#include <sys/kauth.h>
sys/kauth.h
NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
support for mandatory and extensible security protections. This notice
is included in support of clause 2.2 (b) of the Apple Public License,
Version 2.0.
functionkauth_cred_ref
extern void kauth_cred_ref(kauth_cred_t cred)
@brief Retains a credential data structure.
@Description
The reference returned must be released with @c kauth_cred_unref().
functionkauth_cred_unref
extern void kauth_cred_unref(kauth_cred_t *credp)
functionkauth_cred_get
__pure2 extern kauth_cred_t kauth_cred_get(void)
@brief Returns the current thread assumed credentials.
@discussion These might differ from the proc's credential if settid() has been called.
This never returns NULL/NOCRED.
This function doesn't take a reference, and the returned pointer is valid
for the duration of the current syscall.
This function returns cached credentials without a reference which are valid
for the duration of a MACF hook. If a copy of this pointer has to be stashed,
the credentials must be retained with kauth_cred_ref().
(this function should really be called @c current_thread_cred())
macrocurrent_thread_cred
#define current_thread_cred() kauth_cred_get()
functioncurrent_thread_cred_label_get
__pure2 extern intptr_t current_thread_cred_label_get(int slot)
@brief Returns the current MAC label slot value for the thread assumed credentials.
@discussion These might differ from the proc's credential if settid() has been called.
functionkauth_cred_get_with_ref
extern kauth_cred_t kauth_cred_get_with_ref(void)
@brief Returns the current thread assumed credentials, with a reference.
@discussion These might differ from the proc's credential if settid() has been called.
This never returns NULL/NOCRED.
The caller must call kauth_cred_unref() to dispose of the returned value.
This is equivalent to @c kauth_cred_ref(kauth_cred_get())
(this function should really be called @c current_thread_cred_ref())
macrocurrent_thread_cred_ref
#define current_thread_cred_ref() kauth_cred_get_with_ref()
functioncurrent_cached_proc_cred
__pure2 extern kauth_cred_t current_cached_proc_cred(proc_t)
@brief Returns the current cached proc credentials.
@discussion This function will panic if its argument is neither PROC_NULL nor
current_proc() (this can be used to protect against programming mistakes
assuming the incorrect context).
Note that this function returns the credential the proc had
at the time of the last syscall this thread performed.
This function returns cached credentials without a reference which are valid
for the duration of a syscall only. If a copy of this pointer has to be
stashed, the credentials must be retained with kauth_cred_ref().
For the freshest credentials, kauth_cred_proc_ref()
must be used against @c current_proc().
This never returns NULL/NOCRED.
functioncurrent_cached_proc_label_get
__pure2 extern intptr_t current_cached_proc_label_get(int slot)
@brief Returns the current MAC label slot value for the cached proc credentials.
functioncurrent_cached_proc_cred_ref
extern kauth_cred_t current_cached_proc_cred_ref(proc_t)
@brief Returns the current cached proc credentials, with a reference.
@discussion This function will panic if its argument is neither PROC_NULL nor
current_proc() (this can be used to protect against programming mistakes
assuming the incorrect context).
Note that this function returns the credential the proc had
at the time of the last syscall this thread performed.
For the freshest credentials, kauth_cred_proc_ref()
must be used against @c current_proc().
The caller must call kauth_cred_unref() to dispose of the returned value.
This never returns NULL/NOCRED.
functionkauth_cred_proc_ref
extern kauth_cred_t kauth_cred_proc_ref(proc_t procp)
@brief Returns the specified proc credentials, with a reference.
@discussion The caller must call kauth_cred_unref() to dispose of the returned value.
This never returns NULL/NOCRED.
The caller must call kauth_cred_unref() to dispose of the returned value.
functionkauth_cred_proc_ref_for_pid
extern kauth_cred_t kauth_cred_proc_ref_for_pid(pid_t pid)
@brief Returns the specified proc credentials, with a reference, or NOCRED.
@discussion The caller must call kauth_cred_unref() to dispose of the returned value.
functionkauth_cred_proc_ref_for_pidversion
extern kauth_cred_t kauth_cred_proc_ref_for_pidversion(pid_t pid, uint32_t version)
@brief Returns the specified proc credentials, with a reference, or NOCRED.
