mac_policy.h

Overview

Kernel Interfaces for MAC policy modules

Discussion

This header defines the list of operations that are defined by the TrustedBSD MAC Framwork on Darwin. MAC Policy modules register with the framework to declare interest in a specific set of operations. If interest in an entry point is not declared, then the policy will be ignored when the Framework evaluates that entry point.

Flags for the mpc_loadtime_flags field

Group members:

Flags for MAC allocator interfaces

Group members:

Entry Points for Label Management

Group members:

Functions

mac_policy_register

MAC policy module registration routine

mac_policy_unregister

MAC policy module de-registration routine

MAC policy module registration routine

int mac_policy_register(
    struct mac_policy_conf *mpc, 
    mac_policy_handle_t *handlep,
    void *xd);  

Discussion

This function is called to register a policy with the MAC framework. A policy module will typically call this from the Darwin KEXT registration routine.

MAC policy module de-registration routine

int mac_policy_unregister(
    mac_policy_handle_t handle);  

Discussion

This function is called to de-register a policy with theD MAC framework. A policy module will typically call this from the Darwin KEXT de-registration routine.

Typedefs

dummy

kauth_cred_t

mac_policy_handle_t

MAC policy handle type

mac_proc_check_run_cs_invalid_t

Privilege check for a process to run invalid

mpo_audit_check_postselect_t

Audit event postselection

mpo_audit_check_preselect_t

Audit event preselection

mpo_bpfdesc_check_receive_t

Check whether BPF can read from a network interface

mpo_bpfdesc_label_associate_t

Associate a BPF descriptor with a label

mpo_bpfdesc_label_destroy_t

Destroy BPF descriptor label

mpo_bpfdesc_label_init_t

Initialize BPF descriptor label

mpo_cred_check_label_update_execve_t

Indicate desire to change the process label at exec time

mpo_cred_check_label_update_t

Access control check for relabelling processes

mpo_cred_check_visible_t

Access control check for visibility of other subjects

mpo_cred_label_associate_fork_t

Associate a credential with a new process at fork

mpo_cred_label_associate_kernel_t

Create the first process

mpo_cred_label_associate_t

Create a credential label

mpo_cred_label_associate_user_t

Create the first process

mpo_cred_label_destroy_t

Destroy credential label

mpo_cred_label_externalize_audit_t

Externalize a user credential label for auditing

mpo_cred_label_externalize_t

Externalize a user credential label

mpo_cred_label_init_t

Initialize user credential label

mpo_cred_label_internalize_t

Internalize a user credential label

mpo_cred_label_update_execve_t

Update credential at exec time

mpo_cred_label_update_t

Update a credential label

mpo_devfs_label_associate_device_t

Create a new devfs device

mpo_devfs_label_associate_directory_t

Create a new devfs directory

mpo_devfs_label_copy_t

Copy a devfs label

mpo_devfs_label_destroy_t

Destroy devfs label

mpo_devfs_label_init_t

Initialize devfs label

mpo_devfs_label_update_t

Update a devfs label after relabelling its vnode

mpo_file_check_change_offset_t

Access control for changing the offset of a file descriptor

mpo_file_check_create_t

Access control for creating a file descriptor

mpo_file_check_dup_t

Access control for duplicating a file descriptor

mpo_file_check_fcntl_t

Access control check for fcntl

mpo_file_check_get_offset_t

Access control for getting the offset of a file descriptor

mpo_file_check_get_t

Access control check for mac_get_fd

mpo_file_check_inherit_t

Access control for inheriting a file descriptor

mpo_file_check_ioctl_t

Access control check for file ioctl

mpo_file_check_lock_t

Access control check for file locking

mpo_file_check_mmap_downgrade_t

Downgrade the mmap protections

mpo_file_check_mmap_t

Access control check for mapping a file

mpo_file_check_receive_t

Access control for receiving a file descriptor

mpo_file_check_set_t

Access control check for mac_set_fd

mpo_file_label_associate_t

Create file label

mpo_file_label_destroy_t

Destroy file label

mpo_file_label_init_t

Initialize file label

mpo_ifnet_check_label_update_t

Access control check for relabeling network interfaces

mpo_ifnet_check_transmit_t

Access control check for relabeling network interfaces

mpo_ifnet_label_associate_t

Create a network interface label

mpo_ifnet_label_copy_t

Copy an ifnet label

mpo_ifnet_label_destroy_t

Destroy ifnet label

mpo_ifnet_label_externalize_t

Externalize an ifnet label

mpo_ifnet_label_init_t

Initialize ifnet label

mpo_ifnet_label_internalize_t

Internalize an interface label

mpo_ifnet_label_recycle_t

Recycle up a network interface label

mpo_ifnet_label_update_t

Update a network interface label

mpo_inpcb_check_deliver_t

Access control check for delivering a packet to a socket

mpo_inpcb_label_associate_t

Create an inpcb label

mpo_inpcb_label_destroy_t

Destroy inpcb label

mpo_inpcb_label_init_t

Initialize inpcb label

mpo_inpcb_label_recycle_t

Recycle up an inpcb label

mpo_inpcb_label_update_t

Update an inpcb label from a socket label

mpo_iokit_check_device_t

Device hardware access control

mpo_ipq_label_associate_t

Create an IP reassembly queue label

mpo_ipq_label_compare_t

Compare an mbuf header label to an ipq label

mpo_ipq_label_destroy_t

Destroy IP reassembly queue label

mpo_ipq_label_init_t

Initialize IP reassembly queue label

mpo_ipq_label_update_t

Update the label on an IP fragment reassembly queue

mpo_lctx_check_label_update_t

Access control check for relabelling Login Context

mpo_lctx_label_destroy_t

Destroy Login Context label

mpo_lctx_label_externalize_t

Externalize a Login Context label

mpo_lctx_label_init_t

Initialize Login Context label

mpo_lctx_label_internalize_t

Internalize a Login Context label

mpo_lctx_label_update_t

Update a Login Context label

mpo_lctx_notify_create_t

A process has created a login context

mpo_lctx_notify_join_t

A process has joined a login context

mpo_lctx_notify_leave_t

A process has left a login context

mpo_mbuf_label_associate_bpfdesc_t

Assign a label to a new mbuf

mpo_mbuf_label_associate_ifnet_t

Assign a label to a new mbuf

mpo_mbuf_label_associate_inpcb_t

Assign a label to a new mbuf

mpo_mbuf_label_associate_ipq_t

Set the label on a newly reassembled IP datagram

mpo_mbuf_label_associate_linklayer_t

Assign a label to a new mbuf

mpo_mbuf_label_associate_multicast_encap_t

Assign a label to a new mbuf

mpo_mbuf_label_associate_netlayer_t

Assign a label to a new mbuf

mpo_mbuf_label_associate_socket_t

Assign a label to a new mbuf

