endpoint_sec_sys/
types.rs

1//! Corresponding header: `EndpointSecurity/ESTypes.h`
2
3// Types and methods should be added in the same order as they are in the original header to make
4// maintenance easier.
5
6use core::fmt;
7use core::hash::Hash;
8use core::slice::from_raw_parts;
9use std::ffi::OsStr;
10use std::os::unix::ffi::OsStrExt;
11
12pub use libc::{c_char, size_t};
13
14use super::audit_token_t;
15
16/// Unique ID for an event
17#[repr(C)]
18#[derive(Copy, Clone, PartialEq, Eq, Hash)]
19pub struct es_event_id_t {
20    _reserved: [u8; 32],
21}
22
23// Make the debug representation an hex string to make it shorter and clearer when debugging
24impl fmt::Debug for es_event_id_t {
25    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
26        f.debug_tuple("es_event_id_t").field(&format!("{:#X}", self)).finish()
27    }
28}
29
30impl fmt::LowerHex for es_event_id_t {
31    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
32        for v in self._reserved {
33            fmt::LowerHex::fmt(&v, f)?;
34        }
35
36        Ok(())
37    }
38}
39
40impl fmt::UpperHex for es_event_id_t {
41    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
42        for v in self._reserved {
43            fmt::UpperHex::fmt(&v, f)?;
44        }
45
46        Ok(())
47    }
48}
49
50ffi_wrap_enum!(
51    /// Type of action to take after receiving a message
52    es_action_type_t(u32);
53
54    == MACOS_10_15_0;
55    /// Event needs a response before its deadline
56    ES_ACTION_TYPE_AUTH = 0,
57    --
58    /// Event needs no response, it is informative only
59    ES_ACTION_TYPE_NOTIFY = 1,
60);
61
62ffi_wrap_enum!(
63    /// Whether an ACL is being set or cleared
64    ///
65    /// See [`es_event_setacl_t`][super::es_event_setacl_t]
66    es_set_or_clear_t(u32);
67
68    == MACOS_10_15_0;
69    /// ACL is being set
70    ES_SET = 0,
71    --
72    /// ACL is being cleared
73    ES_CLEAR = 1,
74);
75
76ffi_wrap_enum!(
77    /// This enum describes the type of [`es_event_proc_check_t`][crate::es_event_proc_check_t]
78    /// events that are currently used.
79    ///
80    /// `ES_PROC_CHECK_TYPE_KERNMSGBUF`, `ES_PROC_CHECK_TYPE_TERMINATE` and
81    /// `ES_PROC_CHECK_TYPE_UDATA_INFO` are deprecated and no `proc_check` messages will be
82    /// generated for the corresponding `proc_info` call numbers.
83    ///
84    /// The terminate callnum is covered by the signal event.
85    es_proc_check_type_t(u32);
86
87    == MACOS_10_15_0;
88    ES_PROC_CHECK_TYPE_LISTPIDS = 0x1,
89    ES_PROC_CHECK_TYPE_PIDINFO = 0x2,
90    ES_PROC_CHECK_TYPE_PIDFDINFO = 0x3,
91    /// Deprecated, not generated anymore (since when ?)
92    ES_PROC_CHECK_TYPE_KERNMSGBUF = 0x4,
93    ES_PROC_CHECK_TYPE_SETCONTROL = 0x5,
94    ES_PROC_CHECK_TYPE_PIDFILEPORTINFO = 0x6,
95    /// Deprecated, not generated anymore (since when ?)
96    ES_PROC_CHECK_TYPE_TERMINATE = 0x7,
97    ES_PROC_CHECK_TYPE_DIRTYCONTROL = 0x8,
98    ES_PROC_CHECK_TYPE_PIDRUSAGE = 0x9,
99    --
100    /// Deprecated, not generated anymore (since when ?)
101    ES_PROC_CHECK_TYPE_UDATA_INFO = 0xe,
102);
103
104#[cfg(feature = "macos_14_0_0")]
105ffi_wrap_enum!(
106    /// This enum describes the types of XPC service domains.
