FreeBSD/Linux Kernel Cross Reference
sys/security/mac_priv.c

     /*
      * Copyright (c) 2010 Apple Inc. All rights reserved.
      *
      * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
      * 
      * This file contains Original Code and/or Modifications of Original Code
      * as defined in and that are subject to the Apple Public Source License
      * Version 2.0 (the 'License'). You may not use this file except in
      * compliance with the License. The rights granted to you under the License
     * may not be used to create, or enable the creation or redistribution of,
     * unlawful or unlicensed copies of an Apple operating system, or to
     * circumvent, violate, or enable the circumvention or violation of, any
     * terms of an Apple operating system software license agreement.
     * 
     * Please obtain a copy of the License at
     * http://www.opensource.apple.com/apsl/ and read it before using this file.
     * 
     * The Original Code and all software distributed under the License are
     * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
     * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
     * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
     * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
     * Please see the License for the specific language governing rights and
     * limitations under the License.
     * 
     * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
     */
    /*-
     * Copyright (c) 2006 nCircle Network Security, Inc.
     * Copyright (c) 2009 Robert N. M. Watson
     * All rights reserved.
     *
     * This software was developed by Robert N. M. Watson for the TrustedBSD
     * Project under contract to nCircle Network Security, Inc.
     *
     * This software was developed at the University of Cambridge Computer
     * Laboratory with support from a grant from Google, Inc.
     *
     * Redistribution and use in source and binary forms, with or without
     * modification, are permitted provided that the following conditions
     * are met:
     * 1. Redistributions of source code must retain the above copyright
     *    notice, this list of conditions and the following disclaimer.
     * 2. Redistributions in binary form must reproduce the above copyright
     *    notice, this list of conditions and the following disclaimer in the
     *    documentation and/or other materials provided with the distribution.
     *
     * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY,
     * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
     * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
     * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
     * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
     * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
     * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     */
    
    /*
     * MAC checks for system privileges.
     */
    
    #include <sys/param.h>
    #include <sys/kernel.h>
    
    #include <security/mac_internal.h>
    
    /*
     * The MAC Framework interacts with kernel privilege checks in two ways: it
     * may restrict the granting of privilege to a subject, and it may grant
     * additional privileges to the subject.  Policies may implement none, one,
     * or both of these entry points.  Restriction of privilege by any policy
     * always overrides granting of privilege by any policy or other privilege
     * mechanism.  See kern_priv.c:priv_check_cred() for details of the
     * composition.
     */
    
    /*
     * Restrict access to a privilege for a credential.  Return failure if any
     * policy denies access.
     */
    int
    mac_priv_check(kauth_cred_t cred, int priv)
    {
            int error;
    
            MAC_CHECK(priv_check, cred, priv);
    
            return (error);
    }
    
    /*
     * Grant access to a privilege for a credential.  Return success if any
     * policy grants access.
     */
    int
    mac_priv_grant(kauth_cred_t cred, int priv)
   {
           int error;
   
           MAC_GRANT(priv_grant, cred, priv);
   
           return (error);
   }

Cache object: d4fc0a21735ecb1faf04448255525ca5