152void mac_bpfdesc_label_init(struct bpf_d *bpf_d); 153void mac_bpfdesc_label_associate(kauth_cred_t cred, struct bpf_d *bpf_d); 154int mac_cred_check_label_update(kauth_cred_t cred, 155 struct label *newlabel); 156int mac_cred_check_label_update_execve(vfs_context_t ctx, 157 struct vnode *vp, off_t offset, struct vnode *scriptvp, 158 struct label *scriptvnodelabel, struct label *execlabel, 159 proc_t proc, void *macextensions); 160int mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2); 161struct label *mac_cred_label_alloc(void); 162void mac_cred_label_associate(kauth_cred_t cred_parent, 163 kauth_cred_t cred_child); 164void mac_cred_label_associate_fork(kauth_cred_t cred, proc_t child); 165void mac_cred_label_associate_kernel(kauth_cred_t cred); 166void mac_cred_label_associate_user(kauth_cred_t cred); 167void mac_cred_label_destroy(kauth_cred_t cred); 168int mac_cred_label_externalize_audit(proc_t p, struct mac *mac); 169void mac_cred_label_free(struct label *label); 170void mac_cred_label_init(kauth_cred_t cred); 171int mac_cred_label_compare(struct label *a, struct label *b); 172void mac_cred_label_update(kauth_cred_t cred, struct label *newlabel); 173void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t newcred, 174 struct vnode *vp, off_t offset, struct vnode *scriptvp, 175 struct label *scriptvnodelabel, struct label *execlabel, u_int *csflags, 176 void *macextensions, int *disjoint, int *labelupdateerror); 177void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, 178 const char *fullpath); 179void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, 180 struct devnode *de, const char *fullpath); 181void mac_devfs_label_copy(struct label *, struct label *label); 182void mac_devfs_label_destroy(struct devnode *de); 183void mac_devfs_label_init(struct devnode *de); 184void mac_devfs_label_update(struct mount *mp, struct devnode *de, 185 struct vnode *vp); 186int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp); 187int mac_file_check_change_offset(kauth_cred_t cred, struct fileglob *fg); 188int mac_file_check_create(kauth_cred_t cred); 189int mac_file_check_dup(kauth_cred_t cred, struct fileglob *fg, int newfd); 190int mac_file_check_fcntl(kauth_cred_t cred, struct fileglob *fg, int cmd, 191 user_long_t arg); 192int mac_file_check_get(kauth_cred_t cred, struct fileglob *fg, 193 char *elements, int len); 194int mac_file_check_get_offset(kauth_cred_t cred, struct fileglob *fg); 195int mac_file_check_inherit(kauth_cred_t cred, struct fileglob *fg); 196int mac_file_check_ioctl(kauth_cred_t cred, struct fileglob *fg, 197 unsigned int cmd); 198int mac_file_check_lock(kauth_cred_t cred, struct fileglob *fg, int op, 199 struct flock *fl); 200int mac_file_check_mmap(kauth_cred_t cred, struct fileglob *fg, 201 int prot, int flags, int *maxprot); 202void mac_file_check_mmap_downgrade(kauth_cred_t cred, struct fileglob *fg, 203 int *prot); 204int mac_file_check_receive(kauth_cred_t cred, struct fileglob *fg); 205int mac_file_check_set(kauth_cred_t cred, struct fileglob *fg, 206 char *bufp, int buflen); 207void mac_file_label_associate(kauth_cred_t cred, struct fileglob *fg); 208void mac_file_label_destroy(struct fileglob *fg); 209void mac_file_label_init(struct fileglob *fg); 210int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf, 211 int family, int type); 212void mac_ifnet_label_associate(struct ifnet *ifp); 213void mac_ifnet_label_destroy(struct ifnet *ifp); 214int mac_ifnet_label_get(kauth_cred_t cred, struct ifreq *ifr, 215 struct ifnet *ifp); 216void mac_ifnet_label_init(struct ifnet *ifp); 217void mac_ifnet_label_recycle(struct ifnet *ifp); 218int mac_ifnet_label_set(kauth_cred_t cred, struct ifreq *ifr, 219 struct ifnet *ifp); 220int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf, 221 int family, int type); 222void mac_inpcb_label_associate(struct socket *so, struct inpcb *inp); 