mpo_mbuf_label_copy_t

Copy a mbuf label

mpo_mbuf_label_destroy_t

Destroy mbuf label

mpo_mbuf_label_init_t

Initialize mbuf label

mpo_mount_check_fsctl_t

Access control check for fsctl

mpo_mount_check_getattr_t

Access control check for the retrieval of file system attributes

mpo_mount_check_label_update_t

Access control check for mount point relabeling

mpo_mount_check_mount_t

Access control check for mounting a file system

mpo_mount_check_remount_t

Access control check remounting a filesystem

mpo_mount_check_setattr_t

Access control check for the settting of file system attributes

mpo_mount_check_stat_t

Access control check for file system statistics

mpo_mount_check_umount_t

Access control check for unmounting a filesystem

mpo_mount_label_associate_t

Create mount labels

mpo_mount_label_destroy_t

Destroy mount label

mpo_mount_label_externalize_t

Externalize a mount point label

mpo_mount_label_init_t

Initialize mount point label

mpo_mount_label_internalize_t

Internalize a mount point label

mpo_netinet_fragment_t

Set the label on an IPv4 datagram fragment

mpo_netinet_icmp_reply_t

Set the label on an ICMP reply

mpo_netinet_tcp_reply_t

Set the label on a TCP reply

mpo_pipe_check_ioctl_t

Access control check for pipe ioctl

mpo_pipe_check_kqfilter_t

Access control check for pipe kqfilter

mpo_pipe_check_label_update_t

Access control check for pipe relabel

mpo_pipe_check_read_t

Access control check for pipe read

mpo_pipe_check_select_t

Access control check for pipe select

mpo_pipe_check_stat_t

Access control check for pipe stat

mpo_pipe_check_write_t

Access control check for pipe write

mpo_pipe_label_associate_t

Create a pipe label

mpo_pipe_label_copy_t

Copy a pipe label

mpo_pipe_label_destroy_t

Destroy pipe label

mpo_pipe_label_externalize_t

Externalize a pipe label

mpo_pipe_label_init_t

Initialize pipe label

mpo_pipe_label_internalize_t

Internalize a pipe label

mpo_pipe_label_update_t

Update a pipe label

mpo_policy_destroy_t

Policy unload event

mpo_policy_init_t

Policy initialization event

mpo_policy_initbsd_t

Policy BSD initialization event

mpo_policy_syscall_t

Policy extension service

mpo_port_check_copy_send_t

Access control check for copying a send right to another task

mpo_port_check_hold_receive_t

Access control check for obtaining a receive right

mpo_port_check_hold_send_once_t

Access control check for obtaining a send once right

mpo_port_check_hold_send_t

Access control check for obtaining a send right

mpo_port_check_label_update_t

Access control check for relabelling ports

mpo_port_check_make_send_once_t

Access control check for producing a send once right from a receive right

mpo_port_check_make_send_t

Access control check for producing a send right from a receive right

mpo_port_check_method_t

Compute access control check for a Mach message-based service

mpo_port_check_move_receive_t

Access control check for transferring a receive right

mpo_port_check_move_send_once_t

Access control check for transferring a send once right

mpo_port_check_move_send_t

Access control check for transferring a send right

mpo_port_check_receive_t

Access control check for receiving Mach messsages

mpo_port_check_send_t

Access control check for sending Mach messsages

mpo_port_check_service_t

Generic access control check

mpo_port_label_associate_kernel_t

Assign a label to a new Mach port created by the kernel

mpo_port_label_associate_t

Assign a label to a new Mach port

mpo_port_label_compute_t

Request label for new (userspace) object

mpo_port_label_copy_t

Copy a Mach port label

mpo_port_label_destroy_t

Destroy Mach port label

mpo_port_label_init_t

Initialize Mach port label

mpo_port_label_update_cred_t

Update a Mach task port label

mpo_port_label_update_kobject_t

Assign a label to a Mach port connected to a kernel object

mpo_posixsem_check_create_t

Access control check for POSIX semaphore create

mpo_posixsem_check_open_t

Access control check for POSIX semaphore open

mpo_posixsem_check_post_t

Access control check for POSIX semaphore post

mpo_posixsem_check_unlink_t

Access control check for POSIX semaphore unlink

mpo_posixsem_check_wait_t

Access control check for POSIX semaphore wait

mpo_posixsem_label_associate_t

Create a POSIX semaphore label

mpo_posixsem_label_destroy_t

Destroy POSIX semaphore label

mpo_posixsem_label_init_t

Initialize POSIX semaphore label

mpo_posixshm_check_create_t

Access control check for POSIX shared memory region create

mpo_posixshm_check_mmap_t

Access control check for mapping POSIX shared memory

mpo_posixshm_check_open_t

Access control check for POSIX shared memory region open

mpo_posixshm_check_stat_t

Access control check for POSIX shared memory stat

mpo_posixshm_check_truncate_t

Access control check for POSIX shared memory truncate

mpo_posixshm_check_unlink_t

Access control check for POSIX shared memory unlink

mpo_posixshm_label_associate_t

Create a POSIX shared memory region label

mpo_posixshm_label_destroy_t

Destroy POSIX shared memory label

mpo_posixshm_label_init_t

Initialize POSIX Shared Memory region label

mpo_proc_check_debug_t

Access control check for debugging process

mpo_proc_check_fork_t

Access control over fork

mpo_proc_check_get_task_name_t

Access control check for getting a process's task name

mpo_proc_check_get_task_t

Access control check for getting a process's task port

mpo_proc_check_getaudit_t

Access control check for retrieving audit information

mpo_proc_check_getauid_t

Access control check for retrieving audit user ID

mpo_proc_check_getlcid_t

Access control check for retrieving Login Context ID

mpo_proc_check_mprotect_t

Access control check for setting memory protections

mpo_proc_check_sched_t

Access control check for changing scheduling parameters

mpo_proc_check_setaudit_t

Access control check for setting audit information

mpo_proc_check_setauid_t

Access control check for setting audit user ID

mpo_proc_check_setlcid_t

Access control check for setting the Login Context

mpo_proc_check_signal_t

Access control check for delivering signal

mpo_proc_check_wait_t

Access control check for wait

mpo_proc_label_destroy_t

Destroy process label

mpo_proc_label_init_t

Initialize process label

mpo_socket_check_accept_t

Access control check for socket accept

mpo_socket_check_accepted_t

Access control check for a pending socket accept

mpo_socket_check_bind_t

Access control check for socket bind

mpo_socket_check_connect_t

Access control check for socket connect

mpo_socket_check_create_t

Access control check for socket() system call.