107    es_xpc_domain_type_t(u32);
108
109    == MACOS_14_0_0;
110    ES_XPC_DOMAIN_TYPE_SYSTEM = 1,
111    ES_XPC_DOMAIN_TYPE_USER = 2,
112    ES_XPC_DOMAIN_TYPE_USER_LOGIN = 3,
113    ES_XPC_DOMAIN_TYPE_SESSION = 4,
114    ES_XPC_DOMAIN_TYPE_PID = 5,
115    ES_XPC_DOMAIN_TYPE_MANAGER = 6,
116    ES_XPC_DOMAIN_TYPE_PORT = 7,
117    --
118    ES_XPC_DOMAIN_TYPE_GUI = 8,
119);
120
121#[cfg(feature = "macos_13_0_0")]
122ffi_wrap_enum!(
123    /// This enum describes the types of authentications that
124    /// [`ES_EVENT_TYPE_NOTIFY_AUTHENTICATION`][es_event_type_t] can describe.
125    es_authentication_type_t(u32);
126
127    == LAST;
128    // `ES_AUTHENTICATION_TYPE_LAST` is not a valid type of authentication but is a convenience
129    // value to operate on the range of defined authentication types.
130    ES_AUTHENTICATION_TYPE_LAST,
131
132    == MACOS_13_0_0;
133    ES_AUTHENTICATION_TYPE_OD = 0,
134    ES_AUTHENTICATION_TYPE_TOUCHID = 1,
135    ES_AUTHENTICATION_TYPE_TOKEN = 2,
136    --
137    ES_AUTHENTICATION_TYPE_AUTO_UNLOCK = 3,
138);
139
140ffi_wrap_enum!(
141    /// The valid event types recognized by Endpoint Security.
142    ///
143    /// When a program subscribes to and receives an `AUTH`-related event, it must respond with an
144    /// appropriate result indicating whether or not the operation should be allowed to continue.
145    ///
146    /// The valid API options are:
147    ///
148    ///  - [`es_respond_auth_result`][super::es_respond_auth_result]
149    ///  - [`es_respond_flags_result`][super::es_respond_flags_result]
150    ///
151    /// Currently, only [`Self::ES_EVENT_TYPE_AUTH_OPEN`] must use `es_respond_flags_result`. All
152    /// other `AUTH` events must use `es_respond_auth_result`.
153    es_event_type_t(u32);
154
155    == LAST;
156    ES_EVENT_TYPE_LAST,
157
158    == MACOS_10_15_0;
159    ES_EVENT_TYPE_AUTH_EXEC = 0,
160    ES_EVENT_TYPE_AUTH_OPEN = 1,
161    ES_EVENT_TYPE_AUTH_KEXTLOAD = 2,
162    ES_EVENT_TYPE_AUTH_MMAP = 3,
163    ES_EVENT_TYPE_AUTH_MPROTECT = 4,
164    ES_EVENT_TYPE_AUTH_MOUNT = 5,
165    ES_EVENT_TYPE_AUTH_RENAME = 6,
166    ES_EVENT_TYPE_AUTH_SIGNAL = 7,
167    ES_EVENT_TYPE_AUTH_UNLINK = 8,
168    ES_EVENT_TYPE_NOTIFY_EXEC = 9,
169    ES_EVENT_TYPE_NOTIFY_OPEN = 10,
170    ES_EVENT_TYPE_NOTIFY_FORK = 11,
171    ES_EVENT_TYPE_NOTIFY_CLOSE = 12,
172    ES_EVENT_TYPE_NOTIFY_CREATE = 13,
173    ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA = 14,
174    ES_EVENT_TYPE_NOTIFY_EXIT = 15,
175    ES_EVENT_TYPE_NOTIFY_GET_TASK = 16,
176    ES_EVENT_TYPE_NOTIFY_KEXTLOAD = 17,
177    ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD = 18,
178    ES_EVENT_TYPE_NOTIFY_LINK = 19,
179    ES_EVENT_TYPE_NOTIFY_MMAP = 20,
180    ES_EVENT_TYPE_NOTIFY_MPROTECT = 21,
181    ES_EVENT_TYPE_NOTIFY_MOUNT = 22,
182    ES_EVENT_TYPE_NOTIFY_UNMOUNT = 23,
183    ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN = 24,
184    ES_EVENT_TYPE_NOTIFY_RENAME = 25,
185    ES_EVENT_TYPE_NOTIFY_SETATTRLIST = 26,
186    ES_EVENT_TYPE_NOTIFY_SETEXTATTR = 27,
187    ES_EVENT_TYPE_NOTIFY_SETFLAGS = 28,
188    ES_EVENT_TYPE_NOTIFY_SETMODE = 29,
189    ES_EVENT_TYPE_NOTIFY_SETOWNER = 30,
190    ES_EVENT_TYPE_NOTIFY_SIGNAL = 31,
191    ES_EVENT_TYPE_NOTIFY_UNLINK = 32,
192    ES_EVENT_TYPE_NOTIFY_WRITE = 33,
193    ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE = 34,
194    ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE = 35,