223void mac_inpcb_label_destroy(struct inpcb *inp); 224int mac_inpcb_label_init(struct inpcb *inp, int flag); 225void mac_inpcb_label_recycle(struct inpcb *inp); 226void mac_inpcb_label_update(struct socket *so); 227int mac_iokit_check_device(char *devtype, struct mac_module_data *mdata); 228int mac_iokit_check_open(kauth_cred_t cred, io_object_t user_client, unsigned int user_client_type); 229int mac_iokit_check_set_properties(kauth_cred_t cred, io_object_t registry_entry, io_object_t properties); 230int mac_iokit_check_filter_properties(kauth_cred_t cred, io_object_t registry_entry); 231int mac_iokit_check_get_property(kauth_cred_t cred, io_object_t registry_entry, const char *name); 232int mac_iokit_check_hid_control(kauth_cred_t cred); 233void mac_ipq_label_associate(struct mbuf *fragment, struct ipq *ipq); 234int mac_ipq_label_compare(struct mbuf *fragment, struct ipq *ipq); 235void mac_ipq_label_destroy(struct ipq *ipq); 236int mac_ipq_label_init(struct ipq *ipq, int flag); 237void mac_ipq_label_update(struct mbuf *fragment, struct ipq *ipq); 238struct label *mac_lctx_label_alloc(void); 239void mac_lctx_label_free(struct label *label); 240void mac_lctx_label_update(struct lctx *l, struct label *newlabel); 241int mac_lctx_check_label_update(struct lctx *l, struct label *newlabel); 242void mac_lctx_notify_create(proc_t proc, struct lctx *l); 243void mac_lctx_notify_join(proc_t proc, struct lctx *l); 244void mac_lctx_notify_leave(proc_t proc, struct lctx *l); 245void mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); 246void mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *m); 247void mac_mbuf_label_associate_inpcb(struct inpcb *inp, struct mbuf *m); 248void mac_mbuf_label_associate_ipq(struct ipq *ipq, struct mbuf *mbuf); 249void mac_mbuf_label_associate_linklayer(struct ifnet *ifp, struct mbuf *m); 250void mac_mbuf_label_associate_multicast_encap(struct mbuf *oldmbuf, 251 struct ifnet *ifp, struct mbuf *newmbuf); 252void mac_mbuf_label_associate_netlayer(struct mbuf *oldmbuf, 253 struct mbuf *newmbuf); 254void mac_mbuf_label_associate_socket(struct socket *so, struct mbuf *m); 255void mac_mbuf_label_copy(struct mbuf *m_from, struct mbuf *m_to); 256void mac_mbuf_label_destroy(struct mbuf *m); 257int mac_mbuf_label_init(struct mbuf *m, int flag); 258void mac_mbuf_tag_copy(struct m_tag *m, struct m_tag *mtag); 259void mac_mbuf_tag_destroy(struct m_tag *mtag); 260int mac_mbuf_tag_init(struct m_tag *, int how); 261int mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, 262 unsigned int cmd); 263int mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, 264 struct vfs_attr *vfa); 265int mac_mount_check_label_update(vfs_context_t ctx, struct mount *mp); 266int mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, 267 struct componentname *cnp, const char *vfc_name); 268int mac_mount_check_remount(vfs_context_t ctx, struct mount *mp); 269int mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, 270 struct vfs_attr *vfa); 271int mac_mount_check_stat(vfs_context_t ctx, struct mount *mp); 272int mac_mount_check_umount(vfs_context_t ctx, struct mount *mp); 273void mac_mount_label_associate(vfs_context_t ctx, struct mount *mp); 274void mac_mount_label_destroy(struct mount *mp); 275int mac_mount_label_externalize(struct label *label, char *elements, 276 char *outbuf, size_t outbuflen); 277int mac_mount_label_get(struct mount *mp, user_addr_t mac_p); 278void mac_mount_label_init(struct mount *); 279int mac_mount_label_internalize(struct label *, char *string); 280void mac_netinet_fragment(struct mbuf *datagram, struct mbuf *fragment); 281void mac_netinet_icmp_reply(struct mbuf *m); 282void mac_netinet_tcp_reply(struct mbuf *m); 283int mac_pipe_check_ioctl(kauth_cred_t cred, struct pipe *cpipe, 284 unsigned int cmd); 285int mac_pipe_check_kqfilter(kauth_cred_t cred, struct knote *kn, 286 struct pipe *cpipe); 