xnu-11215/security/mac_process.c

/*
 * Copyright (c) 2007-2010 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

/*-
 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
 * Copyright (c) 2001 Ilmar S. Habibulin
 * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
 *
 * This software was developed by Robert Watson and Ilmar Habibulin for the
 * TrustedBSD Project.
 *
 * This software was developed for the FreeBSD Project in part by Network
 * Associates Laboratories, the Security Research Division of Network
 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
 * as part of the DARPA CHATS research program.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 */

#include <string.h>
#include <sys/param.h>
#include <sys/ucred.h>
#include <sys/malloc.h>
#include <sys/sbuf.h>
#include <sys/vnode.h>
#include <sys/proc.h>
#include <sys/proc_internal.h>
#include <sys/kauth.h>
#include <sys/imgact.h>
#include <sys/reason.h>
#include <sys/vnode_internal.h>
#include <mach/mach_types.h>
#include <kern/task.h>
#include <kern/zalloc.h>

#include <os/hash.h>

#include <security/mac_internal.h>
#include <security/mac_mach_internal.h>

#include <bsd/security/audit/audit.h>

#include <os/log.h>
#include <kern/cs_blobs.h>
#include <sys/spawn.h>
#include <sys/spawn_internal.h>

struct label *
mac_cred_label_alloc(void)
{
	struct label *label;

	label = mac_labelzone_alloc(MAC_WAITOK);
	if (label == NULL) {
		return NULL;
	}
	MAC_PERFORM(cred_label_init, label);
	return label;
}

void
mac_cred_label_init(struct ucred *cred)
{
	cred->cr_label = mac_cred_label_alloc();
}

void
mac_cred_label_seal(struct ucred *cred)
{
#if DEVELOPMENT || DEBUG
	struct label **seal = (struct label **)-1;

	zalloc_ro_update_field(ZONE_ID_MAC_LABEL, cred->cr_label, l_owner, &seal);
#else
	(void)cred;
#endif
}

void
mac_cred_label_free(struct label *label)
{
#if DEVELOPMENT || DEBUG
	struct label **seal = (struct label **)-1;

	if (label->l_owner == seal) {
		seal = NULL;
		zalloc_ro_update_field(ZONE_ID_MAC_LABEL, label, l_owner, &seal);
	}
#endif

	MAC_PERFORM(cred_label_destroy, label);
	mac_labelzone_free(label);
}

struct label *
mac_cred_label(struct ucred *cred)
{
	return cred->cr_label;
}

bool
mac_cred_label_is_equal(const struct label *a, const struct label *b)
{
	return memcmp(a->l_perpolicy, b->l_perpolicy, sizeof(a->l_perpolicy)) == 0;
}

uint32_t
mac_cred_label_hash_update(const struct label *a, uint32_t hash)
{
	return os_hash_jenkins_update(a->l_perpolicy, sizeof(a->l_perpolicy), hash);
}

int
mac_cred_label_externalize_audit(struct proc *p, struct mac *mac)
{
	kauth_cred_t cr;
	int error;

	cr = kauth_cred_proc_ref(p);

	error = MAC_EXTERNALIZE_AUDIT(cred, mac_cred_label(cr),
	    mac->m_string, mac->m_buflen);

	kauth_cred_unref(&cr);
	return error;
}

void
mac_cred_label_destroy(kauth_cred_t cred)
{
	struct label *label = mac_cred_label(cred);
	cred->cr_label = NULL;
	mac_cred_label_free(label);
}

int
mac_cred_label_externalize(struct label *label, char *elements,
    char *outbuf, size_t outbuflen, int flags __unused)
{
	int error = 0;

	error = MAC_EXTERNALIZE(cred, label, elements, outbuf, outbuflen);

	return error;
}

int
mac_cred_label_internalize(struct label *label, char *string)
{
	int error;

	error = MAC_INTERNALIZE(cred, label, string);

	return error;
}

/*
 * By default, fork just adds a reference to the parent
 * credential.  Policies may need to know about this reference
 * if they are tracking exit calls to know when to free the
 * label.
 */
void
mac_cred_label_associate_fork(kauth_cred_t cred, proc_t proc)
{
	MAC_PERFORM(cred_label_associate_fork, cred, proc);
}

/*
 * Initialize MAC label for the first kernel process, from which other
 * kernel processes and threads are spawned.
 */
void
mac_cred_label_associate_kernel(kauth_cred_t cred)
{
	MAC_PERFORM(cred_label_associate_kernel, cred);
}

