endpoint_sec_sys/
types.rs

1//! Corresponding header: `EndpointSecurity/ESTypes.h`
2
3// Types and methods should be added in the same order as they are in the original header to make
4// maintenance easier.
5
6use core::fmt;
7use core::hash::Hash;
8use core::slice::from_raw_parts;
9use std::ffi::OsStr;
10use std::os::unix::ffi::OsStrExt;
11
12pub use libc::{c_char, size_t};
13
14use super::audit_token_t;
15
16/// Unique ID for an event
17#[repr(C)]
18#[derive(Copy, Clone, PartialEq, Eq, Hash)]
19pub struct es_event_id_t {
20    _reserved: [u8; 32],
21}
22
23// Make the debug representation an hex string to make it shorter and clearer when debugging
24impl fmt::Debug for es_event_id_t {
25    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
26        f.debug_tuple("es_event_id_t").field(&format!("{self:#X}")).finish()
27    }
28}
29
30impl fmt::LowerHex for es_event_id_t {
31    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
32        for v in self._reserved {
33            fmt::LowerHex::fmt(&v, f)?;
34        }
35
36        Ok(())
37    }
38}
39
40impl fmt::UpperHex for es_event_id_t {
41    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
42        for v in self._reserved {
43            fmt::UpperHex::fmt(&v, f)?;
44        }
45
46        Ok(())
47    }
48}
49
50ffi_wrap_enum!(
51    /// Type of action to take after receiving a message
52    es_action_type_t(u32);
53
54    == MACOS_10_15_0;
55    /// Event needs a response before its deadline
56    ES_ACTION_TYPE_AUTH = 0,
57    --
58    /// Event needs no response, it is informative only
59    ES_ACTION_TYPE_NOTIFY = 1,
60);
61
62ffi_wrap_enum!(
63    /// Whether an ACL is being set or cleared
64    ///
65    /// See [`es_event_setacl_t`][super::es_event_setacl_t]
66    es_set_or_clear_t(u32);
67
68    == MACOS_10_15_0;
69    /// ACL is being set
70    ES_SET = 0,
71    --
72    /// ACL is being cleared
73    ES_CLEAR = 1,
74);
75
76ffi_wrap_enum!(
77    /// This enum describes the type of [`es_event_proc_check_t`][crate::es_event_proc_check_t]
78    /// events that are currently used.
79    ///
80    /// `ES_PROC_CHECK_TYPE_KERNMSGBUF`, `ES_PROC_CHECK_TYPE_TERMINATE` and
81    /// `ES_PROC_CHECK_TYPE_UDATA_INFO` are deprecated and no `proc_check` messages will be
82    /// generated for the corresponding `proc_info` call numbers.
83    ///
84    /// The terminate callnum is covered by the signal event.
85    es_proc_check_type_t(u32);
86
87    == MACOS_10_15_0;
88    ES_PROC_CHECK_TYPE_LISTPIDS = 0x1,
89    ES_PROC_CHECK_TYPE_PIDINFO = 0x2,
90    ES_PROC_CHECK_TYPE_PIDFDINFO = 0x3,
91    /// Deprecated, not generated anymore (since when ?)
92    ES_PROC_CHECK_TYPE_KERNMSGBUF = 0x4,
93    ES_PROC_CHECK_TYPE_SETCONTROL = 0x5,
94    ES_PROC_CHECK_TYPE_PIDFILEPORTINFO = 0x6,
95    /// Deprecated, not generated anymore (since when ?)
96    ES_PROC_CHECK_TYPE_TERMINATE = 0x7,
97    ES_PROC_CHECK_TYPE_DIRTYCONTROL = 0x8,
98    ES_PROC_CHECK_TYPE_PIDRUSAGE = 0x9,
99    --
100    /// Deprecated, not generated anymore (since when ?)
101    ES_PROC_CHECK_TYPE_UDATA_INFO = 0xe,
102);
103
104#[cfg(feature = "macos_14_0_0")]
105ffi_wrap_enum!(
106    /// This enum describes the types of XPC service domains.
107    es_xpc_domain_type_t(u32);
108
109    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
110    ES_XPC_DOMAIN_TYPE_SYSTEM = 1,
111    ES_XPC_DOMAIN_TYPE_USER = 2,
112    ES_XPC_DOMAIN_TYPE_USER_LOGIN = 3,
113    ES_XPC_DOMAIN_TYPE_SESSION = 4,
114    ES_XPC_DOMAIN_TYPE_PID = 5,
115    ES_XPC_DOMAIN_TYPE_MANAGER = 6,
116    ES_XPC_DOMAIN_TYPE_PORT = 7,
117    --
118    ES_XPC_DOMAIN_TYPE_GUI = 8,
119);
120
121#[cfg(feature = "macos_13_0_0")]
122ffi_wrap_enum!(
123    /// This enum describes the types of authentications that
124    /// [`ES_EVENT_TYPE_NOTIFY_AUTHENTICATION`][es_event_type_t] can describe.