287int mac_pipe_check_read(kauth_cred_t cred, struct pipe *cpipe); 288int mac_pipe_check_select(kauth_cred_t cred, struct pipe *cpipe, 289 int which); 290int mac_pipe_check_stat(kauth_cred_t cred, struct pipe *cpipe); 291int mac_pipe_check_write(kauth_cred_t cred, struct pipe *cpipe); 292struct label *mac_pipe_label_alloc(void); 293void mac_pipe_label_associate(kauth_cred_t cred, struct pipe *cpipe); 294void mac_pipe_label_copy(struct label *src, struct label *dest); 295void mac_pipe_label_destroy(struct pipe *cpipe); 296void mac_pipe_label_free(struct label *label); 297void mac_pipe_label_init(struct pipe *cpipe); 298int mac_pipe_label_update(kauth_cred_t cred, struct pipe *cpipe, 299 struct label *label); 300void mac_policy_initbsd(void); 301int mac_posixsem_check_create(kauth_cred_t cred, const char *name); 302int mac_posixsem_check_open(kauth_cred_t cred, struct pseminfo *psem); 303int mac_posixsem_check_post(kauth_cred_t cred, struct pseminfo *psem); 304int mac_posixsem_check_unlink(kauth_cred_t cred, struct pseminfo *psem, 305 const char *name); 306int mac_posixsem_check_wait(kauth_cred_t cred, struct pseminfo *psem); 307void mac_posixsem_vnode_label_associate(kauth_cred_t cred, 308 struct pseminfo *psem, struct label *plabel, 309 vnode_t vp, struct label *vlabel); 310void mac_posixsem_label_associate(kauth_cred_t cred, 311 struct pseminfo *psem, const char *name); 312void mac_posixsem_label_destroy(struct pseminfo *psem); 313void mac_posixsem_label_init(struct pseminfo *psem); 314int mac_posixshm_check_create(kauth_cred_t cred, const char *name); 315int mac_posixshm_check_mmap(kauth_cred_t cred, struct pshminfo *pshm, 316 int prot, int flags); 317int mac_posixshm_check_open(kauth_cred_t cred, struct pshminfo *pshm, 318 int fflags); 319int mac_posixshm_check_stat(kauth_cred_t cred, struct pshminfo *pshm); 320int mac_posixshm_check_truncate(kauth_cred_t cred, struct pshminfo *pshm, 321 off_t s); 322int mac_posixshm_check_unlink(kauth_cred_t cred, struct pshminfo *pshm, 323 const char *name); 324void mac_posixshm_vnode_label_associate(kauth_cred_t cred, 325 struct pshminfo *pshm, struct label *plabel, 326 vnode_t vp, struct label *vlabel); 327void mac_posixshm_label_associate(kauth_cred_t cred, 328 struct pshminfo *pshm, const char *name); 329void mac_posixshm_label_destroy(struct pshminfo *pshm); 330void mac_posixshm_label_init(struct pshminfo *pshm); 331int mac_priv_check(kauth_cred_t cred, int priv); 332int mac_priv_grant(kauth_cred_t cred, int priv); 333int mac_proc_check_debug(proc_t proc1, proc_t proc2); 334int mac_proc_check_cpumon(proc_t curp); 335int mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor); 336int mac_proc_check_fork(proc_t proc); 337int mac_proc_check_suspend_resume(proc_t proc, int sr); 338int mac_proc_check_get_task_name(kauth_cred_t cred, struct proc *p); 339int mac_proc_check_get_task(kauth_cred_t cred, struct proc *p); 340int mac_proc_check_inherit_ipc_ports(struct proc *p, struct vnode *cur_vp, off_t cur_offset, struct vnode *img_vp, off_t img_offset, struct vnode *scriptvp); 341int mac_proc_check_getaudit(proc_t proc); 342int mac_proc_check_getauid(proc_t proc); 343int mac_proc_check_getlcid(proc_t proc1, proc_t proc2, 344 pid_t pid); 345int mac_proc_check_ledger(proc_t curp, proc_t target, int op); 346int mac_proc_check_map_anon(proc_t proc, user_addr_t u_addr, 347 user_size_t u_size, int prot, int flags, int *maxprot); 348int mac_proc_check_mprotect(proc_t proc, 349 user_addr_t addr, user_size_t size, int prot); 350int mac_proc_check_run_cs_invalid(proc_t proc); 351int mac_proc_check_sched(proc_t proc, proc_t proc2); 352int mac_proc_check_setaudit(proc_t proc, struct auditinfo_addr *ai); 353int mac_proc_check_setauid(proc_t proc, uid_t auid); 354int mac_proc_check_setlcid(proc_t proc1, proc_t proc2, 355 pid_t pid1, pid_t pid2); 356int mac_proc_check_signal(proc_t proc1, proc_t