mpo_socket_check_deliver_t

Access control check for delivering data to a user's receieve queue

mpo_socket_check_getsockopt_t

Access control check for getting socket options

mpo_socket_check_kqfilter_t

Access control check for socket kqfilter

mpo_socket_check_label_update_t

Access control check for socket relabel

mpo_socket_check_listen_t

Access control check for socket listen

mpo_socket_check_receive_t

Access control check for socket receive

mpo_socket_check_received_t

Access control check for socket receive

mpo_socket_check_select_t

Access control check for socket select

mpo_socket_check_send_t

Access control check for socket send

mpo_socket_check_setsockopt_t

Access control check for setting socket options

mpo_socket_check_stat_t

Access control check for retrieving socket status

mpo_socket_label_associate_accept_t

Label a socket

mpo_socket_label_associate_t

Assign a label to a new socket

mpo_socket_label_copy_t

Copy a socket label

mpo_socket_label_destroy_t

Destroy socket label

mpo_socket_label_externalize_t

Externalize a socket label

mpo_socket_label_init_t

Initialize socket label

mpo_socket_label_internalize_t

Internalize a socket label

mpo_socket_label_update_t

Relabel socket

mpo_socketpeer_label_associate_mbuf_t

Set the peer label on a socket from mbuf

mpo_socketpeer_label_associate_socket_t

Set the peer label on a socket from socket

mpo_socketpeer_label_destroy_t

Destroy socket peer label

mpo_socketpeer_label_externalize_t

Externalize a socket peer label

mpo_socketpeer_label_init_t

Initialize socket peer label

mpo_system_check_acct_t

Access control check for enabling accounting

mpo_system_check_audit_t

Access control check for audit

mpo_system_check_auditctl_t

Access control check for controlling audit

mpo_system_check_auditon_t

Access control check for manipulating auditing

mpo_system_check_host_priv_t

Access control check for obtaining the host control port

mpo_system_check_nfsd_t

Access control check for calling NFS services

mpo_system_check_reboot_t

Access control check for reboot

mpo_system_check_settime_t

Access control check for setting system clock

mpo_system_check_swapoff_t

Access control check for removing swap devices

mpo_system_check_swapon_t

Access control check for adding swap devices

mpo_system_check_sysctl_t

Access control check for sysctl

mpo_sysvmsg_label_associate_t

Create a System V message label

mpo_sysvmsg_label_destroy_t

Destroy System V message label

mpo_sysvmsg_label_init_t

Initialize System V message label

mpo_sysvmsg_label_recycle_t

Clean up a System V message label

mpo_sysvmsq_check_enqueue_t

Access control check for System V message enqueuing

mpo_sysvmsq_check_msgrcv_t

Access control check for System V message reception

mpo_sysvmsq_check_msgrmid_t

Access control check for System V message queue removal

mpo_sysvmsq_check_msqctl_t

Access control check for msgctl()

