svc · unix #380
__mac_execve
Variante d'execve qui applique simultanément une étiquette MAC à la nouvelle image de processus.
Prototype
int __mac_execve(char *fname, char **argp, char **envp, struct mac *mac_p);Retour: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| fname | char | - | |
| argp | char | - | |
| envp | char | - | |
| mac_p | struct mac | - |
Historique des versions
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 380 |
| xnu-1699.24.8 | macOS 10.7 Lion | 380 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 380 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 380 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 380 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 380 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 380 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 380 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 380 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 380 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 380 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 380 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 380 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 380 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 380 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 380 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 380 |
| xnu-10002.41.9 | — | 380 |
| xnu-10002.61.3 | — | 380 |
| xnu-10002.81.5 | — | 380 |
| xnu-10063.101.15 | — | 380 |
| xnu-10063.121.3 | — | 380 |
| xnu-10063.141.1 | — | 380 |
| xnu-11215.41.3 | — | 380 |
| xnu-11215.61.5 | — | 380 |
| xnu-11215.81.4 | — | 380 |
| xnu-11417.121.6 | — | 380 |
| xnu-11417.140.69 | — | 380 |
| xnu-12377.101.15 | — | 380 |
| xnu-12377.41.6 | — | 380 |
| xnu-12377.61.12 | — | 380 |
| xnu-12377.81.4 | — | 380 |
| xnu-1486.2.11 | — | 380 |
| xnu-1504.15.3 | — | 380 |
| xnu-1504.3.12 | — | 380 |
| xnu-1504.7.4 | — | 380 |
| xnu-1504.9.17 | — | 380 |
| xnu-1504.9.26 | — | 380 |
| xnu-1504.9.37 | — | 380 |
| xnu-1699.22.73 | — | 380 |
| xnu-1699.22.81 | — | 380 |
| xnu-1699.24.23 | — | 380 |
| xnu-1699.26.8 | — | 380 |
| xnu-1699.32.7 | — | 380 |
| xnu-2050.22.13 | — | 380 |
| xnu-2050.24.15 | — | 380 |
| xnu-2050.48.11 | — | 380 |
| xnu-2050.7.9 | — | 380 |
| xnu-2050.9.2 | — | 380 |
| xnu-2422.1.72 | — | 380 |
| xnu-2422.100.13 | — | 380 |
| xnu-2422.110.17 | — | 380 |
| xnu-2422.90.20 | — | 380 |
| xnu-2782.1.97 | — | 380 |
| xnu-2782.10.72 | — | 380 |
| xnu-2782.20.48 | — | 380 |
| xnu-2782.30.5 | — | 380 |
| xnu-3247.10.11 | — | 380 |
| xnu-3248.20.55 | — | 380 |
| xnu-3248.30.4 | — | 380 |
| xnu-3248.40.184 | — | 380 |
| xnu-3248.50.21 | — | 380 |
| xnu-3248.60.10 | — | 380 |
| xnu-3789.21.4 | — | 380 |
| xnu-3789.31.2 | — | 380 |
| xnu-3789.41.3 | — | 380 |
| xnu-3789.51.2 | — | 380 |
| xnu-3789.60.24 | — | 380 |
| xnu-3789.70.16 | — | 380 |
| xnu-4570.20.62 | — | 380 |
| xnu-4570.31.3 | — | 380 |
| xnu-4570.41.2 | — | 380 |
| xnu-4570.51.1 | — | 380 |
| xnu-4570.61.1 | — | 380 |
| xnu-4570.71.2 | — | 380 |
| xnu-4903.231.4 | — | 380 |
| xnu-4903.241.1 | — | 380 |
| xnu-4903.270.47 | — | 380 |
| xnu-6153.101.6 | — | 380 |
| xnu-6153.121.1 | — | 380 |
| xnu-6153.141.1 | — | 380 |
| xnu-6153.41.3 | — | 380 |
| xnu-6153.61.1 | — | 380 |
| xnu-6153.81.5 | — | 380 |
| xnu-7195.101.1 | — | 380 |
| xnu-7195.121.3 | — | 380 |
| xnu-7195.141.2 | — | 380 |
| xnu-7195.60.75 | — | 380 |
| xnu-7195.81.3 | — | 380 |
| xnu-8019.61.5 | — | 380 |
| xnu-8019.80.24 | — | 380 |
| xnu-8020.101.4 | — | 380 |
| xnu-8020.121.3 | — | 380 |
| xnu-8020.140.41 | — | 380 |
| xnu-8792.61.2 | — | 380 |
| xnu-8792.81.2 | — | 380 |
| xnu-8796.101.5 | — | 380 |
| xnu-8796.121.2 | — | 380 |
| xnu-8796.141.3 | — | 380 |
Notes
Superposé à execve, __mac_execve prend un mac_t supplémentaire portant des étiquettes pour un ou plusieurs modules de politique chargés. Le noyau transmet l'étiquette au hook mpo_vnode_check_exec de chaque politique, permettant à des modules comme Sandbox ou AMFI de bloquer ou de faire transitionner la nouvelle image. Sur macOS standard aucune politique MAC livrée ne parse d'étiquette, donc les étiquettes non vides échouent typiquement avec EINVAL — mais le syscall reste la manière canonique d'exprimer une transition d'étiquette au moment de l'exec.
Détection
Endpoint Security l'expose via ES_EVENT_TYPE_NOTIFY_EXEC comme execve ; différencier en inspectant le numéro de syscall enregistré dans proc->p_sysent. Les politiques MACF la voient via mpo_vnode_check_label_update_exec et mpo_cred_label_update_execve.