proc2, 357 int signum); 358int mac_proc_check_wait(proc_t proc1, proc_t proc2); 359void mac_proc_set_enforce(proc_t p, int enforce_flags); 360int mac_setsockopt_label(kauth_cred_t cred, struct socket *so, 361 struct mac *extmac); 362int mac_socket_check_accept(kauth_cred_t cred, struct socket *so); 363int mac_socket_check_accepted(kauth_cred_t cred, struct socket *so); 364int mac_socket_check_bind(kauth_cred_t cred, struct socket *so, 365 struct sockaddr *addr); 366int mac_socket_check_connect(kauth_cred_t cred, struct socket *so, 367 struct sockaddr *addr); 368int mac_socket_check_create(kauth_cred_t cred, int domain, 369 int type, int protocol); 370int mac_socket_check_deliver(struct socket *so, struct mbuf *m); 371int mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn, 372 struct socket *so); 373int mac_socket_check_listen(kauth_cred_t cred, struct socket *so); 374int mac_socket_check_receive(kauth_cred_t cred, struct socket *so); 375int mac_socket_check_received(kauth_cred_t cred, struct socket *so, 376 struct sockaddr *saddr); 377int mac_socket_check_select(kauth_cred_t cred, struct socket *so, 378 int which); 379int mac_socket_check_send(kauth_cred_t cred, struct socket *so, 380 struct sockaddr *addr); 381int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so, 382 struct sockopt *sopt); 383int mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so, 384 struct sockopt *sopt); 385int mac_socket_check_stat(kauth_cred_t cred, struct socket *so); 386void mac_socket_label_associate(kauth_cred_t cred, struct socket *so); 387void mac_socket_label_associate_accept(struct socket *oldsocket, 388 struct socket *newsocket); 389void mac_socket_label_copy(struct label *from, struct label *to); 390void mac_socket_label_destroy(struct socket *); 391int mac_socket_label_get(kauth_cred_t cred, struct socket *so, 392 struct mac *extmac); 393int mac_socket_label_init(struct socket *, int waitok); 394void mac_socketpeer_label_associate_mbuf(struct mbuf *m, struct socket *so); 395void mac_socketpeer_label_associate_socket(struct socket *peersocket, 396 struct socket *socket_to_modify); 397int mac_socketpeer_label_get(kauth_cred_t cred, struct socket *so, 398 struct mac *extmac); 399int mac_system_check_acct(kauth_cred_t cred, struct vnode *vp); 400int mac_system_check_audit(kauth_cred_t cred, void *record, int length); 401int mac_system_check_auditctl(kauth_cred_t cred, struct vnode *vp); 402int mac_system_check_auditon(kauth_cred_t cred, int cmd); 403int mac_system_check_chud(kauth_cred_t cred); 404int mac_system_check_host_priv(kauth_cred_t cred); 405int mac_system_check_info(kauth_cred_t, const char *info_type); 406int mac_system_check_nfsd(kauth_cred_t cred); 407int mac_system_check_reboot(kauth_cred_t cred, int howto); 408int mac_system_check_settime(kauth_cred_t cred); 409int mac_system_check_swapoff(kauth_cred_t cred, struct vnode *vp); 410int mac_system_check_swapon(kauth_cred_t cred, struct vnode *vp); 411int mac_system_check_sysctlbyname(kauth_cred_t cred, const char *namestring, int *name, 412 u_int namelen, user_addr_t oldctl, size_t oldlen, 413 user_addr_t newctl, size_t newlen); 414int mac_system_check_kas_info(kauth_cred_t cred, int selector); 415void mac_sysvmsg_label_associate(kauth_cred_t cred, 416 struct msqid_kernel *msqptr, struct msg *msgptr); 417void mac_sysvmsg_label_init(struct msg *msgptr); 418void mac_sysvmsg_label_recycle(struct msg *msgptr); 419int mac_sysvmsq_check_enqueue(kauth_cred_t cred, struct msg *msgptr, 420 struct msqid_kernel *msqptr); 421int mac_sysvmsq_check_msgrcv(kauth_cred_t cred, struct msg *msgptr); 422int mac_sysvmsq_check_msgrmid(kauth_cred_t cred, struct msg *msgptr); 423int mac_sysvmsq_check_msqctl(kauth_cred_t cred, 424 struct msqid_kernel *msqptr, int cmd); 425int mac_sysvmsq_check_msqget(kauth_cred_t cred, 426 struct msqid_kernel *msqptr); 427int mac_sysvmsq_check_msqrcv(kauth_cred_t