125    es_authentication_type_t(u32);
126
127    == LAST;
128    // `ES_AUTHENTICATION_TYPE_LAST` is not a valid type of authentication but is a convenience
129    // value to operate on the range of defined authentication types.
130    ES_AUTHENTICATION_TYPE_LAST,
131
132    == #[cfg(feature = "macos_13_0_0")] 13_0_0 "13.0.0";
133    ES_AUTHENTICATION_TYPE_OD = 0,
134    ES_AUTHENTICATION_TYPE_TOUCHID = 1,
135    ES_AUTHENTICATION_TYPE_TOKEN = 2,
136    --
137    ES_AUTHENTICATION_TYPE_AUTO_UNLOCK = 3,
138);
139
140#[cfg(feature = "macos_14_0_0")]
141ffi_wrap_enum!(
142    /// Describes the type of plugin types in sudo.
143    es_sudo_plugin_type_t(u32);
144
145    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
146    ES_SUDO_PLUGIN_TYPE_UNKNOWN = 0,
147    ES_SUDO_PLUGIN_TYPE_FRONT_END = 1,
148    ES_SUDO_PLUGIN_TYPE_POLICY = 2,
149    ES_SUDO_PLUGIN_TYPE_IO = 3,
150    ES_SUDO_PLUGIN_TYPE_AUDIT = 4,
151    --
152    ES_SUDO_PLUGIN_TYPE_APPROVAL = 5,
153);
154
155ffi_wrap_enum!(
156    /// The valid event types recognized by Endpoint Security.
157    ///
158    /// When a program subscribes to and receives an `AUTH`-related event, it must respond with an
159    /// appropriate result indicating whether or not the operation should be allowed to continue.
160    ///
161    /// The valid API options are:
162    ///
163    ///  - [`es_respond_auth_result`][super::es_respond_auth_result]
164    ///  - [`es_respond_flags_result`][super::es_respond_flags_result]
165    ///
166    /// Currently, only [`Self::ES_EVENT_TYPE_AUTH_OPEN`] must use `es_respond_flags_result`. All
167    /// other `AUTH` events must use `es_respond_auth_result`.
168    es_event_type_t(u32);
169
170    == LAST;
171    ES_EVENT_TYPE_LAST,
172
173    == MACOS_10_15_0;
174    ES_EVENT_TYPE_AUTH_EXEC = 0,
175    ES_EVENT_TYPE_AUTH_OPEN = 1,
176    ES_EVENT_TYPE_AUTH_KEXTLOAD = 2,
177    ES_EVENT_TYPE_AUTH_MMAP = 3,
178    ES_EVENT_TYPE_AUTH_MPROTECT = 4,
179    ES_EVENT_TYPE_AUTH_MOUNT = 5,
180    ES_EVENT_TYPE_AUTH_RENAME = 6,
181    ES_EVENT_TYPE_AUTH_SIGNAL = 7,
182    ES_EVENT_TYPE_AUTH_UNLINK = 8,
183    ES_EVENT_TYPE_NOTIFY_EXEC = 9,
184    ES_EVENT_TYPE_NOTIFY_OPEN = 10,
185    ES_EVENT_TYPE_NOTIFY_FORK = 11,
186    ES_EVENT_TYPE_NOTIFY_CLOSE = 12,
187    ES_EVENT_TYPE_NOTIFY_CREATE = 13,
188    ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA = 14,
189    ES_EVENT_TYPE_NOTIFY_EXIT = 15,
190    ES_EVENT_TYPE_NOTIFY_GET_TASK = 16,
191    ES_EVENT_TYPE_NOTIFY_KEXTLOAD = 17,
192    ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD = 18,
193    ES_EVENT_TYPE_NOTIFY_LINK = 19,
194    ES_EVENT_TYPE_NOTIFY_MMAP = 20,
195    ES_EVENT_TYPE_NOTIFY_MPROTECT = 21,
196    ES_EVENT_TYPE_NOTIFY_MOUNT = 22,
197    ES_EVENT_TYPE_NOTIFY_UNMOUNT = 23,
198    ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN = 24,
199    ES_EVENT_TYPE_NOTIFY_RENAME = 25,
200    ES_EVENT_TYPE_NOTIFY_SETATTRLIST = 26,
201    ES_EVENT_TYPE_NOTIFY_SETEXTATTR = 27,
202    ES_EVENT_TYPE_NOTIFY_SETFLAGS = 28,
203    ES_EVENT_TYPE_NOTIFY_SETMODE = 29,
204    ES_EVENT_TYPE_NOTIFY_SETOWNER = 30,
205    ES_EVENT_TYPE_NOTIFY_SIGNAL = 31,
206    ES_EVENT_TYPE_NOTIFY_UNLINK = 32,
207    ES_EVENT_TYPE_NOTIFY_WRITE = 33,
208    ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE = 34,
209    ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE = 35,
210    ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE = 36,
211    ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE = 37,
212    ES_EVENT_TYPE_AUTH_READLINK = 38,
213    ES_EVENT_TYPE_NOTIFY_READLINK = 39,
214    ES_EVENT_TYPE_AUTH_TRUNCATE = 40,
215    ES_EVENT_TYPE_NOTIFY_TRUNCATE = 41,
216    ES_EVENT_TYPE_AUTH_LINK = 42,
217    ES_EVENT_TYPE_NOTIFY_LOOKUP = 43,
