mac_policy.h

Kernel Interfaces for MAC policy modules

Overview

See the Overview section above for header-level documentation.

Overview

This header defines the list of operations that are defined by the TrustedBSD MAC Framwork on Darwin. MAC Policy modules register with the framework to declare interest in a specific set of operations. If interest in an entry point is not declared, then the policy will be ignored when the Framework evaluates that entry point.

Included Headers

  • <security/_label.h>

Topics

Callbacks

See the Overview section above for header-level documentation.

These are the entry points corresponding to the life cycle events for kernel objects, such as initialization, creation, and destruction.

Most policies (that use labels) will initialize labels by allocating space for policy-specific data. In most cases, it is permitted to sleep during label initialization operations; it will be noted when it is not permitted.

Initialization usually will not require doing more than allocating a generic label for the given object. What follows initialization is creation, where a label is made specific to the object it is associated with. Destruction occurs when the label is no longer needed, such as when the corresponding object is destroyed. All necessary cleanup should be performed in label destroy operations.

Where possible, the label entry points have identical parameters. If the policy module does not require structure-specific label information, the same function may be registered in the policy operation vector. Many policies will implement two such generic allocation calls: one to handle sleepable requests, and one to handle potentially non-sleepable requests.

mpo_lctx_check_label_update_t

Access control check for relabelling Login Context

mpo_lctx_label_destroy_t

Destroy Login Context label

mpo_lctx_label_externalize_t

Externalize a Login Context label

mpo_lctx_label_init_t

Initialize Login Context label

mpo_lctx_label_internalize_t

Internalize a Login Context label

mpo_lctx_label_update_t

Update a Login Context label

mpo_lctx_notify_create_t

A process has created a login context

mpo_lctx_notify_join_t

A process has joined a login context

mpo_lctx_notify_leave_t

A process has left a login context

mpo_port_check_copy_send_t

Access control check for copying a send right to another task

mpo_port_check_hold_receive_t

Access control check for obtaining a receive right

mpo_port_check_hold_send_once_t

Access control check for obtaining a send once right

mpo_port_check_hold_send_t

Access control check for obtaining a send right

mpo_port_check_label_update_t

Access control check for relabelling ports

mpo_port_check_make_send_once_t

Access control check for producing a send once right from a receive right

mpo_port_check_make_send_t

Access control check for producing a send right from a receive right

mpo_port_check_method_t

Compute access control check for a Mach message-based service

mpo_port_check_move_receive_t

Access control check for transferring a receive right

mpo_port_check_move_send_once_t

Access control check for transferring a send once right

mpo_port_check_move_send_t

Access control check for transferring a send right

mpo_port_check_receive_t

Access control check for receiving Mach messsages

mpo_port_check_send_t

Access control check for sending Mach messsages

mpo_port_check_service_t

Generic access control check

mpo_port_label_associate_kernel_t

Assign a label to a new Mach port created by the kernel

mpo_port_label_associate_t

Assign a label to a new Mach port

mpo_port_label_compute_t

Request label for new (userspace) object

mpo_port_label_copy_t

Copy a Mach port label

mpo_port_label_destroy_t

Destroy Mach port label

mpo_port_label_init_t

Initialize Mach port label

mpo_port_label_update_cred_t

Update a Mach task port label

mpo_port_label_update_kobject_t

Assign a label to a Mach port connected to a kernel object

mpo_system_check_sysctl_t

Access control check for sysctl

mpo_task_label_associate_kernel_t

Assign a label to a new kernelspace Mach task

mpo_task_label_associate_t

Assign a label to a new (userspace) Mach task

mpo_task_label_copy_t

Copy a Mach task label

mpo_task_label_destroy_t

Destroy Mach task label

mpo_task_label_externalize_t

Externalize a task label

mpo_task_label_init_t

Initialize Mach task label

mpo_task_label_internalize_t

Internalize a task label

mpo_task_label_update_t

Update a Mach task label

Data Types

See the Overview section above for header-level documentation.

Constants

See the Overview section above for header-level documentation.