cred, 428 struct msqid_kernel *msqptr); 429int mac_sysvmsq_check_msqsnd(kauth_cred_t cred, 430 struct msqid_kernel *msqptr); 431void mac_sysvmsq_label_associate(kauth_cred_t cred, 432 struct msqid_kernel *msqptr); 433void mac_sysvmsq_label_init(struct msqid_kernel *msqptr); 434void mac_sysvmsq_label_recycle(struct msqid_kernel *msqptr); 435int mac_sysvsem_check_semctl(kauth_cred_t cred, 436 struct semid_kernel *semakptr, int cmd); 437int mac_sysvsem_check_semget(kauth_cred_t cred, 438 struct semid_kernel *semakptr); 439int mac_sysvsem_check_semop(kauth_cred_t cred, 440 struct semid_kernel *semakptr, size_t accesstype); 441void mac_sysvsem_label_associate(kauth_cred_t cred, 442 struct semid_kernel *semakptr); 443void mac_sysvsem_label_destroy(struct semid_kernel *semakptr); 444void mac_sysvsem_label_init(struct semid_kernel *semakptr); 445void mac_sysvsem_label_recycle(struct semid_kernel *semakptr); 446int mac_sysvshm_check_shmat(kauth_cred_t cred, 447 struct shmid_kernel *shmsegptr, int shmflg); 448int mac_sysvshm_check_shmctl(kauth_cred_t cred, 449 struct shmid_kernel *shmsegptr, int cmd); 450int mac_sysvshm_check_shmdt(kauth_cred_t cred, 451 struct shmid_kernel *shmsegptr); 452int mac_sysvshm_check_shmget(kauth_cred_t cred, 453 struct shmid_kernel *shmsegptr, int shmflg); 454void mac_sysvshm_label_associate(kauth_cred_t cred, 455 struct shmid_kernel *shmsegptr); 456void mac_sysvshm_label_destroy(struct shmid_kernel *shmsegptr); 457void mac_sysvshm_label_init(struct shmid_kernel* shmsegptr); 458void mac_sysvshm_label_recycle(struct shmid_kernel *shmsegptr); 459struct label * mac_thread_label_alloc(void); 460void mac_thread_label_destroy(struct uthread *uthread); 461void mac_thread_label_free(struct label *label); 462void mac_thread_label_init(struct uthread *uthread); 463int mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, 464 int acc_mode); 465int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp); 466int mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, 467 struct componentname *cnp); 468int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, 469 struct componentname *cnp, struct vnode_attr *vap); 470int mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, 471 const char *name); 472int mac_vnode_check_exchangedata(vfs_context_t ctx, struct vnode *v1, 473 struct vnode *v2); 474int mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, 475 struct image_params *imgp); 476int mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp); 477int mac_vnode_check_signature(struct vnode *vp, off_t macho_offset, 478 unsigned char *sha1, const void * signature, size_t size, 479 int *is_platform_binary); 480int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, 481 struct attrlist *alist); 482int mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, 483 const char *name, struct uio *uio); 484int mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, 485 unsigned int cmd); 486int mac_vnode_check_kqfilter(vfs_context_t ctx, 487 kauth_cred_t file_cred, struct knote *kn, struct vnode *vp); 488int mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp, 489 struct label *newlabel); 490int mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, 491 struct vnode *vp, struct componentname *cnp); 492int mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp); 493int mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, 494 struct componentname *cnp); 495int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, 496 int acc_mode); 497int mac_vnode_check_read(vfs_context_t ctx, 498 kauth_cred_t file_cred, struct vnode *vp); 499int mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *vp); 500int mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp); 501int mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp, 502 struct vnode *vp, struct componentname *cnp, struct vnode *tdvp, 503 struct