218    ES_EVENT_TYPE_AUTH_CREATE = 44,
219    ES_EVENT_TYPE_AUTH_SETATTRLIST = 45,
220    ES_EVENT_TYPE_AUTH_SETEXTATTR = 46,
221    ES_EVENT_TYPE_AUTH_SETFLAGS = 47,
222    ES_EVENT_TYPE_AUTH_SETMODE = 48,
223    --
224    ES_EVENT_TYPE_AUTH_SETOWNER = 49,
225
226    == #[cfg(feature = "macos_10_15_1")] 10_15_1 "10.15.1";
227    ES_EVENT_TYPE_AUTH_CHDIR = 50,
228    ES_EVENT_TYPE_NOTIFY_CHDIR = 51,
229    ES_EVENT_TYPE_AUTH_GETATTRLIST = 52,
230    ES_EVENT_TYPE_NOTIFY_GETATTRLIST = 53,
231    ES_EVENT_TYPE_NOTIFY_STAT = 54,
232    ES_EVENT_TYPE_NOTIFY_ACCESS = 55,
233    ES_EVENT_TYPE_AUTH_CHROOT = 56,
234    ES_EVENT_TYPE_NOTIFY_CHROOT = 57,
235    ES_EVENT_TYPE_AUTH_UTIMES = 58,
236    ES_EVENT_TYPE_NOTIFY_UTIMES = 59,
237    ES_EVENT_TYPE_AUTH_CLONE = 60,
238    ES_EVENT_TYPE_NOTIFY_CLONE = 61,
239    ES_EVENT_TYPE_NOTIFY_FCNTL = 62,
240    ES_EVENT_TYPE_AUTH_GETEXTATTR = 63,
241    ES_EVENT_TYPE_NOTIFY_GETEXTATTR = 64,
242    ES_EVENT_TYPE_AUTH_LISTEXTATTR = 65,
243    ES_EVENT_TYPE_NOTIFY_LISTEXTATTR = 66,
244    ES_EVENT_TYPE_AUTH_READDIR = 67,
245    ES_EVENT_TYPE_NOTIFY_READDIR = 68,
246    ES_EVENT_TYPE_AUTH_DELETEEXTATTR = 69,
247    ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR = 70,
248    ES_EVENT_TYPE_AUTH_FSGETPATH = 71,
249    ES_EVENT_TYPE_NOTIFY_FSGETPATH = 72,
250    ES_EVENT_TYPE_NOTIFY_DUP = 73,
251    ES_EVENT_TYPE_AUTH_SETTIME = 74,
252    ES_EVENT_TYPE_NOTIFY_SETTIME = 75,
253    ES_EVENT_TYPE_NOTIFY_UIPC_BIND = 76,
254    ES_EVENT_TYPE_AUTH_UIPC_BIND = 77,
255    ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT = 78,
256    ES_EVENT_TYPE_AUTH_UIPC_CONNECT = 79,
257    ES_EVENT_TYPE_AUTH_EXCHANGEDATA = 80,
258    ES_EVENT_TYPE_AUTH_SETACL = 81,
259    --
260    ES_EVENT_TYPE_NOTIFY_SETACL = 82,
261
262    == #[cfg(feature = "macos_10_15_4")] 10_15_4 "10.15.4";
263    ES_EVENT_TYPE_NOTIFY_PTY_GRANT = 83,
264    ES_EVENT_TYPE_NOTIFY_PTY_CLOSE = 84,
265    ES_EVENT_TYPE_AUTH_PROC_CHECK = 85,
266    ES_EVENT_TYPE_NOTIFY_PROC_CHECK = 86,
267    --
268    ES_EVENT_TYPE_AUTH_GET_TASK = 87,
269
270    == #[cfg(feature = "macos_11_0_0")] 11_0_0 "11.0.0";
271    ES_EVENT_TYPE_AUTH_SEARCHFS = 88,
272    ES_EVENT_TYPE_NOTIFY_SEARCHFS = 89,
273    ES_EVENT_TYPE_AUTH_FCNTL = 90,
274    ES_EVENT_TYPE_AUTH_IOKIT_OPEN = 91,
275    ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME = 92,
276    ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME = 93,
277    ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED = 94,
278    ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME = 95,
279    ES_EVENT_TYPE_NOTIFY_TRACE = 96,
280    ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE = 97,
281    ES_EVENT_TYPE_AUTH_REMOUNT = 98,
282    --
283    ES_EVENT_TYPE_NOTIFY_REMOUNT = 99,
284
285    == #[cfg(feature = "macos_11_3_0")] 11_3_0 "11.3.0";
286    ES_EVENT_TYPE_AUTH_GET_TASK_READ = 100,
287    ES_EVENT_TYPE_NOTIFY_GET_TASK_READ = 101,
288    --
289    ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT = 102,
290
291    == #[cfg(feature = "macos_12_0_0")] 12_0_0 "12.0.0";
292    ES_EVENT_TYPE_NOTIFY_SETUID = 103,
293    ES_EVENT_TYPE_NOTIFY_SETGID = 104,
294    ES_EVENT_TYPE_NOTIFY_SETEUID = 105,
295    ES_EVENT_TYPE_NOTIFY_SETEGID = 106,
296    ES_EVENT_TYPE_NOTIFY_SETREUID = 107,
297    ES_EVENT_TYPE_NOTIFY_SETREGID = 108,
298    ES_EVENT_TYPE_AUTH_COPYFILE = 109,
299    --
300    ES_EVENT_TYPE_NOTIFY_COPYFILE = 110,
301
302    == #[cfg(feature = "macos_13_0_0")] 13_0_0 "13.0.0";
303    ES_EVENT_TYPE_NOTIFY_AUTHENTICATION = 111,
304    ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED = 112,
305    ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED = 113,
306    ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN = 114,