mpo_sysvmsq_check_msqget_t

Access control check to get a System V message queue

mpo_sysvmsq_check_msqrcv_t

Access control check to receive a System V message from the given queue

mpo_sysvmsq_check_msqsnd_t

Access control check to send a System V message to the given queue

mpo_sysvmsq_label_associate_t

Create a System V message queue label

mpo_sysvmsq_label_destroy_t

Destroy System V message queue label

mpo_sysvmsq_label_init_t

Initialize System V message queue label

mpo_sysvmsq_label_recycle_t

Clean up a System V message queue label

mpo_sysvsem_check_semctl_t

Access control check for System V semaphore control operation

mpo_sysvsem_check_semget_t

Access control check for obtaining a System V semaphore

mpo_sysvsem_check_semop_t

Access control check for System V semaphore operations

mpo_sysvsem_label_associate_t

Create a System V semaphore label

mpo_sysvsem_label_destroy_t

Destroy System V semaphore label

mpo_sysvsem_label_init_t

Initialize System V semaphore label

mpo_sysvsem_label_recycle_t

Clean up a System V semaphore label

mpo_sysvshm_check_shmat_t

Access control check for mapping System V shared memory

mpo_sysvshm_check_shmctl_t

Access control check for System V shared memory control operation

mpo_sysvshm_check_shmdt_t

Access control check for unmapping System V shared memory

mpo_sysvshm_check_shmget_t

Access control check obtaining System V shared memory identifier

mpo_sysvshm_label_associate_t

Create a System V shared memory region label

mpo_sysvshm_label_destroy_t

Destroy System V shared memory label

mpo_sysvshm_label_init_t

Initialize System V Shared Memory region label

mpo_sysvshm_label_recycle_t

Clean up a System V Share Memory Region label

mpo_task_label_associate_kernel_t

Assign a label to a new kernelspace Mach task

mpo_task_label_associate_t

Assign a label to a new (userspace) Mach task

mpo_task_label_copy_t

Copy a Mach task label

mpo_task_label_destroy_t

Destroy Mach task label

mpo_task_label_externalize_t

Externalize a task label

mpo_task_label_init_t

Initialize Mach task label

mpo_task_label_internalize_t

Internalize a task label

mpo_task_label_update_t

Update a Mach task label

mpo_thread_userret_t

Perform MAC-related events when a thread returns to user space

mpo_vnode_check_access_t

Check vnode access

mpo_vnode_check_chdir_t

Access control check for changing working directory

mpo_vnode_check_chroot_t

Access control check for changing root directory

mpo_vnode_check_create_t

Access control check for creating vnode

mpo_vnode_check_deleteextattr_t

Access control check for deleting extended attribute

mpo_vnode_check_exchangedata_t

Access control check for exchanging file data

mpo_vnode_check_exec_t

Access control check for executing the vnode

mpo_vnode_check_getattrlist_t

Access control check for retrieving file attributes

mpo_vnode_check_getextattr_t

Access control check for retrieving an extended attribute

mpo_vnode_check_ioctl_t

Access control check for ioctl

mpo_vnode_check_kqfilter_t

Access control check for vnode kqfilter

mpo_vnode_check_label_update_t

Access control check for relabel

mpo_vnode_check_link_t

Access control check for creating link

mpo_vnode_check_listextattr_t

Access control check for listing extended attributes

mpo_vnode_check_lookup_t

Access control check for lookup

mpo_vnode_check_open_t

Access control check for open

mpo_vnode_check_read_t

Access control check for read

mpo_vnode_check_readdir_t

Access control check for read directory

mpo_vnode_check_readlink_t

Access control check for read link

mpo_vnode_check_rename_from_t

Access control check for rename from

mpo_vnode_check_rename_to_t

Access control check for rename to

mpo_vnode_check_revoke_t

Access control check for revoke

mpo_vnode_check_select_t

Access control check for select

mpo_vnode_check_setattrlist_t

Access control check for setting file attributes

mpo_vnode_check_setextattr_t

Access control check for setting extended attribute

mpo_vnode_check_setflags_t

Access control check for setting flags

mpo_vnode_check_setmode_t

Access control check for setting mode

mpo_vnode_check_setowner_t

Access control check for setting uid and gid

mpo_vnode_check_setutimes_t

Access control check for setting timestamps

mpo_vnode_check_signature_t

Access control check after determining the code directory hash

mpo_vnode_check_stat_t

Access control check for stat

mpo_vnode_check_truncate_t

Access control check for truncate/ftruncate

mpo_vnode_check_uipc_bind_t

Access control check for binding UNIX domain socket

mpo_vnode_check_uipc_connect_t

Access control check for connecting UNIX domain socket

mpo_vnode_check_unlink_t

Access control check for deleting vnode

mpo_vnode_check_write_t

Access control check for write

mpo_vnode_label_associate_devfs_t

Associate a vnode with a devfs entry

mpo_vnode_label_associate_extattr_t

Associate a label with a vnode

mpo_vnode_label_associate_file_t

Associate a file label with a vnode

mpo_vnode_label_associate_pipe_t

Associate a pipe label with a vnode

mpo_vnode_label_associate_posixsem_t

Associate a POSIX semaphore label with a vnode

mpo_vnode_label_associate_posixshm_t

Associate a POSIX shared memory label with a vnode

mpo_vnode_label_associate_singlelabel_t

Associate a label with a vnode

mpo_vnode_label_associate_socket_t

Associate a socket label with a vnode

mpo_vnode_label_copy_t

Copy a vnode label

mpo_vnode_label_destroy_t

Destroy vnode label

mpo_vnode_label_externalize_audit_t

Externalize a vnode label for auditing

mpo_vnode_label_externalize_t

Externalize a vnode label

mpo_vnode_label_init_t

Initialize vnode label

mpo_vnode_label_internalize_t

Internalize a vnode label

mpo_vnode_label_recycle_t

Clean up a vnode label

mpo_vnode_label_store_t

Write a label to a extended attribute

mpo_vnode_label_update_extattr_t

Update vnode label from extended attributes

mpo_vnode_label_update_t

Update a vnode label

mpo_vnode_notify_create_t

Create a new vnode, backed by extended attributes

typedef struct ucred *kauth_cred_t;  

typedef struct ucred *kauth_cred_t;  

MAC policy handle type

typedef unsigned int mac_policy_handle_t;  

Discussion

The MAC handle is used to uniquely identify a loaded policy within the MAC Framework.

A variable of this type is set by mac_policy_register().

Privilege check for a process to run invalid

typedef int mac_proc_check_run_cs_invalid_t( 
    struct proc *p );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the process may execute even though the system determined that it is untrusted (eg unidentified / modified code).

Audit event postselection

typedef int mpo_audit_check_postselect_t( 
    kauth_cred_t cred, 
    unsigned short syscode, 
    void *args, 
    int error, 
    int retval );  

Parameters

Return Value

Return MAC_AUDIT_NO to force suppression of the audit record. Any other value results in the audit record being committed.

Discussion

This is the MAC Framework audit postselect, which is called before exiting a syscall to determine if an audit event should be committed. A return value of MAC_AUDIT_NO forces the audit record to be suppressed. Any other return value results in the audit record being committed.

WARNING:

Audit event preselection

typedef int mpo_audit_check_preselect_t( 
    kauth_cred_t cred, 
    unsigned short syscode, 
    void *args );  

Parameters

Return Value

Return MAC_AUDIT_YES to force auditing of the syscall, MAC_AUDIT_NO to force no auditing of the syscall, MAC_AUDIT_DEFAULT to allow auditing mechanisms to determine if the syscall is audited.

Discussion

This is the MAC Framework audit preselect, which is called before a syscall is entered to determine if an audit event should be created. If the MAC policy forces the syscall to be audited, MAC_AUDIT_YES should be returned. A return value of MAC_AUDIT_NO causes the audit record to be suppressed. Returning MAC_POLICY_DEFAULT indicates that the policy wants to defer to the system's existing preselection mechanism.

When policies return different preferences, the Framework decides what action to take based on the following policy. If any policy returns MAC_AUDIT_YES, then create an audit record, else if any policy returns MAC_AUDIT_NO, then suppress the creations of an audit record, else defer to the system's existing preselection mechanism.

WARNING:

Check whether BPF can read from a network interface

typedef int mpo_bpfdesc_check_receive_t( 
    struct bpf_d *bpf_d, 
    struct label *bpflabel, 
    struct ifnet *ifp, 
    struct label *ifnetlabel );  

Fields

Discussion

Determine whether the MAC framework should permit datagrams from the passed network interface to be delivered to the buffers of the passed BPF descriptor. Return (0) for success, or an errno value for failure. Suggested failure: EACCES for label mismatches, EPERM for lack of privilege.

Associate a BPF descriptor with a label

typedef void mpo_bpfdesc_label_associate_t( 
    kauth_cred_t cred, 
    struct bpf_d *bpf_d, 
    struct label *bpflabel );  

Fields

Discussion

Set the label on a newly created BPF descriptor from the passed subject credential. This call will be made when a BPF device node is opened by a process with the passed subject credential.

Destroy BPF descriptor label

typedef void mpo_bpfdesc_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy a BPF descriptor label. Since the BPF descriptor is going out of scope, policy modules should free any internal storage associated with the label so that it may be destroyed.

Initialize BPF descriptor label

typedef void mpo_bpfdesc_label_init_t( 
    struct label *label );  

Fields

Discussion

Initialize the label for a newly instantiated BPF descriptor. Sleeping is permitted.

Indicate desire to change the process label at exec time

typedef int mpo_cred_check_label_update_execve_t( 
    kauth_cred_t old, 
    struct vnode *vp, 
    struct label *vnodelabel, 
    struct label *scriptvnodelabel, 
    struct label *execlabel, 
    struct proc *proc );  

Parameters

Return Value

Non-zero if a transition is required, 0 otherwise.