195    ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE = 36,
196    ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE = 37,
197    ES_EVENT_TYPE_AUTH_READLINK = 38,
198    ES_EVENT_TYPE_NOTIFY_READLINK = 39,
199    ES_EVENT_TYPE_AUTH_TRUNCATE = 40,
200    ES_EVENT_TYPE_NOTIFY_TRUNCATE = 41,
201    ES_EVENT_TYPE_AUTH_LINK = 42,
202    ES_EVENT_TYPE_NOTIFY_LOOKUP = 43,
203    ES_EVENT_TYPE_AUTH_CREATE = 44,
204    ES_EVENT_TYPE_AUTH_SETATTRLIST = 45,
205    ES_EVENT_TYPE_AUTH_SETEXTATTR = 46,
206    ES_EVENT_TYPE_AUTH_SETFLAGS = 47,
207    ES_EVENT_TYPE_AUTH_SETMODE = 48,
208    --
209    ES_EVENT_TYPE_AUTH_SETOWNER = 49,
210
211    == MACOS_10_15_1;
212    ES_EVENT_TYPE_AUTH_CHDIR = 50,
213    ES_EVENT_TYPE_NOTIFY_CHDIR = 51,
214    ES_EVENT_TYPE_AUTH_GETATTRLIST = 52,
215    ES_EVENT_TYPE_NOTIFY_GETATTRLIST = 53,
216    ES_EVENT_TYPE_NOTIFY_STAT = 54,
217    ES_EVENT_TYPE_NOTIFY_ACCESS = 55,
218    ES_EVENT_TYPE_AUTH_CHROOT = 56,
219    ES_EVENT_TYPE_NOTIFY_CHROOT = 57,
220    ES_EVENT_TYPE_AUTH_UTIMES = 58,
221    ES_EVENT_TYPE_NOTIFY_UTIMES = 59,
222    ES_EVENT_TYPE_AUTH_CLONE = 60,
223    ES_EVENT_TYPE_NOTIFY_CLONE = 61,
224    ES_EVENT_TYPE_NOTIFY_FCNTL = 62,
225    ES_EVENT_TYPE_AUTH_GETEXTATTR = 63,
226    ES_EVENT_TYPE_NOTIFY_GETEXTATTR = 64,
227    ES_EVENT_TYPE_AUTH_LISTEXTATTR = 65,
228    ES_EVENT_TYPE_NOTIFY_LISTEXTATTR = 66,
229    ES_EVENT_TYPE_AUTH_READDIR = 67,
230    ES_EVENT_TYPE_NOTIFY_READDIR = 68,
231    ES_EVENT_TYPE_AUTH_DELETEEXTATTR = 69,
232    ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR = 70,
233    ES_EVENT_TYPE_AUTH_FSGETPATH = 71,
234    ES_EVENT_TYPE_NOTIFY_FSGETPATH = 72,
235    ES_EVENT_TYPE_NOTIFY_DUP = 73,
236    ES_EVENT_TYPE_AUTH_SETTIME = 74,
237    ES_EVENT_TYPE_NOTIFY_SETTIME = 75,
238    ES_EVENT_TYPE_NOTIFY_UIPC_BIND = 76,
239    ES_EVENT_TYPE_AUTH_UIPC_BIND = 77,
240    ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT = 78,
241    ES_EVENT_TYPE_AUTH_UIPC_CONNECT = 79,
242    ES_EVENT_TYPE_AUTH_EXCHANGEDATA = 80,
243    ES_EVENT_TYPE_AUTH_SETACL = 81,
244    --
245    ES_EVENT_TYPE_NOTIFY_SETACL = 82,
246
247    == MACOS_10_15_4;
248    ES_EVENT_TYPE_NOTIFY_PTY_GRANT = 83,
249    ES_EVENT_TYPE_NOTIFY_PTY_CLOSE = 84,
250    ES_EVENT_TYPE_AUTH_PROC_CHECK = 85,
251    ES_EVENT_TYPE_NOTIFY_PROC_CHECK = 86,
252    --
253    ES_EVENT_TYPE_AUTH_GET_TASK = 87,
254
255    == MACOS_11_0_0;
256    ES_EVENT_TYPE_AUTH_SEARCHFS = 88,
257    ES_EVENT_TYPE_NOTIFY_SEARCHFS = 89,
258    ES_EVENT_TYPE_AUTH_FCNTL = 90,
259    ES_EVENT_TYPE_AUTH_IOKIT_OPEN = 91,
260    ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME = 92,
261    ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME = 93,
262    ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED = 94,
263    ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME = 95,
264    ES_EVENT_TYPE_NOTIFY_TRACE = 96,
265    ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE = 97,
266    ES_EVENT_TYPE_AUTH_REMOUNT = 98,
267    --
268    ES_EVENT_TYPE_NOTIFY_REMOUNT = 99,
269
270    == MACOS_11_3_0;
271    ES_EVENT_TYPE_AUTH_GET_TASK_READ = 100,
272    ES_EVENT_TYPE_NOTIFY_GET_TASK_READ = 101,
273    --
274    ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT = 102,
275
276    == MACOS_12_0_0;
277    ES_EVENT_TYPE_NOTIFY_SETUID = 103,
278    ES_EVENT_TYPE_NOTIFY_SETGID = 104,
279    ES_EVENT_TYPE_NOTIFY_SETEUID = 105,
280    ES_EVENT_TYPE_NOTIFY_SETEGID = 106,
281    ES_EVENT_TYPE_NOTIFY_SETREUID = 107,