307    ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT = 115,
308    ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK = 116,
309    ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK = 117,
310    ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH = 118,
311    ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH = 119,
312    ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN = 120,
313    ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT = 121,
314    ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN = 122,
315    ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT = 123,
316    ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD = 124,
317    --
318    ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE = 125,
319
320    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
321    ES_EVENT_TYPE_NOTIFY_PROFILE_ADD = 126,
322    ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE = 127,
323    ES_EVENT_TYPE_NOTIFY_SU = 128,
324    ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION = 129,
325    ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT = 130,
326    ES_EVENT_TYPE_NOTIFY_SUDO = 131,
327    ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD = 132,
328    ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE = 133,
329    ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET = 134,
330    ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD = 135,
331    ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER = 136,
332    ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER = 137,
333    ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD = 138,
334    ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE = 139,
335    ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET = 140,
336    ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER = 141,
337    ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP = 142,
338    ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER = 143,
339    ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP = 144,
340    --
341    ES_EVENT_TYPE_NOTIFY_XPC_CONNECT = 145,
342
343    == #[cfg(feature = "macos_15_0_0")] 15_0_0 "15.0.0";
344    --
345    ES_EVENT_TYPE_NOTIFY_GATEKEEPER_USER_OVERRIDE = 146,
346
347    == #[cfg(feature = "macos_15_4_0")] 15_4_0 "15.4.0";
348    --
349    ES_EVENT_TYPE_NOTIFY_TCC_MODIFY = 147,
350);
351
352ffi_wrap_enum!(
353    /// Valid authorization values to be used when responding to a
354    /// [`es_message_t`][super::es_message_t] auth event
355    es_auth_result_t(u32);
356
357    == MACOS_10_15_0;
358    /// The event is authorized and should be allowed to continue
359    ES_AUTH_RESULT_ALLOW = 0,
360    --
361    /// The event is not authorized and should be blocked
362    ES_AUTH_RESULT_DENY = 1,
363);
364
365ffi_wrap_enum!(
366    /// Valid authorization values to be used when responding to a
367    /// [`es_message_t`][super::es_message_t] auth event
368    es_result_type_t(u32);
369
370    == MACOS_10_15_0;
371    /// The event is authorized and should be allowed to continue
372    ES_RESULT_TYPE_AUTH = 0,
373    --
374    /// The event is not authorized and should be blocked
375    ES_RESULT_TYPE_FLAGS = 1,
376);
377
378ffi_wrap_enum!(
379    /// Return value for functions that can only fail in one way
380    es_return_t(u32);
381
382    == MACOS_10_15_0;
383    /// Function was successful
384    ES_RETURN_SUCCESS = 0,
385    --
386    /// Function failed
387    ES_RETURN_ERROR = 1,
388);
389
390ffi_wrap_enum!(
391    /// Error conditions for responding to a message
392    es_respond_result_t(u32);
393
394    == MACOS_10_15_0;
395    /// Success case
396    ES_RESPOND_RESULT_SUCCESS = 0,
397    /// One or more invalid arguments were provided
