321 	const char    *varName;  member
400 variableInAllowList(const char *varName)  in variableInAllowList()  argument
406 		if (strcmp(varName, list[i]) == 0) {  in variableInAllowList()
544 verifyVarEntitlement(const uuid_t varGuid, const char *varName, IONVRAMOperation op, bool systemAct…  in verifyVarEntitlement()  argument
546 	if (varGuid == nullptr || varName == nullptr || veChecked == nullptr) {  in verifyVarEntitlement()
555 	translateGUID(varGuid, varName, translatedGuid, systemActive);  in verifyVarEntitlement()
558 	while ((entry != nullptr) && (entry->varName != nullptr)) {  in verifyVarEntitlement()
559 …if ((strcmp(entry->varName, varName) == 0) && (uuid_compare(translatedGuid, *(entry->varGuid)) == …  in verifyVarEntitlement()
563 …DEBUG_INFO("Checking entitlement %s for %s for operation %s\n", entry->varEntitlement, varName, ge…  in verifyVarEntitlement()
575 kernelOnlyVar(const uuid_t varGuid, const char *varName)  in kernelOnlyVar()  argument
577 	if (strncmp(varName, KERNEL_ONLY_VAR_NAME_PREFIX, sizeof(KERNEL_ONLY_VAR_NAME_PREFIX) - 1) == 0) {  in kernelOnlyVar()
585 verifyPermission(IONVRAMOperation op, const uuid_t varGuid, const char *varName, const bool systemA…  in verifyPermission()  argument
592 	if (verifyVarEntitlement(varGuid, varName, op, systemActive, &varEntitled) == false) {  in verifyPermission()
596 	perm = getVariablePermission(varName);  in verifyPermission()
600 	if (perm.Bits.KernelOnly || kernelOnlyVar(varGuid, varName)) {  in verifyPermission()
601 		DEBUG_INFO("KernelOnly access for %s, kernel=%d\n", varName, kernel);  in verifyPermission()
607 		DEBUG_INFO("InternalOnly access for %s, gInternalBuild=%d\n", varName, gInternalBuild);  in verifyPermission()
611 	allowList              = variableInAllowList(varName);  in verifyPermission()
636 						DEBUG_ERROR("Allowed write to system region when NOT entitled for %s\n", varName);  in verifyPermission()
639 …DEBUG_INFO("Allowed write to system region using variable specific entitlement for %s\n", varName);  in verifyPermission()
641 					DEBUG_ERROR("Not entitled for system region writes for %s\n", varName);  in verifyPermission()
653 			DEBUG_INFO("Never allowed to delete %s\n", varName);  in verifyPermission()
656 			DEBUG_INFO("Not allowed to obliterate %s\n", varName);  in verifyPermission()
659 			DEBUG_INFO("Only allowed to delete %s via NVRAM reset\n", varName);  in verifyPermission()
667 						DEBUG_ERROR("Allowed delete to system region when NOT entitled for %s\n", varName);  in verifyPermission()
670 …EBUG_INFO("Allowed delete to system region using variable specific entitlement for %s\n", varName);  in verifyPermission()
672 					DEBUG_ERROR("Not entitled for system region deletes for %s\n", varName);  in verifyPermission()
685 … sG=%d, sEd=%d, sIEd=%d, sRHA=%d, UW=%d, vE=%d\n", getNVRAMOpString(op), varName, ok ? "granted" :…  in verifyPermission()
694 	const char *varName;  in verifyPermission()  local
697 	parseVariableName(canonicalKey->getCStringNoCopy(), &varGuid, &varName);  in verifyPermission()
699 	return verifyPermission(op, varGuid, varName, systemActive);  in verifyPermission()
1568 	const char *                      varName;  in dictionaryWithProperties()  local
1595 		parseVariableName(canonicalKey, &varGuid, &varName);  in dictionaryWithProperties()
1598 …  verifyPermission(kIONVRAMOperationRead, varGuid, varName, _format->getSystemPartitionActive())) {  in dictionaryWithProperties()
1599 			OSSharedPtr<const OSSymbol> returnKey = OSSymbol::withCString(varName);  in dictionaryWithProperties()
1613 		parseVariableName(canonicalKey, &varGuid, &varName);  in dictionaryWithProperties()
1616 			if (returnDict->getObject(varName) != nullptr) {  in dictionaryWithProperties()
1621 …if (verifyPermission(kIONVRAMOperationRead, varGuid, varName, _format->getSystemPartitionActive())…  in dictionaryWithProperties()
1622 				OSSharedPtr<const OSSymbol> returnKey = OSSymbol::withCString(varName);  in dictionaryWithProperties()