#definempc_tstruct mac_policy_conf */**@brief Mac policy configurationThis structure specifies the configuration information for aMAC policy module. A policy module developer must supplya short unique policy name, a more descriptive full name, a list of labelnamespaces and count, a pointer to the registered enty point operations,any load time flags, and optionally, a pointer to a label slot identifier.The Framework will update the runtime flags (mpc_runtime_flags) toindicate that the module has been registered.If the label slot identifier (mpc_field_off) is NULL, the Frameworkwill not provide label storage for the policy. Otherwise, theFramework will store the label location (slot) in this field.The mpc_list field is used by the Framework and should not bemodified by policies.*//* XXX - reorder these for better aligment on 64bit platforms */struct mac_policy_conf {constchar*mpc_name; /** policy name */constchar*mpc_fullname; /** full name */constchar**mpc_labelnames; /** managed label namespaces */unsignedint mpc_labelname_count; /** number of managed label namespaces */struct mac_policy_ops *mpc_ops; /** operation vector */int mpc_loadtime_flags; /** load time flags */int*mpc_field_off; /** label slot */int mpc_runtime_flags; /** run time flags */mpc_t mpc_list; /** List reference */void*mpc_data; /** module data */};
/** MAC_CHECK performs the designated check by walking the policy* module list and checking with each as to how it feels about the* request. Note that it returns its value via 'error' in the scope* of the caller.*/#defineMAC_CHECK(check, args...) do { \error =0; \MAC_POLICY_ITERATE({ \if (mpc->mpc_ops->mpo_ ## check !=NULL) { \DTRACE_MACF3(mac__call__ ## check,void*, mpc,int, error,int, MAC_ITERATE_CHECK); \int __step_err =mpc->mpc_ops->mpo_ ## check (args); \DTRACE_MACF2(mac__rslt__ ## check,void*, mpc,int, __step_err); \error =mac_error_select(__step_err, error); \} \}); \} while (0)
将遍历所有注册的 mac 策略，调用它们的函数并将输出存储在 error 变量中，该变量仅可通过成功代码的 mac_error_select 进行覆盖，因此如果任何检查失败，整个检查将失败，操作将不被允许。
/** MAC_GRANT performs the designated check by walking the policy* module list and checking with each as to how it feels about the* request. Unlike MAC_CHECK, it grants if any policies return '0',* and otherwise returns EPERM. Note that it returns its value via* 'error' in the scope of the caller.*/#defineMAC_GRANT(check, args...) do { \error = EPERM; \MAC_POLICY_ITERATE({ \if (mpc->mpc_ops->mpo_ ## check !=NULL) { \DTRACE_MACF3(mac__call__ ## check,void*, mpc,int, error,int, MAC_ITERATE_GRANT); \int __step_res =mpc->mpc_ops->mpo_ ## check (args); \if (__step_res ==0) { \error =0; \} \DTRACE_MACF2(mac__rslt__ ## check,void*, mpc,int, __step_res); \} \}); \} while (0)
/** Extended non-POSIX.1e interfaces that offer additional services* available from the userland and kernel MAC frameworks.*/#ifdef__APPLE_API_PRIVATE__BEGIN_DECLSint__mac_execve(char*fname,char**argv,char**envv,mac_t _label);int__mac_get_fd(int _fd,mac_t _label);int__mac_get_file(constchar*_path,mac_t _label);int__mac_get_link(constchar*_path,mac_t _label);int__mac_get_pid(pid_t _pid,mac_t _label);int__mac_get_proc(mac_t _label);int__mac_set_fd(int _fildes,constmac_t _label);int__mac_set_file(constchar*_path,mac_t _label);int__mac_set_link(constchar*_path,mac_t _label);int__mac_mount(constchar*type,constchar*path,int flags,void*data,struct mac *label);int__mac_get_mount(constchar*path,struct mac *label);int__mac_set_proc(constmac_t _label);int__mac_syscall(constchar*_policyname,int _call,void*_arg);__END_DECLS#endif /*__APPLE_API_PRIVATE*/