282    ES_EVENT_TYPE_NOTIFY_SETREGID = 108,
283    ES_EVENT_TYPE_AUTH_COPYFILE = 109,
284    --
285    ES_EVENT_TYPE_NOTIFY_COPYFILE = 110,
286
287    == MACOS_13_0_0;
288    ES_EVENT_TYPE_NOTIFY_AUTHENTICATION = 111,
289    ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED = 112,
290    ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED = 113,
291    ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN = 114,
292    ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT = 115,
293    ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK = 116,
294    ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK = 117,
295    ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH = 118,
296    ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH = 119,
297    ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN = 120,
298    ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT = 121,
299    ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN = 122,
300    ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT = 123,
301    ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD = 124,
302    --
303    ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE = 125,
304
305    == MACOS_14_0_0;
306    ES_EVENT_TYPE_NOTIFY_PROFILE_ADD = 126,
307    ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE = 127,
308    ES_EVENT_TYPE_NOTIFY_SU = 128,
309    ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION = 129,
310    ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT = 130,
311    ES_EVENT_TYPE_NOTIFY_SUDO = 131,
312    ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD = 132,
313    ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE = 133,
314    ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET = 134,
315    ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD = 135,
316    ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER = 136,
317    ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER = 137,
318    ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD = 138,
319    ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE = 139,
320    ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET = 140,
321    ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER = 141,
322    ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP = 142,
323    ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER = 143,
324    ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP = 144,
325    --
326    ES_EVENT_TYPE_NOTIFY_XPC_CONNECT = 145,
327);
328
329ffi_wrap_enum!(
330    /// Valid authorization values to be used when responding to a
331    /// [`es_message_t`][super::es_message_t] auth event
332    es_auth_result_t(u32);
333
334    == MACOS_10_15_0;
335    /// The event is authorized and should be allowed to continue
336    ES_AUTH_RESULT_ALLOW = 0,
337    --
338    /// The event is not authorized and should be blocked
339    ES_AUTH_RESULT_DENY = 1,
340);
341
342ffi_wrap_enum!(
343    /// Valid authorization values to be used when responding to a
344    /// [`es_message_t`][super::es_message_t] auth event
345    es_result_type_t(u32);
346
347    == MACOS_10_15_0;
348    /// The event is authorized and should be allowed to continue
349    ES_RESULT_TYPE_AUTH = 0,
350    --
351    /// The event is not authorized and should be blocked
352    ES_RESULT_TYPE_FLAGS = 1,
353);
354
355ffi_wrap_enum!(
356    /// Return value for functions that can only fail in one way
