Hello,
I tried to make use of the MAC framework on Mac to block signals. I observe that I am able to hook on to the signals before it gets passed onto the processes. But, I am not able to block the signals.
I had spent sometime analyzing why this was happening.
Interestingly, I see that the implementation on Mac and on FreeBSD differs significantly. These are my observations.
Definition of mac_proc_check_signal() as per Apple [1]
int
mac_proc_check_signal(proc_t curp, struct proc *proc, int signum)
{
kauth_cred_t cred;
int error;
if (!mac_proc_enforce ||
!mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
return (0);
cred = kauth_cred_proc_ref(curp);
MAC_CHECK(proc_check_signal, cred, proc, signum);
kauth_cred_unref(&cred);
return (error);
}
Definition of mac_proc_check_signal() as per FreeBSD [2]
int
mac_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
{
int error;
PROC_LOCK_ASSERT(p, MA_OWNED);
MAC_POLICY_CHECK_NOSLEEP(proc_check_signal, cred, p, signum);
MAC_CHECK_PROBE3(proc_check_signal, error, cred, p, signum);
return (error);
}
As a consequence, I see that the Mac implementation does not capture the error value which should have returned while I was trying to block the signals.