#ifndef _SYS_GUARDED_H_
#define _SYS_GUARDED_H_
#include <sys/types.h>
#include <sys/cdefs.h>
#include <sys/_types/_iovec_t.h>
#ifdef PRIVATE
__BEGIN_DECLS
#if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE)
#ifndef _GUARDID_T
#define _GUARDID_T
typedef __uint64_t guardid_t;
#endif
#if !defined(KERNEL)
extern int guarded_open_np(const char *path,
const guardid_t *guard, u_int guardflags, int flags, ...);
extern int guarded_open_dprotected_np(const char *path,
const guardid_t *guard, u_int guardflags, int flags,
int dpclass, int dpflags, ...);
extern int guarded_kqueue_np(const guardid_t *guard, u_int guardflags);
extern int guarded_close_np(int fd, const guardid_t *guard);
extern int change_fdguard_np(int fd, const guardid_t *guard, u_int guardflags,
const guardid_t *nguard, u_int nguardflags, int *fdflagsp);
extern ssize_t guarded_write_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte);
extern ssize_t guarded_pwrite_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte, off_t offset);
extern ssize_t guarded_writev_np(int fd, const guardid_t *guard, const struct iovec *iovp, int iovcnt);
#endif
#ifndef GUARD_TYPE_FD
#define GUARD_TYPE_FD 0x2
#endif
#define GUARD_CLOSE (1u << 0)
#define GUARD_DUP (1u << 1)
#define GUARD_SOCKET_IPC (1u << 2)
#define GUARD_FILEPORT (1u << 3)
#define GUARD_WRITE (1u << 4)
enum guard_fd_exception_codes {
kGUARD_EXC_CLOSE = 1u << 0,
kGUARD_EXC_DUP = 1u << 1,
kGUARD_EXC_NOCLOEXEC = 1u << 2,
kGUARD_EXC_SOCKET_IPC = 1u << 3,
kGUARD_EXC_FILEPORT = 1u << 4,
kGUARD_EXC_MISMATCH = 1u << 5,
kGUARD_EXC_WRITE = 1u << 6
};
#define VNG_RENAME_TO (1u << 0)
#define VNG_RENAME_FROM (1u << 1)
#define VNG_UNLINK (1u << 2)
#define VNG_WRITE_OTHER (1u << 3)
#define VNG_TRUNC_OTHER (1u << 4)
#define VNG_LINK (1u << 5)
#define VNG_EXCHDATA (1u << 6)
#define VNG_ALL \
(VNG_RENAME_TO | VNG_RENAME_FROM | VNG_UNLINK | VNG_LINK | \
VNG_WRITE_OTHER | VNG_TRUNC_OTHER | VNG_EXCHDATA)
struct vnguard_set {
int vns_fd;
unsigned vns_attrs;
guardid_t vns_guard;
};
struct vnguard_getattr {
int vga_fd;
unsigned vga_attrs;
guardid_t vga_guard;
};
#define VNG_SYSC_PING 0
#define VNG_SYSC_SET_GUARD 1
#define VNG_SYSC_GET_ATTR 2
#define VNG_POLICY_NAME "vnguard"
enum guard_vn_exception_codes {
kGUARD_EXC_RENAME_TO = VNG_RENAME_TO,
kGUARD_EXC_RENAME_FROM = VNG_RENAME_FROM,
kGUARD_EXC_UNLINK = VNG_UNLINK,
kGUARD_EXC_WRITE_OTHER = VNG_WRITE_OTHER,
kGUARD_EXC_TRUNC_OTHER = VNG_TRUNC_OTHER,
kGUARD_EXC_LINK = VNG_LINK,
kGUARD_EXC_EXCHDATA = VNG_EXCHDATA,
};
#define kVNG_POLICY_LOGMSG (1u << 0)
#define kVNG_POLICY_EPERM (1u << 1)
#define kVNG_POLICY_EXC (1u << 2)
#define kVNG_POLICY_EXC_CORPSE (1u << 3)
#define kVNG_POLICY_SIGKILL (1u << 4)
#define kVNG_POLICY_UPRINTMSG (1u << 5)
#if defined(KERNEL)
extern int vnguard_exceptions_active(void);
extern void vnguard_policy_init(void);
#endif
#endif
__END_DECLS
#endif
#endif