vnode *tvp, struct componentname *tcnp); 504int mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp); 505int mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, 506 struct attrlist *alist); 507int mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, 508 int which); 509int mac_vnode_check_setattrlist(vfs_context_t ctxd, struct vnode *vp, 510 struct attrlist *alist); 511int mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, 512 const char *name, struct uio *uio); 513int mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, 514 u_long flags); 515int mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, 516 mode_t mode); 517int mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, 518 uid_t uid, gid_t gid); 519int mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, 520 struct timespec atime, struct timespec mtime); 521int mac_vnode_check_stat(vfs_context_t ctx, 522 kauth_cred_t file_cred, struct vnode *vp); 523int mac_vnode_check_truncate(vfs_context_t ctx, 524 kauth_cred_t file_cred, struct vnode *vp); 525int mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, 526 struct componentname *cnp, struct vnode_attr *vap); 527int mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp); 528int mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, 529 struct vnode *vp, struct componentname *cnp); 530int mac_vnode_check_write(vfs_context_t ctx, 531 kauth_cred_t file_cred, struct vnode *vp); 532struct label *mac_vnode_label_alloc(void); 533int mac_vnode_label_associate(struct mount *mp, struct vnode *vp, 534 vfs_context_t ctx); 535void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de, 536 struct vnode *vp); 537int mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp); 538int mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, 539 struct vnode *vp, vfs_context_t ctx); 540void mac_vnode_label_associate_singlelabel(struct mount *mp, 541 struct vnode *vp); 542void mac_vnode_label_copy(struct label *l1, struct label *l2); 543void mac_vnode_label_destroy(struct vnode *vp); 544int mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac); 545void mac_vnode_label_free(struct label *label); 546void mac_vnode_label_init(struct vnode *vp); 547int mac_vnode_label_init_needed(struct vnode *vp); 548void mac_vnode_label_recycle(struct vnode *vp); 549void mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, 550 struct label *newlabel); 551void mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, 552 const char *name); 553int mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, 554 struct vnode *dvp, struct vnode *vp, struct componentname *cnp); 555void mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, 556 struct vnode *dvp, struct componentname *cnp); 557void mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags); 558void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, 559 struct vnode *dvp, struct componentname *cnp); 560int mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offsetInMacho); 561int vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, 562 struct componentname *cnp, int flags, vfs_context_t ctx); 563void vnode_relabel(struct vnode *vp); 564void mac_pty_notify_grant(proc_t p, struct tty *tp, dev_t dev, struct label *label); 565void mac_pty_notify_close(proc_t p, struct tty *tp, dev_t dev, struct label *label); 566int mac_kext_check_load(kauth_cred_t cred, const char *identifier); 567int mac_kext_check_unload(kauth_cred_t cred, const char *identifier); 568 569void psem_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); 570void pshm_label_associate(struct fileproc *fp, struct vnode *vp, struct vfs_context *ctx); 571 572#if CONFIG_MACF_NET 573struct label *mac_bpfdesc_label_get(struct bpf_d *d); 574void mac_bpfdesc_label_set(struct bpf_d *d, struct label *label); 575#endif 576 577#endif /* CONFIG_MACF */ 578 579#endif /* !_SECURITY_MAC_FRAMEWORK_H_ */ 580