/*
 * Initialize MAC label for the first userland process, from which other
 * userland processes and threads are spawned.
 */
void
mac_cred_label_associate_user(kauth_cred_t cred)
{
	MAC_PERFORM(cred_label_associate_user, cred);
}

/*
 * When a new process is created, its label must be initialized.  Generally,
 * this involves inheritence from the parent process, modulo possible
 * deltas.  This function allows that processing to take place.
 */
void
mac_cred_label_associate(struct ucred *parent_cred, struct ucred *child_cred)
{
	MAC_PERFORM(cred_label_associate, parent_cred, child_cred);
}

int
mac_execve_enter(user_addr_t mac_p, struct image_params *imgp)
{
	if (mac_p == USER_ADDR_NULL) {
		return 0;
	}

	return mac_do_set(current_proc(), mac_p,
	           ^(char *input, __unused size_t len) {
		struct label *execlabel;
		int error;

		execlabel = mac_cred_label_alloc();
		if ((error = mac_cred_label_internalize(execlabel, input))) {
		        mac_cred_label_free(execlabel);
		        execlabel = NULL;
		}

		imgp->ip_execlabelp = execlabel;
		return error;
	});
}

/*
 * When the subject's label changes, it may require revocation of privilege
 * to mapped objects.  This can't be done on-the-fly later with a unified
 * buffer cache.
 *
 * XXX:		CRF_MAC_ENFORCE should be in a kauth_cred_t field, rather
 * XXX:		than a posix_cred_t field.
 */
void
mac_cred_label_update(kauth_cred_t cred, struct label *newlabel)
{
	posix_cred_t pcred = posix_cred_get(cred);

	/* force label to be part of "matching" for credential */
	pcred->cr_flags |= CRF_MAC_ENFORCE;

	/* inform the policies of the update */
	MAC_PERFORM(cred_label_update, cred, newlabel);
}

int
mac_cred_check_label_update(kauth_cred_t cred, struct label *newlabel)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif

	MAC_CHECK(cred_check_label_update, cred, newlabel);

	return error;
}

int
mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif

	MAC_CHECK(cred_check_visible, u1, u2);

	return error;
}

int
mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident)
{
	int error;
	bool enforce;
	proc_t tracingp;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	/*
	 * Once all mac hooks adopt proc_ident_t, finding proc_t and releasing
	 * it below should go to mac_proc_check_enforce().
	 */
	if ((tracingp = proc_find_ident(tracing_ident)) == PROC_NULL) {
		return ESRCH;
	}
	enforce = mac_proc_check_enforce(tracingp);
	proc_rele(tracingp);

	if (!enforce) {
		return 0;
	}
	MAC_CHECK(proc_check_debug, tracing_cred, traced_ident);

	return error;
}

int
mac_proc_check_dump_core(struct proc *proc)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(proc)) {
		return 0;
	}

	MAC_CHECK(proc_check_dump_core, proc);

	return error;
}

int
mac_proc_check_remote_thread_create(struct task *task, int flavor, thread_state_t new_state, mach_msg_type_number_t new_state_count)
{
	proc_t curp = current_proc();
	proc_t proc;
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	proc = proc_find(task_pid(task));
	if (proc == PROC_NULL) {
		return ESRCH;
	}

	MAC_CHECK(proc_check_remote_thread_create, current_cached_proc_cred(curp),
	    proc, flavor, new_state, new_state_count);
	proc_rele(proc);

	return error;
}

void
mac_proc_notify_service_port_derive(struct mach_service_port_info *sp_info)
{
	MAC_PERFORM(proc_notify_service_port_derive,
	    current_cached_proc_cred(PROC_NULL), sp_info);
}

int
mac_proc_check_fork(proc_t curp)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_fork, current_cached_proc_cred(curp), curp);

	return error;
}

int
mac_proc_check_get_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)
{
	int error;

	assert(flavor <= TASK_FLAVOR_NAME);

	MAC_CHECK(proc_check_get_task_with_flavor, cred, pident, flavor);

	return error;
}

int
mac_proc_check_expose_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)
{
	int error;

	assert(flavor <= TASK_FLAVOR_NAME);

	MAC_CHECK(proc_check_expose_task_with_flavor, cred, pident, flavor);

	return error;
}

int
mac_proc_check_inherit_ipc_ports(
	struct proc *p,
	struct vnode *cur_vp,
	off_t cur_offset,
	struct vnode *img_vp,
	off_t img_offset,
	struct vnode *scriptvp)
{
	int error;