357    es_return_t(u32);
358
359    == MACOS_10_15_0;
360    /// Function was successful
361    ES_RETURN_SUCCESS = 0,
362    --
363    /// Function failed
364    ES_RETURN_ERROR = 1,
365);
366
367ffi_wrap_enum!(
368    /// Error conditions for responding to a message
369    es_respond_result_t(u32);
370
371    == MACOS_10_15_0;
372    /// Success case
373    ES_RESPOND_RESULT_SUCCESS = 0,
374    /// One or more invalid arguments were provided
375    ES_RESPOND_RESULT_ERR_INVALID_ARGUMENT = 1,
376    /// Communication with the ES subsystem failed
377    ES_RESPOND_RESULT_ERR_INTERNAL = 2,
378    /// The message being responded to could not be found
379    ES_RESPOND_RESULT_NOT_FOUND = 3,
380    /// The provided message has been responded to more than once
381    ES_RESPOND_RESULT_ERR_DUPLICATE_RESPONSE = 4,
382    --
383    /// Either an inappropriate response API was used for the event type (ensure using proper
384    /// [`es_respond_auth_result`][super::es_respond_auth_result] or
385    /// [`es_respond_flags_result`][super::es_respond_flags_result] function) or the event is
386    /// notification only.
387    ES_RESPOND_RESULT_ERR_EVENT_TYPE = 5,
388);
389
390ffi_wrap_enum!(
391    /// Error conditions for creating a new client
392    es_new_client_result_t(u32);
393
394    == MACOS_10_15_0;
395    /// Success case
396    ES_NEW_CLIENT_RESULT_SUCCESS = 0,
397    /// One or more invalid arguments were provided.
398    ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT = 1,
399    /// Communication with the ES subsystem failed, or other error condition.
400    ES_NEW_CLIENT_RESULT_ERR_INTERNAL = 2,
401    /// The caller is not properly entitled to connect.
402    ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED = 3,
403    /// The caller lacks Transparency, Consent, and Control (TCC) approval from the user.
404    ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED = 4,
405    --
406    /// The caller is not running as root.
407    ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED = 5,
408
409    == MACOS_10_15_1;
410    --
411    /// The caller has reached the maximum number of allowed simultaneously connected clients.
412    ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS = 6,
413);
414
415ffi_wrap_enum!(
416    /// Error conditions for clearing the authorisation caches
417    es_clear_cache_result_t(u32);
418
419    == MACOS_10_15_0;
420    /// Success case
421    ES_CLEAR_CACHE_RESULT_SUCCESS = 0,
422    /// Communication with the ES subsystem failed
423    ES_CLEAR_CACHE_RESULT_ERR_INTERNAL = 1,
424    --
425    /// Rate of calls is too high. Slow down.
426    ES_CLEAR_CACHE_RESULT_ERR_THROTTLE = 2,
427);
428
429/// Structure buffer with size
430#[repr(C)]
431pub struct es_token_t {
432    /// Size of the `data` field, in bytes
433    pub size: size_t,
434    pub data: *const u8,
435}
436
437slice_access!(es_token_t[.data; .size]: fn as_slice() -> u8);
438
439/// Structure for handling strings
440#[repr(C)]
441pub struct es_string_token_t {
442    /// Size of the `data` field, equivalent to `strlen()`
443    pub length: size_t,
444    pub data: *const c_char,
445}
446
447impl es_string_token_t {
448    /// See the data as an [`OsStr`]
449    ///
450    /// # Safety
451    ///
452    /// `length` and `data` should be in sync. If `length` is not 0, `data` should be a non-null
453    /// pointer to initialized data of the correct number of bytes.
