Mac Developer Library

Developer

security.defs Reference

Options
Deployment Target:

On This Page

security.defs Reference

Included Headers

  • <mach/std_types.defs>

  • <mach/mach_types.defs>

Functions

  • mac_check_service mac_check_service Available in OS X v10.5 through OS X v10.9

    Generic access control check

    Declaration

    Objective-C

    kern_return_t mac_check_service ( ipc_space_t task, labelstr_t subject, labelstr_t object, labelstr_t service, labelstr_t perm );

    Parameters

    task

    Any task port

    subj

    subject label in textual form

    obj

    object label in textual form

    serv

    Service or object class name

    perm

    Permission, or method, within the specified service

    This function provides a general way for a user process to query an arbitrary access control decision from the system's security policies. Currently, there are no standards for the format of the service and permission names.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mac_label_new mac_label_new Available in OS X v10.5 through OS X v10.9

    Create a new label handle

    Declaration

    Objective-C

    kern_return_t mac_label_new ( ipc_space_t task, mach_port_name_t *name, labelstr_t label );

    Parameters

    task

    Task to receive new ports (usually caller's)

    name

    Returned label handle port

    label

    String representation of new label

    Creates a new label handle, with the stored label defined by the given text. Any task may create a label handle with any valid label, not necessarily one that it has permission to access. A port right for the new label handle is inserted into the specified task. Posession of label handles should not imply any security properties.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mac_port_check_access mac_port_check_access Available in OS X v10.5 through OS X v10.9

    Generic access control check

    Declaration

    Objective-C

    kern_return_t mac_port_check_access ( ipc_space_t task, mach_port_name_t subject, mach_port_name_t object, labelstr_t service, labelstr_t perm );

    Parameters

    task

    Task containing specified ports (usually caller's)

    subj

    port containing subject label

    obj

    port containing object label

    serv

    Service or object class name

    perm

    Permission, or method, within the specified service

    This function provides a general way for a user process to query an arbitrary access control decision from the system's security policies. Currently, there are no standards for the format of the service and permission names. If any ports are label handles, the stored label is used. Otherwise, the access control labels are used.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mac_port_check_service_obj mac_port_check_service_obj Available in OS X v10.5 through OS X v10.9

    Generic access control check

    Declaration

    Objective-C

    kern_return_t mac_port_check_service_obj ( ipc_space_t task, labelstr_t subject, mach_port_name_t object, labelstr_t service, labelstr_t perm );

    Parameters

    task

    Task containing specified ports (usually caller's)

    subj

    subject label in textual form

    obj

    port containing object label

    serv

    Service or object class name

    perm

    Permission, or method, within the specified service

    This function provides a general way for a user process to query an arbitrary access control decision from the system's security policies. Currently, there are no standards for the format of the service and permission names. If the port is a label handle, the stored label is used. Otherwise, its access control label is used.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mac_request_label mac_request_label Available in OS X v10.5 through OS X v10.9

    Request a computed label

    Declaration

    Objective-C

    kern_return_t mac_request_label ( ipc_space_t task, mach_port_name_t subject, mach_port_name_t object, labelstr_t service, mach_port_name_t *newlabel );

    Parameters

    task

    subj,obj,newlabel relative to this task (usually caller's)

    subj

    port containing subject label

    obj

    port containing object label

    serv

    Service or object class name

    newlabel

    Returned label handle port

    Ask the loaded policies to compute a label based on the two input labels and the service name. There is currently no standard for the service name, or even what the input labels represent (Subject and parent object are only a suggestion). If any ports are label handles, the stored label is used. Otherwise, the access control labels are used. A new label handle is created to contain the computed label, and is stored into the specified task.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mach_get_label mach_get_label Available in OS X v10.5 through OS X v10.9

    Retrieve a port label as a label handle

    Declaration

    Objective-C

    kern_return_t mach_get_label ( ipc_space_t task, mach_port_name_t port, mach_port_name_t *label );

    Parameters

    task

    Issuer's task port

    port

    Port to query label from

    label

    Returned label handle

    This call retrieves a new label handle for the specified port. If the port represents a label handle, KERN_INVALID_ARGUMENT is returned.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mach_get_label_text mach_get_label_text Available in OS X v10.5 through OS X v10.9

    Retrieve a port label in textual form

    Declaration

    Objective-C

    kern_return_t mach_get_label_text ( ipc_space_t task, mach_port_name_t name, labelstr_t policies, labelstr_t label );

    Parameters

    task

    Issuer's task port

    name

    Port to query label from

    policies

    Comma-delimited list of policies to query

    label

    Returned label text

    This call retrieves an externalized port label for the specified port, with respect to the specified policies. If the port represents a label handle, the returned label text refers to the stored label and not the access control label.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mach_get_task_label mach_get_task_label Available in OS X v10.5 through OS X v10.9

    Retrieve a task label as a label handle

    Declaration

    Objective-C

    kern_return_t mach_get_task_label ( ipc_space_t task, mach_port_name_t *label );

    Parameters

    task

    Target's task port

    label

    Returned label handle

    This call retrieves the label handle of the specified task.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mach_get_task_label_text mach_get_task_label_text Available in OS X v10.5 through OS X v10.9

    Retrieve a task label in textual form

    Declaration

    Objective-C

    kern_return_t mach_get_task_label_text ( ipc_space_t task, labelstr_t policies, labelstr_t label );

    Parameters

    task

    Target's task port

    policies

    Comma-delimited list of policies to query

    label

    Returned label text

    This call retrieves an externalized task label for the specified task, with respect to the specified policies.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.

  • mach_set_port_label mach_set_port_label Available in OS X v10.5 through OS X v10.9

    Relabel a port

    Declaration

    Objective-C

    kern_return_t mach_set_port_label ( ipc_space_t task, mach_port_name_t name, labelstr_t label );

    Parameters

    task

    Task containing specified ports

    name

    Port to relabel

    label

    String representation of new label

    This call attempts to relabel the specified port to the label specified. For label handles, it changes the access control label and not the stored label.

    Return Value

    Standard MiG return values (0 for success)

    Import Statement

    Availability

    Available in OS X v10.5 through OS X v10.9.