Discussion

Indicate whether this policy intends to update the label of a newly created credential from the existing subject credential (old). This call occurs when a process executes the passed vnode. If a policy returns success from this entry point, the mpo_cred_label_update_execve entry point will later be called with the same parameters. Access has already been checked via the mpo_vnode_check_exec entry point, this entry point is necessary to preserve kernel locking constraints during program execution.

The supplied vnode and vnodelabel correspond with the file actually being executed; in the case that the file is interpreted (for example, a script), the label of the original exec-time vnode has been preserved in scriptvnodelabel.

The final label, execlabel, corresponds to a label supplied by a user space application through the use of the mac_execve system call.

The vnode lock is held during this operation. No changes should be made to the old credential structure.

WARNING:

Access control check for relabelling processes

typedef int mpo_cred_check_label_update_t( 
    kauth_cred_t cred, 
    struct label *newlabel );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can relabel itself to the supplied new label (newlabel). This access control check is called when the mac_set_proc system call is invoked. A user space application will supply a new value, the value will be internalized and provided in newlabel.

Access control check for visibility of other subjects

typedef int mpo_cred_check_visible_t( 
    kauth_cred_t u1, 
    kauth_cred_t u2 );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned. Suggested failure: EACCES for label mismatch, EPERM for lack of privilege, or ESRCH to hide visibility.

Discussion

Determine whether the subject identified by the credential u1 can "see" other subjects with the passed subject credential u2. This call may be made in a number of situations, including inter-process status sysctls used by ps, and in procfs lookups.

Associate a credential with a new process at fork

typedef void mpo_cred_label_associate_fork_t( 
    kauth_cred_t cred, 
    proc_t proc );  

Fields

Discussion

Allow a process to associate the credential with a new process for reference countng purposes. NOTE: the credential can be dis-associated in ways other than exit - so this strategy is flawed - should just catch label destroy callback.

Create the first process

typedef void mpo_cred_label_associate_kernel_t( 
    kauth_cred_t cred );  

Fields

Discussion

Create the subject credential of process 0, the parent of all BSD kernel processes. Policies should update the label in the previously initialized credential structure.

Create a credential label

typedef void mpo_cred_label_associate_t( 
    kauth_cred_t parent_cred, 
    kauth_cred_t child_cred );  

Fields

Discussion

Set the label of a newly created credential, most likely using the information in the supplied parent credential.

WARNING:

Create the first process

typedef void mpo_cred_label_associate_user_t( 
    kauth_cred_t cred );  

Fields

Discussion

Create the subject credential of process 1, the parent of all BSD user processes. Policies should update the label in the previously initialized credential structure. This is the 'init' process.

Destroy credential label

typedef void mpo_cred_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy a user credential label. Since the user credential is going out of scope, policy modules should free any internal storage associated with the label so that it may be destroyed.

Externalize a user credential label for auditing

typedef int mpo_cred_label_externalize_audit_t( 
    struct label *label, 
    char *element_name, 
    struct sbuf *sb );  

Parameters

Return Value

0 on success, return non-zero if an error occurs while externalizing the label data.

Discussion

Produce an external representation of the label on a user credential for inclusion in an audit record. An externalized label consists of a text representation of the label contents that will be added to the audit record as part of a text token. Policy-agnostic user space tools will display this externalized version.

Externalize a user credential label

typedef int mpo_cred_label_externalize_t( 
    struct label *label, 
    char *element_name, 
    struct sbuf *sb );  

Parameters

Return Value

0 on success, return non-zero if an error occurs while externalizing the label data.

Discussion

Produce an external representation of the label on a user credential. An externalized label consists of a text representation of the label contents that can be used with user applications. Policy-agnostic user space tools will display this externalized version.

Initialize user credential label

typedef void mpo_cred_label_init_t( 
    struct label *label );  

Fields

Discussion

Initialize the label for a newly instantiated user credential. Sleeping is permitted.

Internalize a user credential label

typedef int mpo_cred_label_internalize_t( 
    struct label *label, 
    char *element_name, 
    char *element_data );  

Parameters

Return Value

0 on success, Otherwise, return non-zero if an error occurs while internalizing the label data.

Discussion

Produce a user credential label from an external representation. An externalized label consists of a text representation of the label contents that can be used with user applications. Policy-agnostic user space tools will forward text version to the kernel for processing by individual policy modules.

The policy's internalize entry points will be called only if the policy has registered interest in the label namespace.

Update credential at exec time

typedef void mpo_cred_label_update_execve_t( 
    kauth_cred_t old_cred, 
    kauth_cred_t new_cred, 
    struct vnode *vp, 
    struct label *vnodelabel, 
    struct label *scriptvnodelabel, 
    struct label *execlabel, 
    int *disjointp );  

Fields

Discussion

Update the label of a newly created credential (new) from the existing subject credential (old). This call occurs when a process executes the passed vnode and one of the loaded policy modules has returned success from the mpo_cred_check_label_update_execve entry point. Access has already been checked via the mpo_vnode_check_exec entry point, this entry point is only used to update any policy state.

The supplied vnode and vnodelabel correspond with the file actually being executed; in the case that the file is interpreted (for example, a script), the label of the original exec-time vnode has been preserved in scriptvnodelabel.

The final label, execlabel, corresponds to a label supplied by a user space application through the use of the mac_execve system call.

If non-NULL, the value pointed to by disjointp will be set to 0 to indicate that the old and new credentials are not disjoint, or 1 to indicate that they are.

The vnode lock is held during this operation. No changes should be made to the old credential structure.

Update a credential label

typedef void mpo_cred_label_update_t( 
    kauth_cred_t cred, 
    struct label *newlabel );  

Fields

Discussion

Update the label on a user credential, using the supplied new label. This is called as a result of a process relabel operation. Access control was already confirmed by mpo_cred_check_label_update.

Create a new devfs device

typedef void mpo_devfs_label_associate_device_t( 
    dev_t dev, 
    struct devnode *de, 
    struct label *label, 
    const char *fullpath );  

Fields

Discussion

This entry point labels a new devfs device. The label will likely be based on the path to the device, or the major and minor numbers. The policy should store an appropriate label into 'label'.

Create a new devfs directory

typedef void mpo_devfs_label_associate_directory_t( 
    const char *dirname, 
    int dirnamelen, 
    struct devnode *de, 
    struct label *label, 
    const char *fullpath );  

Fields

Discussion

This entry point labels a new devfs directory. The label will likely be based on the path of the new directory. The policy should store an appropriate label into 'label'. The devfs root directory is labelled in this way.