398    ES_RESPOND_RESULT_ERR_INVALID_ARGUMENT = 1,
399    /// Communication with the ES subsystem failed
400    ES_RESPOND_RESULT_ERR_INTERNAL = 2,
401    /// The message being responded to could not be found
402    ES_RESPOND_RESULT_NOT_FOUND = 3,
403    /// The provided message has been responded to more than once
404    ES_RESPOND_RESULT_ERR_DUPLICATE_RESPONSE = 4,
405    --
406    /// Either an inappropriate response API was used for the event type (ensure using proper
407    /// [`es_respond_auth_result`][super::es_respond_auth_result] or
408    /// [`es_respond_flags_result`][super::es_respond_flags_result] function) or the event is
409    /// notification only.
410    ES_RESPOND_RESULT_ERR_EVENT_TYPE = 5,
411);
412
413ffi_wrap_enum!(
414    /// Error conditions for creating a new client
415    es_new_client_result_t(u32);
416
417    == MACOS_10_15_0;
418    /// Success case
419    ES_NEW_CLIENT_RESULT_SUCCESS = 0,
420    /// One or more invalid arguments were provided.
421    ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT = 1,
422    /// Communication with the ES subsystem failed, or other error condition.
423    ES_NEW_CLIENT_RESULT_ERR_INTERNAL = 2,
424    /// The caller is not properly entitled to connect.
425    ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED = 3,
426    /// The caller lacks Transparency, Consent, and Control (TCC) approval from the user.
427    ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED = 4,
428    --
429    /// The caller is not running as root.
430    ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED = 5,
431
432    == #[cfg(feature = "macos_10_15_1")] 10_15_1 "10.15.1";
433    --
434    /// The caller has reached the maximum number of allowed simultaneously connected clients.
435    ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS = 6,
436);
437
438ffi_wrap_enum!(
439    /// Error conditions for clearing the authorisation caches
440    es_clear_cache_result_t(u32);
441
442    == MACOS_10_15_0;
443    /// Success case
444    ES_CLEAR_CACHE_RESULT_SUCCESS = 0,
445    /// Communication with the ES subsystem failed
446    ES_CLEAR_CACHE_RESULT_ERR_INTERNAL = 1,
447    --
448    /// Rate of calls is too high. Slow down.
449    ES_CLEAR_CACHE_RESULT_ERR_THROTTLE = 2,
450);
451
452/// Binary CDHash
453///
454/// The Code Directory Hash (CDHash) is a hash of hashes, covering a macho or
455/// an entire application bundle.
456/// The Code Directory contains the hash of each executable page in the main
457/// executable. Only when:
458///
459/// - The subject process has opted into the hardened runtime (CS_HARD/CS_KILL)
460///   - The subject process is not being debugged
461/// - The subject process is running
462///
463/// It is guaranteed that the ES provided cdhash value matches the binary
464/// observed by the kernel and that the pages actually executed have not been
465/// modified.
466pub type es_cdhash_t = [u8; 20];
467
468/// Binary Sha256 Digest
469pub type es_sha256_t = [u8; 32];
470
471/// Structure buffer with size
472#[repr(C)]
473pub struct es_token_t {
474    /// Size of the `data` field, in bytes
475    pub size: size_t,
476    pub data: *const u8,
477}
478
479slice_access!(es_token_t[.data; .size]: fn as_slice() -> u8);
480
481/// Structure for handling strings
482#[repr(C)]
483pub struct es_string_token_t {
484    /// Size of the `data` field, equivalent to `strlen()`
485    pub length: size_t,
486    pub data: *const c_char,
487}
488
489impl es_string_token_t {
490    /// See the data as an [`OsStr`]
491    ///
492    /// # Safety
493    ///
494    /// `length` and `data` should be in sync. If `length` is not 0, `data` should be a non-null
495    /// pointer to initialized data of the correct number of bytes.
