xnu/security/mac_policy.h

108 struct vnode;
292   @param scriptvnodelabel Script vnode label
301   call occurs when a process executes the passed vnode.  If a policy
308   The supplied vnode and vnodelabel correspond with the file actually
310   example, a script), the label of the original exec-time vnode has
316   The vnode lock is held during this operation.  No changes should be
327 	struct vnode *vp,
520   @param scriptvnodelabel Script vnode label
528   executes the passed vnode and one of the loaded policy modules has
533   The supplied vnode and vnodelabel correspond with the file actually
535   example, a script), the label of the original exec-time vnode has
545   The vnode lock is held during this operation.  No changes should be
551 	struct vnode *vp,
643   @brief Update a devfs label after relabelling its vnode
648   @param vnodelabel New label of vnode
650   Update a devfs label when its vnode is manually relabelled,
652   the vnode label into the devfs label.
658 	struct vnode *vp,
1735   @param vlabel Label associated with the vnode
1740   the mount operation on the target vnode.
1747 	struct vnode *vp,
1759   the remount operation on the target vnode.
1817   the unmount operation on the target vnode.
3922 	struct vnode *vp,
3957 	struct vnode *vp,
4055 	struct vnode *vp,
4072 	struct vnode *vp,
4796   @brief Check vnode access
4798   @param vp Object vnode
4804   on the passed vnode using the passed access flags. This should
4814 	struct vnode *vp,
4821   @param dvp Object; vnode to chdir(2) into
4825   the process working directory to the passed vnode.
4833 	struct vnode *dvp,
4839   @param dvp Directory vnode
4851 	struct vnode *dvp,
4856   @brief Access control check for creating vnode
4858   @param dvp Directory vnode
4861   @param vap vnode attributes for vap
4864   a vnode with the passed parent directory, passed name information,
4875 	struct vnode *dvp,
4883   @param vp Object vnode
4888   the extended attribute from the passed vnode.
4896 	struct vnode *vp,
4903   @param v1 vnode 1 to swap
4905   @param v2 vnode 2 to swap
4917 	struct vnode *v1,
4919 	struct vnode *v2,
4923   @brief Access control check for executing the vnode
4925   @param vp Object vnode to execute
4931   the passed vnode. Determination of execute privilege is made separately
4945 	struct vnode *vp,
4955   @param label Label associated with the vnode
4958   of the given vnode with fsgetpath.
4965 	struct vnode *vp,
4971 typedef int mpo_vnode_check_signature_t(struct vnode *vp,  struct label *label,
4978   @param vp Object vnode
4983   various attributes of the specified vnode, or the filesystem or volume on
4984   which that vnode resides. See <sys/attr.h> for definitions of the
4995 	struct vnode *vp,
5002   @param vp Object vnode
5008   the extended attribute from the passed vnode.  The uio parameter
5018 	struct vnode *vp,
5026   @param vp Object vnode
5043 	struct vnode *vp,
5048   @brief Access control check for vnode kqfilter
5051   @param vp Object vnode
5055   receive the knote on the passed vnode.
5064 	struct vnode *vp,
5070   @param vp Object vnode
5076   the passed vnode to the passed label update.  If all policies permit
5085 	struct vnode *vp,
5092   @param dvp Directory vnode
5094   @param vp Link destination vnode
5099   allowed to create a link to the vnode vp with the name specified by cnp.
5106 	struct vnode *dvp,
5108 	struct vnode *vp,
5115   @param vp Object vnode
5119   a list of named extended attributes from a vnode.
5126 	struct vnode *vp,
5132   @param dvp Object vnode
5137   a lookup in the passed directory vnode for the passed name (cnp).
5145 	struct vnode *dvp,
5152   @param vp Object vnode
5157   an open operation on the passed vnode with the passed access mode.
5165 	struct vnode *vp,
5173   @param vp Object vnode
5177   a read operation on the passed vnode.  The active_cred hold the credentials
5188 	struct vnode *vp,		/* OBJECT */
5194   @param dvp Object directory vnode
5198   perform a readdir operation on the passed directory vnode.
5206 	struct vnode *dvp,		/* OBJECT */
5212   @param vp Object vnode
5216   a readlink operation on the passed symlink vnode.  This call can be made
5227 	struct vnode *vp,
5233   @param dvp Directory vnode
5235   @param vp vnode to be renamed
5241   allowed to rename the vnode vp to something else.
5243   Due to VFS locking constraints (to make sure proper vnode locks are
5244   held during this entry point), the vnode relabel checks had to be
5252 	struct vnode *dvp,
5254 	struct vnode *vp,
5261   @param dvp Directory vnode
5263   @param vp Overwritten vnode
5270   allowed to rename to the vnode vp, into the directory dvp, or to the
5274   Due to VFS locking constraints (to make sure proper vnode locks are
5275   held during this entry point), the vnode relabel checks had to be
5283 	struct vnode *dvp,
5285 	struct vnode *vp,			/* NULLOK */
5293   @param vp Object vnode
5297   access to the passed vnode.
5305 	struct vnode *vp,
5311   @param vp Object vnode
5316   vnode using the searchfs system call.
5323 	struct vnode *vp,
5330   @param vp Object vnode
5335   the vnode.
5342 	struct vnode *vp,
5349   @param vp Object vnode
5354   various attributes of the specified vnode, or the filesystem or volume on
5355   which that vnode resides. See <sys/attr.h> for definitions of the
5365 	struct vnode *vp,
5372   @param vp Object vnode
5379   vnode. Policies implementing security labels backed into extended
5392 	struct vnode *vp,
5400   @param vp Object vnode
5405   the passed flags on the passed vnode.