	MAC_CHECK(proc_check_inherit_ipc_ports, p, cur_vp, cur_offset, img_vp, img_offset, scriptvp);

	return error;
}

/*
 * The type of maxprot in proc_check_map_anon must be equivalent to vm_prot_t
 * (defined in <mach/vm_prot.h>). mac_policy.h does not include any header
 * files, so cannot use the typedef itself.
 */
int
mac_proc_check_map_anon(proc_t proc, kauth_cred_t cred, user_addr_t u_addr,
    user_size_t u_size, int prot, int flags, int *maxprot)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_vm_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(proc)) {
		return 0;
	}

	MAC_CHECK(proc_check_map_anon, proc, cred, u_addr, u_size, prot, flags, maxprot);

	return error;
}


int
mac_proc_check_memorystatus_control(proc_t proc, uint32_t command, pid_t pid)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(proc)) {
		return 0;
	}

	MAC_CHECK(proc_check_memorystatus_control, current_cached_proc_cred(proc),
	    command, pid);

	return error;
}

int
mac_proc_check_mprotect(proc_t proc,
    user_addr_t addr, user_size_t size, int prot)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_vm_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(proc)) {
		return 0;
	}

	MAC_CHECK(proc_check_mprotect, current_cached_proc_cred(proc),
	    proc, addr, size, prot);

	return error;
}

int
mac_proc_check_run_cs_invalid(proc_t proc)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_vm_enforce) {
		return 0;
	}
#endif

	MAC_CHECK(proc_check_run_cs_invalid, proc);

	return error;
}

void
mac_proc_notify_cs_invalidated(proc_t proc)
{
	MAC_PERFORM(proc_notify_cs_invalidated, proc);
}

int
mac_proc_check_sched(proc_t curp, struct proc *proc)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_sched, current_cached_proc_cred(curp), proc);

	return error;
}

int
mac_proc_check_signal(proc_t curp, struct proc *proc, int signum)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_signal, current_cached_proc_cred(curp), proc, signum);

	return error;
}

int
mac_proc_check_delegated_signal(proc_t curp, audit_token_t instigator, audit_token_t target, int signum)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_delegated_signal, current_cached_proc_cred(curp), instigator, target, signum);
	return error;
}

int
mac_proc_check_syscall_unix(proc_t curp, int scnum)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_syscall_unix, curp, scnum);

	return error;
}

int
mac_proc_check_wait(proc_t curp, struct proc *proc)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_wait, current_cached_proc_cred(curp), proc);

	return error;
}

void
mac_proc_notify_exit(struct proc *proc)
{
	MAC_PERFORM(proc_notify_exit, proc);
}

int
mac_proc_check_suspend_resume(proc_t proc, int sr)
{
	proc_t curp = current_proc();
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_suspend_resume, current_cached_proc_cred(curp),
	    proc, sr);

	return error;
}

int
mac_proc_check_ledger(proc_t curp, proc_t proc, int ledger_op)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_ledger, current_cached_proc_cred(curp),
	    proc, ledger_op);

	return error;
}

int
mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_proc_info, current_cached_proc_cred(curp),
	    target, callnum, flavor);

	return error;
}

int
mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_get_cs_info, current_cached_proc_cred(curp),
	    target, op);

	return error;
}

int
mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_set_cs_info, current_cached_proc_cred(curp),
	    target, op);

	return error;
}

int
mac_proc_check_setuid(proc_t curp, kauth_cred_t cred, uid_t uid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_setuid, cred, uid);

	return error;
}

int
mac_proc_check_seteuid(proc_t curp, kauth_cred_t cred, uid_t euid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_seteuid, cred, euid);

	return error;
}

int
mac_proc_check_setreuid(proc_t curp, kauth_cred_t cred, uid_t ruid, uid_t euid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_setreuid, cred, ruid, euid);

	return error;
}

int
mac_proc_check_setgid(proc_t curp, kauth_cred_t cred, gid_t gid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_setgid, cred, gid);

	return error;
}

int
mac_proc_check_setegid(proc_t curp, kauth_cred_t cred, gid_t egid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_setegid, cred, egid);

	return error;
}

int
mac_proc_check_setregid(proc_t curp, kauth_cred_t cred, gid_t rgid, gid_t egid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_setregid, cred, rgid, egid);

	return error;
}

int
mac_proc_check_settid(proc_t curp, uid_t uid, gid_t gid)
{
	int error = 0;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce) {
		return 0;
	}
#endif
	if (!mac_proc_check_enforce(curp)) {
		return 0;
	}