496    pub unsafe fn as_os_str(&self) -> &OsStr {
497        if self.length > 0 && self.data.is_null() == false {
498            // Safety: `data` is non-null and `length` is the non-zero number of elements (which is
499            // also the size in bytes in this case). Alignement is always correct since it's for a
500            // slice of `u8` (on macOS, `OsStr` are a bag of bytes)
501            let raw: &[u8] = unsafe { from_raw_parts(self.data.cast(), self.length) };
502            OsStr::from_bytes(raw)
503        } else {
504            OsStr::from_bytes(&[])
505        }
506    }
507
508    /// See the data as an [`OsStr`] if it's not empty or null.
509    ///
510    /// # Safety
511    ///
512    /// See [`Self::as_os_str()`].
513    #[inline]
514    pub unsafe fn as_opt_os_str(&self) -> Option<&OsStr> {
515        // SAFETY: upheld by the caller.
516        let s = unsafe { self.as_os_str() };
517        (s.is_empty() == false).then_some(s)
518    }
519}
520
521ffi_wrap_enum!(
522    /// Values that will be paired with path strings to describe the type of the path
523    es_mute_path_type_t(u32);
524
525    == MACOS_10_15_0;
526    /// Value to describe a path prefix
527    ES_MUTE_PATH_TYPE_PREFIX = 0,
528    --
529    /// Value to describe a path literal
530    ES_MUTE_PATH_TYPE_LITERAL = 1,
531
532    == #[cfg(feature = "macos_13_0_0")] 13_0_0 "13.0.0";
533    /// Value to describe a target path prefix
534    ES_MUTE_PATH_TYPE_TARGET_PREFIX = 2,
535    --
536    /// Value to describe a target path literal
537    ES_MUTE_PATH_TYPE_TARGET_LITERAL = 3,
538);
539
540/// Structure to describe attributes of a muted path
541#[repr(C)]
542pub struct es_muted_path_t {
543    /// Indicates if the path is a prefix or literal, and what type of muting applies
544    pub type_: es_mute_path_type_t,
545    /// The number of events contained in the `events` array
546    pub event_count: size_t,
547    /// Array of event types for which the path is muted
548    pub events: *const es_event_type_t,
549    /// The muted path. (Note: `es_string_token_t` is a `char` array and length)
550    pub path: es_string_token_t,
551}
552
553slice_access!(es_muted_path_t[.events; .event_count]: fn events() -> es_event_type_t);
554
555/// Structure for a set of muted paths
556#[repr(C)]
557pub struct es_muted_paths_t {
558    /// Number of elements in the `paths` array
559    pub count: size_t,
560    /// Array of muted paths
561    pub paths: *const es_muted_path_t,
562}
563
564slice_access!(es_muted_paths_t[.paths; .count]: fn paths() -> es_muted_path_t);
565
566/// Structure to describe attributes of a muted process
567#[repr(C)]
568pub struct es_muted_process_t {
569    /// The audit token of a muted process
570    pub audit_token: audit_token_t,
571    /// The number of events contained in the `events` array
572    pub event_count: size_t,
573    /// Array of event types for which the process is muted
574    pub events: *const es_event_type_t,
575}
576
577slice_access!(es_muted_process_t[.events; .event_count]: fn events() -> es_event_type_t);
578
579/// Structure for a set of muted processes
580#[repr(C)]
581pub struct es_muted_processes_t {
582    /// Number of elements in the `processes` array
583    count: size_t,
584    /// Array of muted processes
585    processes: *const es_muted_process_t,
586}
587
588slice_access!(es_muted_processes_t[.processes; .count]: fn processes() -> es_muted_process_t);
589
590#[cfg(feature = "macos_13_0_0")]
591ffi_wrap_enum!(
592    /// Type of a network address.
593    es_address_type_t(u32);
594
595    == #[cfg(feature = "macos_13_0_0")] 13_0_0 "13.0.0";
596    /// No source address available.
597    ES_ADDRESS_TYPE_NONE = 0,
598    /// Source address is IPv4.
599    ES_ADDRESS_TYPE_IPV4 = 1,
600    /// Source address is IPv6.
601    ES_ADDRESS_TYPE_IPV6 = 2,
602    --
603    /// Source address is named UNIX socket.