Copy a devfs label

typedef void mpo_devfs_label_copy_t( 
    struct label *src, 
    struct label *dest );  

Fields

Discussion

Copy the label information from src to dest. The devfs file system often duplicates (splits) existing device nodes rather than creating new ones.

Destroy devfs label

typedef void mpo_devfs_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy a devfs entry label. Since the object is going out of scope, policy modules should free any internal storage associated with the label so that it may be destroyed.

Initialize devfs label

typedef void mpo_devfs_label_init_t( 
    struct label *label );  

Fields

Discussion

Initialize the label for a newly instantiated devfs entry. Sleeping is permitted.

Update a devfs label after relabelling its vnode

typedef void mpo_devfs_label_update_t( 
    struct mount *mp, 
    struct devnode *de, 
    struct label *delabel, 
    struct vnode *vp, 
    struct label *vnodelabel );  

Fields

Discussion

Update a devfs label when its vnode is manually relabelled, for example with setfmac(1). Typically, this will simply copy the vnode label into the devfs label.

Access control for changing the offset of a file descriptor

typedef int mpo_file_check_change_offset_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label );  

Parameters

Return Value

Return 0 if access if granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can change the offset of the file represented by fg.

Access control for creating a file descriptor

typedef int mpo_file_check_create_t( 
    kauth_cred_t cred );  

Parameters

Return Value

Return 0 if access if granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can allocate a new file descriptor.

Access control for duplicating a file descriptor

typedef int mpo_file_check_dup_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label, 
    int newfd );  

Parameters

Return Value

Return 0 if access if granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can duplicate the fileglob structure represented by fg and as file descriptor number newfd.

Access control check for fcntl

typedef int mpo_file_check_fcntl_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label, 
    int cmd, 
    user_long_t arg );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the file control operation indicated by cmd.

Access control for getting the offset of a file descriptor

typedef int mpo_file_check_get_offset_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label );  

Parameters

Return Value

Return 0 if access if granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can get the offset of the file represented by fg.

Access control check for mac_get_fd

typedef int mpo_file_check_get_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    char *elements, 
    int len );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential should be allowed to get an externalized version of the label on the object indicated by fd.

Access control for inheriting a file descriptor

typedef int mpo_file_check_inherit_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label );  

Parameters

Return Value

Return 0 if access if granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can inherit the fileglob structure represented by fg.

Access control check for file ioctl

typedef int mpo_file_check_ioctl_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label, 
    unsigned int cmd );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the ioctl operation indicated by cmd.

WARNING:

Access control check for file locking

typedef int mpo_file_check_lock_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label, 
    int op, 
    struct flock *fl );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the lock operation indicated by op and fl on the file represented by fg.

Downgrade the mmap protections

typedef void mpo_file_check_mmap_downgrade_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label, 
    int *prot );  

Fields

Discussion

Downgrade the mmap protections based on the subject and object labels.

Access control check for mapping a file

typedef int mpo_file_check_mmap_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label, 
    int prot, 
    int flags, 
    int *maxprot );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned. Suggested failure: EACCES for label mismatch or EPERM for lack of privilege.

Discussion

Determine whether the subject identified by the credential should be allowed to map the file represented by fg with the protections specified in prot. The maxprot field holds the maximum permissions on the new mapping, a combination of VM_PROT_READ, VM_PROT_WRITE, and VM_PROT_EXECUTE. To avoid overriding prior access control checks, a policy should only remove flags from maxprot.

Access control for receiving a file descriptor

typedef int mpo_file_check_receive_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label );  

Parameters

Return Value

Return 0 if access if granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can receive the fileglob structure represented by fg.

Access control check for mac_set_fd

typedef int mpo_file_check_set_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    char *elements, 
    int len );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the mac_set_fd operation. The mac_set_fd operation is used to associate a MAC label with a file.

Create file label

typedef void mpo_file_label_associate_t( 
    kauth_cred_t cred, 
    struct fileglob *fg, 
    struct label *label );  

Fields

Destroy file label

typedef void mpo_file_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy the label on a file descriptor. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.

Initialize file label

typedef void mpo_file_label_init_t( 
    struct label *label );  

Fields

Access control check for relabeling network interfaces

typedef int mpo_ifnet_check_label_update_t( 
    kauth_cred_t cred, 
    struct ifnet *ifp, 
    struct label *ifnetlabel, 
    struct label *newlabel );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can relabel the network interface represented by ifp to the supplied new label (newlabel).

Access control check for relabeling network interfaces

typedef int mpo_ifnet_check_transmit_t( 
    struct ifnet *ifp, 
    struct label *ifnetlabel, 
    struct mbuf *m, 
    struct label *mbuflabel, 
    int family, 
    int type );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the mbuf with label mbuflabel may be transmitted through the network interface represented by ifp that has the label ifnetlabel.

Create a network interface label

typedef void mpo_ifnet_label_associate_t( 
    struct ifnet *ifp, 
    struct label *ifnetlabel );  

Fields

Discussion

Set the label of a newly created network interface, most likely using the information in the supplied network interface struct.

Copy an ifnet label

typedef void mpo_ifnet_label_copy_t( 
    struct label *src, 
    struct label *dest );  

Fields

Discussion

Copy the label information from src to dest.

Destroy ifnet label

typedef void mpo_ifnet_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy the label on an ifnet label. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.

Externalize an ifnet label

typedef int mpo_ifnet_label_externalize_t( 
    struct label *label, 
    char *element_name, 
    struct sbuf *sb );  

Parameters

Return Value

0 on success, return non-zero if an error occurs while externalizing the label data.

Discussion

Produce an external representation of the label on an interface. An externalized label consists of a text representation of the label contents that can be used with user applications. Policy-agnostic user space tools will display this externalized version.

Initialize ifnet label

typedef void mpo_ifnet_label_init_t( 
    struct label *label );  

Fields

Internalize an interface label

typedef int mpo_ifnet_label_internalize_t( 
    struct label *label, 
    char *element_name, 
    char *element_data );  

Parameters

Return Value

0 on success, Otherwise, return non-zero if an error occurs while internalizing the label data.

Discussion

Produce an interface label from an external representation. An externalized label consists of a text representation of the label contents that can be used with user applications. Policy-agnostic user space tools will forward text version to the kernel for processing by individual policy modules.

The policy's internalize entry points will be called only if the policy has registered interest in the label namespace.

