Apple

On Wed, Aug 14, 2013 at 10:40 AM, Amarnath <email@hidden> wrote:

Definition of mac_proc_check_signal() as per Apple [1]

int
mac_proc_check_signal(proc_t curp, struct proc *proc, int signum)
{
    kauth_cred_t cred;
    int error;

    if (!mac_proc_enforce ||
        !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
        return (0);

    cred = kauth_cred_proc_ref(curp);
    MAC_CHECK(proc_check_signal, cred, proc, signum);
    kauth_cred_unref(&cred);

    return (error);
}

[…]

As a consequence, I see that the Mac implementation does not capture the error value which should have returned while I was trying to block the signals.

Any inputs on this?

The MAC_CHECK macro (defined in mac_internal.h) does update the error variable with a combination of any errors returned by any MAC policy callbacks via mac_error_select(). In particular, it initialises error = 0, then runs through the registered MAC policies and calls any callbacks supplied for the policy op in question. What are you returning from your callback? You say you're getting the callback, but still: are you sure the mac_proc_enforce etc. check is not causing an early-out? If you look at the calling code in cansignal(), the specific error code isn't passed through, though if anything nonzero is returned, cansignal does return boolean false, which will prevent the signal from being sent:

int error;
error = mac_proc_check_signal(p, q, signum);
if (error)
return (0);

References:
	>Re: Block SIGKILL/SIGTERM (From: Amarnath <email@hidden>)