604    ES_ADDRESS_TYPE_NAMED_SOCKET = 3,
605);
606
607#[cfg(feature = "macos_13_0_0")]
608ffi_wrap_enum!(
609    es_mute_inversion_type_t(u32);
610
611    == #[cfg(feature = "macos_13_0_0")] 13_0_0 "13.0.0";
612    ES_MUTE_INVERSION_TYPE_PROCESS = 0,
613    ES_MUTE_INVERSION_TYPE_PATH = 1,
614    ES_MUTE_INVERSION_TYPE_TARGET_PATH = 2,
615    --
616    ES_MUTE_INVERSION_TYPE_LAST = 4,
617);
618
619#[cfg(feature = "macos_13_0_0")]
620ffi_wrap_enum!(
621    /// Return type for mute inversion
622    es_mute_inverted_return_t(u32);
623
624    == #[cfg(feature = "macos_13_0_0")] 13_0_0 "13.0.0";
625    /// The type of muted queried was inverted
626    ES_MUTE_INVERTED = 0,
627    /// The type of muted queried was not inverted
628    ES_MUTE_NOT_INVERTED = 1,
629    --
630    /// There was an error querying mute inversion state
631    ES_MUTE_INVERTED_ERROR = 2,
632);
633
634#[cfg(feature = "macos_14_0_0")]
635ffi_wrap_enum!(
636    /// The class of rules used to evaluate the petition for a specific authorization right
637    es_authorization_rule_class_t(u32);
638
639    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
640    /// Right is judged on user properties
641    ES_AUTHORIZATION_RULE_CLASS_USER = 0,
642    /// Right is judged by a tree of sub-rules
643    ES_AUTHORIZATION_RULE_CLASS_RULE = 1,
644    /// Right is judged by one or more plugins
645    ES_AUTHORIZATION_RULE_CLASS_MECHANISM = 2,
646    /// Right is always granted
647    ES_AUTHORIZATION_RULE_CLASS_ALLOW = 3,
648    /// Right is always denied
649    ES_AUTHORIZATION_RULE_CLASS_DENY = 4,
650    /// Right is unknown
651    ES_AUTHORIZATION_RULE_CLASS_UNKNOWN = 5,
652    --
653    /// Right is invalid
654    ES_AUTHORIZATION_RULE_CLASS_INVALID = 6,
655);
656
657#[cfg(feature = "macos_14_0_0")]
658ffi_wrap_enum!(
659    /// Type of a group member, used in OpenDirectory (od) events
660    es_od_member_type_t(u32);
661
662    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
663    /// Group member is a user, designated by name
664    ES_OD_MEMBER_TYPE_USER_NAME = 0,
665    /// Group member is a user, designated by UUID
666    ES_OD_MEMBER_TYPE_USER_UUID = 1,
667    --
668    /// Group member is another group, designated by UUID
669    ES_OD_MEMBER_TYPE_GROUP_UUID = 2,
670);
671
672#[cfg(feature = "macos_14_0_0")]
673ffi_wrap_enum!(
674    /// Type of an account, used in OpenDirectory (od) events
675    es_od_account_type_t(u32);
676
677    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
678    ES_OD_ACCOUNT_TYPE_USER = 0,
679    --
680    ES_OD_ACCOUNT_TYPE_COMPUTER = 1,
681);
682
683#[cfg(feature = "macos_14_0_0")]
684ffi_wrap_enum!(
685    /// Type of a record, used in OpenDirectory (od) events
686    es_od_record_type_t(u32);
687
688    == #[cfg(feature = "macos_14_0_0")] 14_0_0 "14.0.0";
689    ES_OD_RECORD_TYPE_USER = 0,
690    --
691    ES_OD_RECORD_TYPE_GROUP = 1,
692);
693
694#[cfg(feature = "macos_15_0_0")]
695ffi_wrap_enum!(
696    es_gatekeeper_user_override_file_type_t(u32);
697
698    == #[cfg(feature = "macos_15_0_0")] 15_0_0 "15.0.0";
699    /// Signals that file is a string of a path since file could not be resolved
700    /// on disk at time of event submission
701    ES_GATEKEEPER_USER_OVERRIDE_FILE_TYPE_PATH = 0,
702    --
703    /// Signals that file is a es_file_t
704    ES_GATEKEEPER_USER_OVERRIDE_FILE_TYPE_FILE = 1,
705);
706
707/// Information from a signed file.
708///
709/// If the file is a multiarchitecture binary, only the information for the
710/// native host architecture is reported. I.e. the CDHash from the AArch64 slice
711/// if the host is AArch64.
712#[cfg(feature = "macos_15_0_0")]
713#[repr(C)]
714pub struct es_signed_file_info_t {
715    /// Code Directory Hash
716    pub cdhash: es_cdhash_t,
717    /// Signing Identifier, if available in the signing information.