Recycle up a network interface label

typedef void mpo_ifnet_label_recycle_t( 
    struct label *label );  

Fields

Discussion

Recycle a network interface label. Darwin caches the struct ifnet of detached ifnets in a "free pool". Before ifnets are returned to the "free pool", policies can cleanup or overwrite any information present in the label.

Update a network interface label

typedef void mpo_ifnet_label_update_t( 
    kauth_cred_t cred, 
    struct ifnet *ifp, 
    struct label *ifnetlabel, 
    struct label *newlabel );  

Fields

Discussion

Update the label on a network interface, using the supplied new label.

Access control check for delivering a packet to a socket

typedef int mpo_inpcb_check_deliver_t( 
    struct inpcb *inp, 
    struct label *inplabel, 
    struct mbuf *m, 
    struct label *mbuflabel, 
    int family, 
    int type );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the mbuf with label mbuflabel may be received by the socket associated with inpcb that has the label inplabel.

Create an inpcb label

typedef void mpo_inpcb_label_associate_t( 
    struct socket *so, 
    struct label *solabel, 
    struct inpcb *inp, 
    struct label *inplabel );  

Fields

Discussion

Set the label of a newly created inpcb, most likely using the information in the socket and/or socket label.

Destroy inpcb label

typedef void mpo_inpcb_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy the label on an inpcb label. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.

Initialize inpcb label

typedef int mpo_inpcb_label_init_t( 
    struct label *label, 
    int flag );  

Fields

Recycle up an inpcb label

typedef void mpo_inpcb_label_recycle_t( 
    struct label *label );  

Fields

Discussion

Recycle an inpcb label. Darwin allocates the inpcb as part of the socket structure in some cases. For this case we must recycle rather than destroy the inpcb as it will be reused later.

Update an inpcb label from a socket label

typedef void mpo_inpcb_label_update_t( 
    struct socket *so, 
    struct label *solabel, 
    struct inpcb *inp, 
    struct label *inplabel );  

Fields

Discussion

Set the label of a newly created inpcb due to a change in the underlying socket label.

Device hardware access control

typedef int mpo_iokit_check_device_t( 
    char *devtype, 
    struct mac_module_data *mdata );  

Parameters

Return Value

Return EPERM to indicate that the device is untrusted and should not be allowed to operate. Return zero to indicate that the device is trusted and should be allowed to operate normally.

Discussion

This is the MAC Framework device access control, which is called by the I/O Kit when a new device is connected to the system to determine whether that device should be trusted. A list of properties associated with the device is passed as an XML-formatted string. The routine should examine these properties to determine the trustworthiness of the device. A return value of EPERM forces the device to be claimed by a special device driver that will prevent its operation.

WARNING:

Create an IP reassembly queue label

typedef void mpo_ipq_label_associate_t( 
    struct mbuf *fragment, 
    struct label *fragmentlabel, 
    struct ipq *ipq, 
    struct label *ipqlabel );  

Fields

Discussion

Set the label on a newly created IP reassembly queue from the mbuf header of the first received fragment.

Compare an mbuf header label to an ipq label

typedef int mpo_ipq_label_compare_t( 
    struct mbuf *fragment, 
    struct label *fragmentlabel, 
    struct ipq *ipq, 
    struct label *ipqlabel );  

Fields

Discussion

Compare the label of the mbuf header containing an IP datagram (fragment) fragment with the label of the passed IP fragment reassembly queue (ipq). Return (1) for a successful match, or (0) for no match. This call is made when the IP stack attempts to find an existing fragment reassembly queue for a newly received fragment; if this fails, a new fragment reassembly queue may be instantiated for the fragment. Policies may use this entry point to prevent the reassembly of otherwise matching IP fragments if policy does not permit them to be reassembled based on the label or other information.

Destroy IP reassembly queue label

typedef void mpo_ipq_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy the label on an IP fragment queue. In this entry point, a policy module should free any internal storage associated with label so that it may be destroyed.

Initialize IP reassembly queue label

typedef int mpo_ipq_label_init_t( 
    struct label *label, 
    int flag );  

Fields

Discussion

Initialize the label on a newly instantiated IP fragment reassembly queue. The flag field may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a sleeping malloc(9) during this initialization call. IP fragment reassembly queue allocation frequently occurs in performance sensitive environments, and the implementation should be careful to avoid sleeping or long-lived operations. This entry point is permitted to fail resulting in the failure to allocate the IP fragment reassembly queue.

Update the label on an IP fragment reassembly queue

typedef void mpo_ipq_label_update_t( 
    struct mbuf *fragment, 
    struct label *fragmentlabel, 
    struct ipq *ipq, 
    struct label *ipqlabel );  

Fields

Discussion

Update the label on an IP fragment reassembly queue (ipq) based on the acceptance of the passed IP fragment mbuf header (fragment).

Access control check for relabelling Login Context

typedef int mpo_lctx_check_label_update_t( 
    struct lctx *l, 
    struct label *newlabel );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can relabel itself to the supplied new label (newlabel). This access control check is called when the mac_set_lctx/lcid system call is invoked. A user space application will supply a new value, the value will be internalized and provided in newlabel.

Destroy Login Context label

typedef void mpo_lctx_label_destroy_t( 
    struct label *label );  

Fields

Externalize a Login Context label

typedef int mpo_lctx_label_externalize_t( 
    struct label *label, 
    char *element_name, 
    struct sbuf *sb );  

Parameters

Return Value

0 on success, return non-zero if an error occurs while externalizing the label data.

Discussion

Produce an external representation of the label on a Login Context. An externalized label consists of a text representation of the label contents that can be used with user applications. Policy-agnostic user space tools will display this externalized version.

Initialize Login Context label

typedef void mpo_lctx_label_init_t( 
    struct label *label );  

Fields

Internalize a Login Context label

typedef int mpo_lctx_label_internalize_t( 
    struct label *label, 
    char *element_name, 
    char *element_data );  

Parameters

Return Value

0 on success, Otherwise, return non-zero if an error occurs while internalizing the label data.

Discussion

Produce a Login Context label from an external representation. An externalized label consists of a text representation of the label contents that can be used with user applications. Policy-agnostic user space tools will forward text version to the kernel for processing by individual policy modules.

The policy's internalize entry points will be called only if the policy has registered interest in the label namespace.

Update a Login Context label

typedef void mpo_lctx_label_update_t( 
    struct lctx *l, 
    struct label *newlabel );  

Fields

Discussion

Update the label on a login context, using the supplied new label. This is called as a result of a login context relabel operation. Access control was already confirmed by mpo_lctx_check_label_update.