5413 	struct vnode *vp,
5420   @param vp Object vnode
5425   the passed mode on the passed vnode.
5433 	struct vnode *vp,
5440   @param vp Object vnode
5447   vnode. The IDs may be set to (-1) to request no update.
5455 	struct vnode *vp,
5463   @param vp Object vnode
5469   the passed access timestamps on the passed vnode.
5477 	struct vnode *vp,
5486   @param vp Object vnode
5490   the passed vnode. See stat(2) for more information.  The active_cred
5502 	struct vnode *vp,
5509   @param vp Object vnode
5513   perform a truncate operation on the passed vnode.  The active_cred hold
5525 	struct vnode *vp,
5531   @param dvp Directory vnode
5534   @param vap vnode attributes for vap
5546 	struct vnode *dvp,
5554   @param vp Object vnode
5558   connect operation on the passed UNIX domain socket vnode.
5566 	struct vnode *vp,
5570   @brief Access control check for deleting vnode
5572   @param dvp Parent directory vnode
5574   @param vp Object vnode to delete
5580   a vnode from the passed parent directory and passed name information.
5592 	struct vnode *dvp,
5594 	struct vnode *vp,
5602   @param vp Object vnode
5606   perform a write operation on the passed vnode.  The active_cred hold
5618 	struct vnode *vp,
5622   @brief Associate a vnode with a devfs entry
5627   @param vp vnode associated with de
5630   Fill in the label (vlabel) for a newly created devfs vnode.  The
5639 	struct vnode *vp,
5643   @brief Associate a label with a vnode
5649   Attempt to retrieve label information for the vnode, vp, from the
5657   a valid label of some sort.  Returning an error will cause vnode
5668 	struct vnode *vp,
5672   @brief Associate a file label with a vnode
5681   Associate label information for the vnode, vp, with the label of
5691 	struct vnode *vp,
5695   @brief Associate a pipe label with a vnode
5702   Associate label information for the vnode, vp, with the label of
5710 	struct vnode *vp,
5714   @brief Associate a POSIX semaphore label with a vnode
5721   Associate label information for the vnode, vp, with the label of
5729 	struct vnode *vp,
5733   @brief Associate a POSIX shared memory label with a vnode
5740   Associate label information for the vnode, vp, with the label of
5748 	struct vnode *vp,
5752   @brief Associate a label with a vnode
5758   On non-multilabel file systems, set the label for a vnode.  The
5764 	struct vnode *vp,
5768   @brief Associate a socket label with a vnode
5775   Associate label information for the vnode, vp, with the label of
5783 	struct vnode *vp,
5787   @brief Copy a vnode label
5788   @param src Source vnode label
5789   @param dest Destination vnode label
5791   Copy the vnode label information from src to dest.  On Darwin, this
5793   will later be used if vnode label externalization cannot be an
5801   @brief Destroy vnode label
5804   Destroy a vnode label.  Since the object is going out of scope,
5812   @brief Externalize a vnode label for auditing
5818   Produce an external representation of the label on a vnode suitable for
5834   @brief Externalize a vnode label
5840   Produce an external representation of the label on a vnode.  An
5855   @brief Initialize vnode label
5858   Initialize label storage for use with a newly instantiated vnode, or
5860   vnode label.  While it is necessary to allocate space for a
5861   kernel-resident vnode label, it is not yet necessary to link this vnode
5869   @brief Internalize a vnode label
5875   Produce a vnode label from an external representation.  An
5893   @brief Clean up a vnode label
5896   Clean up a vnode label.  Darwin (Tiger, 8.x) allocates vnodes on demand, but
5906   @param vp The vnode for which the label is being stored
5911   supplied vnode.  The policy has already authorized the operation;
5923 	struct vnode *vp,
5928   @brief Update vnode label from extended attributes
5937   functions, the MAC vnode label might also require an update.
5941   vnode.  Normally labels should only be modified via MAC Framework label
5950   If the vnode label needs to be updated the policy should return
5951   a non-zero value.  The vnode label will be marked for re-association
5957 	struct vnode *vp,
5962   @brief Update a vnode label
5964   @param vp The vnode to relabel
5965   @param vnodelabel Existing vnode label
5970   and was authorized to relabel the vnode; this entry point allows
5976 	struct vnode *vp,
5981   @brief Create a new vnode, backed by extended attributes
5985   @param dvp Parent directory vnode
5986   @param dlabel Parent directory vnode label
5987   @param vp Newly created vnode
5988   @param vlabel Label to associate with the new vnode
5991   Write out the label for the newly created vnode, most likely storing
5993   derive the new vnode label using information from a combination
6004 	struct vnode *dvp,
6006 	struct vnode *vp,
6012   @brief Inform MAC policies that a vnode has been opened
6014   @param vp vnode opened
6018   Inform Mac policies that a vnode have been successfully opened
6023 	struct vnode *vp,
6029   @brief Inform MAC policies that a vnode has been renamed
6037   Inform MAC policies that a vnode has been renamed.
6041 	struct vnode *vp,
6043 	struct vnode *dvp,
6467 int	mac_vnop_setxattr(struct vnode *, const char *, char *, size_t);
6468 int	mac_vnop_getxattr(struct vnode *, const char *, char *, size_t,
6470 int	mac_vnop_removexattr(struct vnode *, const char *);