718    pub signing_id: es_string_token_t,
719    /// Team Identifier, if available in the signing information.
720    pub team_id: es_string_token_t,
721}
722
723#[cfg(feature = "macos_15_4_0")]
724ffi_wrap_enum!(
725    /// Represents the type of TCC modification event.
726    es_tcc_event_type_t(u32);
727
728    == #[cfg(feature = "macos_15_4_0")] 15_4_0 "15.4.0";
729    /// Unknown prior state.
730    ES_TCC_EVENT_TYPE_UNKNOWN = 0,
731    /// A new TCC authorization record was created.
732    ES_TCC_EVENT_TYPE_CREATE = 1,
733    /// An existing TCC authorization record was modified.
734    ES_TCC_EVENT_TYPE_MODIFY = 2,
735    --
736    /// An existing TCC authorization record was deleted.
737    ES_TCC_EVENT_TYPE_DELETE = 3,
738);
739
740#[cfg(feature = "macos_15_4_0")]
741ffi_wrap_enum!(
742    /// Represents the type of authorization permission an application has to a
743    /// TCC Service.
744     es_tcc_authorization_right_t(u32);
745
746    == #[cfg(feature = "macos_15_4_0")] 15_4_0 "15.4.0";
747    ES_TCC_AUTHORIZATION_RIGHT_DENIED = 0,
748    ES_TCC_AUTHORIZATION_RIGHT_UNKNOWN = 1,
749    ES_TCC_AUTHORIZATION_RIGHT_ALLOWED = 2,
750    ES_TCC_AUTHORIZATION_RIGHT_LIMITED = 3,
751    ES_TCC_AUTHORIZATION_RIGHT_ADD_MODIFY_ADDED = 4,
752    ES_TCC_AUTHORIZATION_RIGHT_SESSION_PID = 5,
753    --
754    ES_TCC_AUTHORIZATION_RIGHT_LEARN_MORE = 6,
755);
756
757#[cfg(feature = "macos_15_4_0")]
758ffi_wrap_enum!(
759    /// Represents the reason a TCC permission was updated.
760    es_tcc_authorization_reason_t(u32);
761
762    == #[cfg(feature = "macos_15_4_0")] 15_4_0 "15.4.0";
763    ES_TCC_AUTHORIZATION_REASON_NONE = 0,
764    ES_TCC_AUTHORIZATION_REASON_ERROR = 1,
765    /// User answered a prompt
766    ES_TCC_AUTHORIZATION_REASON_USER_CONSENT = 2,
767    /// User changed the authorization right via Preferences
768    ES_TCC_AUTHORIZATION_REASON_USER_SET = 3,
769    /// A system process changed the authorization right
770    ES_TCC_AUTHORIZATION_REASON_SYSTEM_SET = 4,
771    ES_TCC_AUTHORIZATION_REASON_SERVICE_POLICY = 5,
772    ES_TCC_AUTHORIZATION_REASON_MDM_POLICY = 6,
773    ES_TCC_AUTHORIZATION_REASON_SERVICE_OVERRIDE_POLICY = 7,
774    ES_TCC_AUTHORIZATION_REASON_MISSING_USAGE_STRING = 8,
775    ES_TCC_AUTHORIZATION_REASON_PROMPT_TIMEOUT = 9,
776    ES_TCC_AUTHORIZATION_REASON_PREFLIGHT_UNKNOWN = 10,
777    ES_TCC_AUTHORIZATION_REASON_ENTITLED = 11,
778    ES_TCC_AUTHORIZATION_REASON_APP_TYPE_POLICY = 12,
779    --
780    ES_TCC_AUTHORIZATION_REASON_PROMPT_CANCEL = 13,
781);
782
783#[cfg(feature = "macos_15_4_0")]
784ffi_wrap_enum!(
785    /// Represents the identity type of an application which has access to a TCC
786    /// service.
787    es_tcc_identity_type_t(u32);
788
789    == #[cfg(feature = "macos_15_4_0")] 15_4_0 "15.4.0";
790    ES_TCC_IDENTITY_TYPE_BUNDLE_ID = 0,
791    ES_TCC_IDENTITY_TYPE_EXECUTABLE_PATH = 1,
792    ES_TCC_IDENTITY_TYPE_POLICY_ID = 2,
793    --
794    ES_TCC_IDENTITY_TYPE_FILE_PROVIDER_DOMAIN_ID = 3,
795);
endpoint_sec_sys/types.rs

endpoint_sec_sys/
types.rs