A process has created a login context

typedef void mpo_lctx_notify_create_t( 
    struct proc *p, 
    struct lctx *l );  

Fields

Discussion

When a process creates a login context (via setlcid()) this entrypoint is called to notify the policy that the process 'p' has created login context 'l'.

A process has joined a login context

typedef void mpo_lctx_notify_join_t( 
    struct proc *p, 
    struct lctx *l );  

Fields

Discussion

When a process joins a login context, either via setlcid() or via fork() this entrypoint is called to notify the policy that process 'p' is now a member of login context 'l'.

A process has left a login context

typedef void mpo_lctx_notify_leave_t( 
    struct proc *p, 
    struct lctx *l );  

Fields

Discussion

When a process leaves a login context either via setlcid() or as a result of the process exiting this entrypoint is called to notify the policy that the process 'p' is no longer a member of login context 'l'.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_bpfdesc_t( 
    struct bpf_d *bpf_d, 
    struct label *b_label, 
    struct mbuf *m, 
    struct label *m_label );  

Fields

Discussion

Set the label on the mbuf header of a newly created datagram generated using the passed BPF descriptor. This call is made when a write is performed to the BPF device associated with the passed BPF descriptor.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_ifnet_t( 
    struct ifnet *ifp, 
    struct label *i_label, 
    struct mbuf *m, 
    struct label *m_label );  

Fields

Discussion

Label an mbuf based on the interface from which it was received.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_inpcb_t( 
    struct inpcb *inp, 
    struct label *i_label, 
    struct mbuf *m, 
    struct label *m_label );  

Fields

Discussion

Label an mbuf based on the inpcb from which it was derived.

Set the label on a newly reassembled IP datagram

typedef void mpo_mbuf_label_associate_ipq_t( 
    struct ipq *ipq, 
    struct label *ipqlabel, 
    struct mbuf *mbuf, 
    struct label *mbuflabel );  

Fields

Discussion

Set the label on a newly reassembled IP datagram (mbuf) from the IP fragment reassembly queue (ipq) from which it was generated.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_linklayer_t( 
    struct ifnet *ifp, 
    struct label *i_label, 
    struct mbuf *m, 
    struct label *m_label );  

Fields

Discussion

Set the label on the mbuf header of a newly created datagram generated for the purposes of a link layer response for the passed interface. This call may be made in a number of situations, including for ARP or ND6 responses in the IPv4 and IPv6 stacks.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_multicast_encap_t( 
    struct mbuf *oldmbuf, 
    struct label *oldmbuflabel, 
    struct ifnet *ifp, 
    struct label *ifplabel, 
    struct mbuf *newmbuf, 
    struct label *newmbuflabel );  

Fields

Discussion

Set the label on the mbuf header of a newly created datagram generated from the existing passed datagram when it is processed by the passed multicast encapsulation interface. This call is made when an mbuf is to be delivered using the virtual interface.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_netlayer_t( 
    struct mbuf *oldmbuf, 
    struct label *oldmbuflabel, 
    struct mbuf *newmbuf, 
    struct label *newmbuflabel );  

Fields

Discussion

Set the label on the mbuf header of a newly created datagram generated by the IP stack in response to an existing received datagram (oldmbuf). This call may be made in a number of situations, including when responding to ICMP request datagrams.

Assign a label to a new mbuf

typedef void mpo_mbuf_label_associate_socket_t( 
    socket_t so, 
    struct label *so_label, 
    struct mbuf *m, 
    struct label *m_label );  

Fields

Discussion

An mbuf structure is used to store network traffic in transit. When an application sends data to a socket or a pipe, it is wrapped in an mbuf first. This function sets the label on a newly created mbuf header based on the socket sending the data. The contents of the label should be suitable for performing an access check on the receiving side of the communication.

Only labeled MBUFs will be presented to the policy via this entrypoint.

Copy a mbuf label

typedef void mpo_mbuf_label_copy_t( 
    struct label *src, 
    struct label *dest );  

Fields

Discussion

Copy the mbuf label information in src into dest.

Only called when both source and destination mbufs have labels.

Destroy mbuf label

typedef void mpo_mbuf_label_destroy_t( 
    struct label *label );  

Fields

Discussion

Destroy a mbuf label. Since the object is going out of scope, policy modules should free any internal storage associated with the label so that it may be destroyed.

Initialize mbuf label

typedef int mpo_mbuf_label_init_t( 
    struct label *label, 
    int flag );  

Parameters

Return Value

On success, 0, otherwise, an appropriate errno return value.

Discussion

Initialize the label for a newly instantiated mbuf.

WARNING:

Access control check for fsctl

typedef int mpo_mount_check_fsctl_t( 
    kauth_cred_t cred, 
    struct mount *mp, 
    struct label *label, 
    unsigned int cmd );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the volume operation indicated by com.

WARNING:

Access control check for the retrieval of file system attributes

typedef int mpo_mount_check_getattr_t( 
    kauth_cred_t cred, 
    struct mount *mp, 
    struct label *mp_label, 
    struct vfs_attr *vfa );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

This entry point determines whether given subject can get information about the given file system. This check happens during statfs() syscalls, but is also used by other parts within the kernel such as the audit system.

Access control check for mount point relabeling

typedef int mpo_mount_check_label_update_t( 
    kauth_cred_t cred, 
    struct mount *mp, 
    struct label *mntlabel );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned. Suggested failure: EACCES for label mismatch or EPERM for lack of privilege.

Discussion

Determine whether the subject identified by the credential can relabel the mount point. This call is made when a file system mount is updated.

Access control check for mounting a file system

typedef int mpo_mount_check_mount_t( 
    kauth_cred_t cred, 
    struct vnode *vp, 
    struct label *vlabel, 
    struct componentname *cnp, 
    const char *vfc_name );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the mount operation on the target vnode.

Access control check remounting a filesystem

typedef int mpo_mount_check_remount_t( 
    kauth_cred_t cred, 
    struct mount *mp, 
    struct label *mlabel );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

Determine whether the subject identified by the credential can perform the remount operation on the target vnode.

Access control check for the settting of file system attributes

typedef int mpo_mount_check_setattr_t( 
    kauth_cred_t cred, 
    struct mount *mp, 
    struct label *mp_label, 
    struct vfs_attr *vfa );  

Parameters

Return Value

Return 0 if access is granted, otherwise an appropriate value for errno should be returned.

Discussion

This entry point determines whether given subject can set information about the given file system, for example the volume name.

Access control check for file system statistics

typedef int mpo_mount_check_stat_t( 
    kauth_cred_t cred, 
    struct mount *mp, 
    struct label *mntlabel );