454    pub unsafe fn as_os_str(&self) -> &OsStr {
455        if self.length > 0 && self.data.is_null() == false {
456            // Safety: `data` is non-null and `length` is the non-zero number of elements (which is
457            // also the size in bytes in this case). Alignement is always correct since it's for a
458            // slice of `u8` (on macOS, `OsStr` are a bag of bytes)
459            let raw: &[u8] = unsafe { from_raw_parts(self.data.cast(), self.length) };
460            OsStr::from_bytes(raw)
461        } else {
462            OsStr::from_bytes(&[])
463        }
464    }
465
466    /// See the data as an [`OsStr`] if it's not empty or null.
467    ///
468    /// # Safety
469    ///
470    /// See [`Self::as_os_str()`].
471    #[inline]
472    pub unsafe fn as_opt_os_str(&self) -> Option<&OsStr> {
473        let s = self.as_os_str();
474        (s.is_empty() == false).then_some(s)
475    }
476}
477
478ffi_wrap_enum!(
479    /// Values that will be paired with path strings to describe the type of the path
480    es_mute_path_type_t(u32);
481
482    == MACOS_10_15_0;
483    /// Value to describe a path prefix
484    ES_MUTE_PATH_TYPE_PREFIX = 0,
485    --
486    /// Value to describe a path literal
487    ES_MUTE_PATH_TYPE_LITERAL = 1,
488
489    == MACOS_13_0_0;
490    /// Value to describe a target path prefix
491    ES_MUTE_PATH_TYPE_TARGET_PREFIX = 2,
492    --
493    /// Value to describe a target path literal
494    ES_MUTE_PATH_TYPE_TARGET_LITERAL = 3,
495);
496
497/// Structure to describe attributes of a muted path
498#[repr(C)]
499pub struct es_muted_path_t {
500    /// Indicates if the path is a prefix or literal, and what type of muting applies
501    pub type_: es_mute_path_type_t,
502    /// The number of events contained in the `events` array
503    pub event_count: size_t,
504    /// Array of event types for which the path is muted
505    pub events: *const es_event_type_t,
506    /// The muted path. (Note: `es_string_token_t` is a `char` array and length)
507    pub path: es_string_token_t,
508}
509
510slice_access!(es_muted_path_t[.events; .event_count]: fn events() -> es_event_type_t);
511
512/// Structure for a set of muted paths
513#[repr(C)]
514pub struct es_muted_paths_t {
515    /// Number of elements in the `paths` array
516    pub count: size_t,
517    /// Array of muted paths
518    pub paths: *const es_muted_path_t,
519}
520
521slice_access!(es_muted_paths_t[.paths; .count]: fn paths() -> es_muted_path_t);
522
523/// Structure to describe attributes of a muted process
524#[repr(C)]
525pub struct es_muted_process_t {
526    /// The audit token of a muted process
527    pub audit_token: audit_token_t,
528    /// The number of events contained in the `events` array
529    pub event_count: size_t,
530    /// Array of event types for which the process is muted
531    pub events: *const es_event_type_t,
532}
533
534slice_access!(es_muted_process_t[.events; .event_count]: fn events() -> es_event_type_t);
535
536/// Structure for a set of muted processes
537#[repr(C)]
538pub struct es_muted_processes_t {
539    /// Number of elements in the `processes` array
540    count: size_t,
541    /// Array of muted processes
542    processes: *const es_muted_process_t,
543}
544
545slice_access!(es_muted_processes_t[.processes; .count]: fn processes() -> es_muted_process_t);
546
547#[cfg(feature = "macos_13_0_0")]
548ffi_wrap_enum!(
549    /// Type of a network address.
550    es_address_type_t(u32);
551
552    == MACOS_13_0_0;
553    /// No source address available.