	MAC_CHECK(proc_check_settid, current_cached_proc_cred(curp),
	    kauth_cred_get(), uid, gid);

	return error;
}

int
mac_proc_check_launch_constraints(proc_t curp, struct image_params *imgp, os_reason_t *reasonp)
{
	char *fatal_failure_desc = NULL;
	size_t fatal_failure_desc_len = 0;

	pid_t original_parent_id = proc_original_ppid(curp);

	pid_t responsible_pid = curp->p_responsible_pid;

	int error = 0;

	/* Vnode of the file */
	struct vnode *vp = imgp->ip_vp;

	char *vn_path = NULL;
	vm_size_t vn_pathlen = MAXPATHLEN;
#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_proc_enforce || !mac_vnode_enforce) {
		return 0;
	}
#endif

	MAC_POLICY_ITERATE({
		mpo_proc_check_launch_constraints_t *hook = mpc->mpc_ops->mpo_proc_check_launch_constraints;
		if (hook == NULL) {
		        continue;
		}

		size_t spawnattrlen = 0;
		void *spawnattr = exec_spawnattr_getmacpolicyinfo(&imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen);
		struct _posix_spawnattr *psa = (struct _posix_spawnattr *) imgp->ip_px_sa;
		struct launch_constraint_data lcd;
		lcd.launch_type = CS_LAUNCH_TYPE_NONE;

		/* Check to see if psa_launch_type was initalized */
		if (psa != (struct _posix_spawnattr*)NULL) {
		        lcd.launch_type = psa->psa_launch_type;
		}

		error = mac_error_select(
			hook(curp, original_parent_id, responsible_pid,
			spawnattr, spawnattrlen, &lcd, &fatal_failure_desc, &fatal_failure_desc_len), error);

		/*
		 * Early exit in case of failure in case we have multiple registered callers.
		 * This is to avoid other MACF policies from stomping on each other's failure description
		 */
		if (fatal_failure_desc_len) {
		        goto policy_fail;
		}
	});

policy_fail:
	if (fatal_failure_desc_len) {
		/*
		 * A fatal code signature validation failure occured, formulate a crash
		 * reason.
		 */

		char const *path = NULL;

		vn_path = zalloc(ZV_NAMEI);
		if (vn_getpath(vp, vn_path, (int*)&vn_pathlen) == 0) {
			path = vn_path;
		} else {
			path = "(get vnode path failed)";
		}

		if (error == 0) {
			panic("%s: MAC hook returned no error, but status is claimed to be fatal? "
			    "path: '%s', fatal_failure_desc_len: %ld, fatal_failure_desc:\n%s\n",
			    __func__, path, fatal_failure_desc_len, fatal_failure_desc);
		}

		os_reason_t reason = os_reason_create(OS_REASON_CODESIGNING,
		    CODESIGNING_EXIT_REASON_LAUNCH_CONSTRAINT_VIOLATION);

		*reasonp = reason;

		reason->osr_flags = (OS_REASON_FLAG_GENERATE_CRASH_REPORT |
		    OS_REASON_FLAG_CONSISTENT_FAILURE);

		if (fatal_failure_desc != NULL) {
			mach_vm_address_t data_addr = 0;

			int reason_error = 0;
			int kcdata_error = 0;

			if ((reason_error = os_reason_alloc_buffer_noblock(reason,
			    kcdata_estimate_required_buffer_size(1,
			    (uint32_t)fatal_failure_desc_len))) == 0) {
				if ((kcdata_error = kcdata_get_memory_addr(&reason->osr_kcd_descriptor,
				    EXIT_REASON_USER_DESC, (uint32_t)fatal_failure_desc_len,
				    &data_addr)) == KERN_SUCCESS) {
					kcdata_memcpy(&reason->osr_kcd_descriptor, (mach_vm_address_t)data_addr,
					    fatal_failure_desc, (uint32_t)fatal_failure_desc_len);
				}
			}
		}
	}

	if (vn_path) {
		zfree(ZV_NAMEI, vn_path);
	}

	if (fatal_failure_desc_len > 0 && fatal_failure_desc != NULL) {
		kfree_data(fatal_failure_desc, fatal_failure_desc_len);
	}

	return error;
}