1  /*
 2   * DTrace static providers at the Code Signing layer
 3   */
 4  #define int32_t int
 5  #define uint32_t unsigned
 6  #define mach_port_t uint32_t
 7  #define bool uint8_t
 8  #define off_t uint64_t
 9  
10  
11  /*
12   * Basic semantic events of the code signing subsystem
13   */
14  provider codesign {
15  	probe diskrep__create__macho(void *me, const char *path, const void *ctx);
16  	probe diskrep__create__bundle__path(void *me, const char *path, void *ctx, void *exec);
17  	probe diskrep__create__bundle__ref(void *me, void *cfbundle, void *ctx, void *exec);
18  	probe diskrep__create__file(void *me, const char *path);
19  	probe diskrep__create__cfm(void *me, const char *path);
20  	probe diskrep__create__slc(void *me, const char *path);
21  	probe diskrep__create__detached(void *me, void *orig, const char *source, void *glob);
22  	probe diskrep__create__kernel(void *me);
23  	probe diskrep__destroy(void *me);
24  
25  	probe static__create(void *me, void *host);
26  	probe dynamic__create(void *me, void *rep);
27  	
28  	probe static__cdhash(void *me, const void *cdhash, uint32_t length);
29  	probe static__attach__explicit(void *me, void *rep);
30  	probe static__attach__system(void *me, void *rep);
31  
32  	probe eval__dynamic__start(void *me, const char *path);
33  	probe eval__dynamic__end(void *me);
34  	probe eval__dynamic__root(void *me);
35  	
36  	probe eval__static__start(void *me, const char *path);
37  	probe eval__static__end(void *me);
38  	probe eval__static__reset(void *me);
39  	
40  	probe eval__static__executable__start(void *me, const char *path, uint32_t pages);
41  	probe eval__static__executable__fail(void *me, uint32_t badPage);
42  	probe eval__static__executable__end(void *me);
43  	probe eval__static__resources__start(void *me, const char *path, int count);
44  	probe eval__static__resources__end(void *me);
45  	
46  	probe eval__static__directory(void *me);
47  	probe eval__static__intreq__start(void *me, uint32_t reqType, void *target, int32_t nullError);
48  	probe eval__static__intreq__end(void *me);
49  	
50  	probe eval__static__signature__start(void *me, const char *path);
51  	probe eval__static__signature__adhoc(void *me);
52  	probe eval__static__signature__result(void *me, uint32_t result, uint32_t chainLength);
53  	probe eval__static__signature__expired(void *me);
54  	probe eval__static__signature__end(void *me);
55  
56  	probe eval__reqint__start(const void *reqdata, uint32_t reqlength);
57  	probe eval__reqint__end(const void *reqdata, uint32_t result);
58  	probe eval__reqint__op(uint32_t opcode, uint32_t offset);
59  	probe eval__reqint__unknown_false(uint32_t opcode);
60  	probe eval__reqint__unknown_skipped(uint32_t opcode);
61  	probe eval__reqint__fragment__load(const char *type, const char *name, const void *req);
62  	probe eval__reqint__fragment__hit(const char *type, const char *name);
63  	
64  	probe guest__hostingport(void *host, mach_port_t hostingPort);
65  	probe guest__locate__generic(void *host, uint32_t *guestPath, uint32_t guestPathLength, mach_port_t subport);
66  	probe guest__identify__process(void *guest, uint32_t guestPid, void *code);
67  	probe guest__cdhash__process(void *code, const void *cdhash, uint32_t length);
68  	probe guest__identify__generic(void *guest, uint32_t guestRef, void *code);
69  	probe guest__cdhash__generic(void *code, const void *cdhash, uint32_t length);
70  	
71  	probe allocate__validate(const char *path, uint32_t pid);
72  	probe allocate__arch(const char *arch, uint32_t size);
73  	probe allocate__archn(uint32_t cputype, uint32_t cpusubtype, uint32_t size);
74  	probe allocate__write(const char *arch, off_t offset, uint32_t length, uint32_t available);
75  	
76  	probe sign__dep__macho(void *me, const char *name, const void *requirement);
77  	probe sign__dep__interp(void *me, const char *name, const void *requirement);
78  
79  	probe load__antlr();
80  };
81  
82  
83  provider syspolicy {
84  	probe assess_api(const char *path, int type, uint64_t flags);
85  	
86  	probe assess__outcome__accept(const char *path, int type, const char *label, const void *cdhash);
87  	probe assess__outcome__deny(const char *path, int type, const char *label, const void *cdhash);
88  	probe assess__outcome__default(const char *path, int type, const char *label, const void *cdhash);
89  	probe assess__outcome__unsigned(const char *path, int type);
90  	probe assess__outcome__broken(const char *path, int type, bool exception_made);
91  
92  	probe recorder_mode(const char *path, int type, const char *label, const void *cdhash, int flags);
93  	probe recorder_mode_adhoc_path(const char *path, int type, const char *sig_path);	// path containing adhoc signature recorded
94  	
95  	probe assess_cache_hit();
96  	probe assess_local();
97  	probe assess_remote();
98  };