554    ES_ADDRESS_TYPE_NONE = 0,
555    /// Source address is IPv4.
556    ES_ADDRESS_TYPE_IPV4 = 1,
557    /// Source address is IPv6.
558    ES_ADDRESS_TYPE_IPV6 = 2,
559    --
560    /// Source address is named UNIX socket.
561    ES_ADDRESS_TYPE_NAMED_SOCKET = 3,
562);
563
564#[cfg(feature = "macos_13_0_0")]
565ffi_wrap_enum!(
566    es_mute_inversion_type_t(u32);
567    == MACOS_13_0_0;
568
569    ES_MUTE_INVERSION_TYPE_PROCESS = 0,
570    ES_MUTE_INVERSION_TYPE_PATH = 1,
571    ES_MUTE_INVERSION_TYPE_TARGET_PATH = 2,
572    --
573    ES_MUTE_INVERSION_TYPE_LAST = 4,
574);
575
576#[cfg(feature = "macos_13_0_0")]
577ffi_wrap_enum!(
578    /// Return type for mute inversion
579    es_mute_inverted_return_t(u32);
580
581    == MACOS_13_0_0;
582    /// The type of muted queried was inverted
583    ES_MUTE_INVERTED = 0,
584    /// The type of muted queried was not inverted
585    ES_MUTE_NOT_INVERTED = 1,
586    --
587    /// There was an error querying mute inversion state
588    ES_MUTE_INVERTED_ERROR = 2,
589);
590
591#[cfg(feature = "macos_14_0_0")]
592ffi_wrap_enum!(
593    /// The class of rules used to evaluate the petition for a specific authorization right
594    es_authorization_rule_class_t(u32);
595
596    == MACOS_14_0_0;
597    /// Right is judged on user properties
598    ES_AUTHORIZATION_RULE_CLASS_USER = 0,
599    /// Right is judged by a tree of sub-rules
600    ES_AUTHORIZATION_RULE_CLASS_RULE = 1,
601    /// Right is judged by one or more plugins
602    ES_AUTHORIZATION_RULE_CLASS_MECHANISM = 2,
603    /// Right is always granted
604    ES_AUTHORIZATION_RULE_CLASS_ALLOW = 3,
605    /// Right is always denied
606    ES_AUTHORIZATION_RULE_CLASS_DENY = 4,
607    /// Right is unknown
608    ES_AUTHORIZATION_RULE_CLASS_UNKNOWN = 5,
609    --
610    /// Right is invalid
611    ES_AUTHORIZATION_RULE_CLASS_INVALID = 6,
612);
613
614#[cfg(feature = "macos_14_0_0")]
615ffi_wrap_enum!(
616    /// Type of a group member, used in OpenDirectory (od) events
617    es_od_member_type_t(u32);
618
619    == MACOS_14_0_0;
620    /// Group member is a user, designated by name
621    ES_OD_MEMBER_TYPE_USER_NAME = 0,
622    /// Group member is a user, designated by UUID
623    ES_OD_MEMBER_TYPE_USER_UUID = 1,
624    --
625    /// Group member is another group, designated by UUID
626    ES_OD_MEMBER_TYPE_GROUP_UUID = 2,
627);
628
629#[cfg(feature = "macos_14_0_0")]
630ffi_wrap_enum!(
631    /// Type of an account, used in OpenDirectory (od) events
632    es_od_account_type_t(u32);
633
634    == MACOS_14_0_0;
635    ES_OD_ACCOUNT_TYPE_USER = 0,
636    --
637    ES_OD_ACCOUNT_TYPE_COMPUTER = 1,
638);
639
640#[cfg(feature = "macos_14_0_0")]
641ffi_wrap_enum!(
642    /// Type of a record, used in OpenDirectory (od) events
643    es_od_record_type_t(u32);
644
645    == MACOS_14_0_0;
646    ES_OD_RECORD_TYPE_USER = 0,
647    --
648    ES_OD_RECORD_TYPE_GROUP = 1,
649);
endpoint_sec_sys/types.rs

endpoint_sec_sys/
types.rs