@discussion The caller must call kauth_cred_unref() to dispose of the returned value.
functionkauth_cred_create
extern kauth_cred_t kauth_cred_create(kauth_cred_t cred)
@brief Obsolete way to create a valid posix-only credential structure out of
a model, DO NOT USE.
functionkauth_cred_getuid
extern uid_t kauth_cred_getuid(kauth_cred_t _cred)
@brief Returns the effective user ID for the specified @c kauth_cred_t.
functionkauth_cred_getruid
extern uid_t kauth_cred_getruid(kauth_cred_t _cred)
@brief Returns the real user ID for the specified @c kauth_cred_t.
functionkauth_cred_getsvuid
extern uid_t kauth_cred_getsvuid(kauth_cred_t _cred)
@brief Returns the saved user ID for the specified @c kauth_cred_t.
functionkauth_cred_issuser
extern int kauth_cred_issuser(kauth_cred_t _cred)
@brief Returns whether the current credential effective user ID is the super user.
functionkauth_cred_getgid
extern gid_t kauth_cred_getgid(kauth_cred_t _cred)
@brief Returns the effective group ID for the specified @c kauth_cred_t.
functionkauth_cred_getrgid
extern gid_t kauth_cred_getrgid(kauth_cred_t _cred)
@brief Returns the real group ID for the specified @c kauth_cred_t.
functionkauth_cred_getsvgid
extern gid_t kauth_cred_getsvgid(kauth_cred_t _cred)
@brief Returns the saved group ID for the specified @c kauth_cred_t.
functionkauth_getuid
extern uid_t kauth_getuid(void)
@brief Returns the effective user ID for the current thread.
@Description
Equivalent to @c kauth_getuid(kauth_cred_get())
functionkauth_getruid
extern uid_t kauth_getruid(void)
@brief Returns the real user ID for the current thread.
@Description
Equivalent to @c kauth_getruid(kauth_cred_get())
functionkauth_getgid
extern gid_t kauth_getgid(void)
@brief Returns the effective group ID for the current thread.
@Description
Equivalent to @c kauth_getgid(kauth_cred_get())
functionkauth_getrgid
extern gid_t kauth_getrgid(void)
@brief Returns the real group ID for the current thread.
@Description
Equivalent to @c kauth_getrgid(kauth_cred_get())
functionkauth_cred_label_update
extern kauth_cred_t kauth_cred_label_update(kauth_cred_t cred, struct label *label)
@brief Updates the MAC label associated with a credential.
@discussion This function returns a new credential where the passed
in label is updated with the specified one.
This will cause the @c cred_label_associate() MAC hook to be invoked
first (so that all MAC policies have a chance to make the newly formed
credential inherit labels) then the @c cred_label_update() hook
(which will allow the newly made credential labels to be overridden).
This never returns NULL/NOCRED.
@param cred (ref consumed) the credentials to use as a model.
@param label the model label to copy from.
functionkauth_proc_label_update
extern int kauth_proc_label_update(struct proc *proc, struct label *label)
@brief Updates the MAC label insde the proc's credentials.
@discussion This function applies @c kauth_cred_label_update() to the specified
process's credntials, and updates the process's credentials
with the outcome.
This function never fails (returns 0 all the time).
@param proc the process which creedntials must be updated.
@param label the model label to copy from.
functionkauth_cred_pwnam2guid
extern int kauth_cred_pwnam2guid(char *pwnam, guid_t *guidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a user name of the form user@domain to the corresponding GUID, consulting the kauth identity cache and, on a miss, the user-space identity resolver. pwnam must be a NUL-terminated string no larger than MAXPATHLEN bytes; on success the GUID is stored in *guidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver (ENOENT if the identity cannot be translated, EWOULDBLOCK, EINTR).
functionkauth_cred_grnam2guid
extern int kauth_cred_grnam2guid(char *grnam, guid_t *guidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a group name of the form group@domain to the corresponding GUID, consulting the kauth identity cache and, on a miss, the user-space identity resolver. grnam must be a NUL-terminated string no larger than MAXPATHLEN bytes; on success the GUID is stored in *guidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_guid2pwnam
extern int kauth_cred_guid2pwnam(guid_t *guidp, char *pwnam)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GUID to the corresponding user name of the form user@domain, consulting the kauth identity cache and, on a miss, the user-space identity resolver. pwnam is assumed to point to a buffer of MAXPATHLEN bytes, modified only on success. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_guid2grnam
extern int kauth_cred_guid2grnam(guid_t *guidp, char *grnam)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GUID to the corresponding group name of the form group@domain, consulting the kauth identity cache and, on a miss, the user-space identity resolver. grnam is assumed to point to a buffer of MAXPATHLEN bytes, modified only on success. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_guid2uid
extern int kauth_cred_guid2uid(guid_t *_guid, uid_t *_uidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GUID to the corresponding UID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the UID is stored in *uidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver (ENOENT if no translation exists).
functionkauth_cred_guid2gid
extern int kauth_cred_guid2gid(guid_t *_guid, gid_t *_gidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GUID to the corresponding GID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the GID is stored in *gidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver (ENOENT if no translation exists).
functionkauth_cred_ntsid2uid
extern int kauth_cred_ntsid2uid(ntsid_t *_sid, uid_t *_uidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a Windows NT security identifier (ntsid_t) to the corresponding UID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the UID is stored in *uidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_ntsid2gid
extern int kauth_cred_ntsid2gid(ntsid_t *_sid, gid_t *_gidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a Windows NT security identifier (ntsid_t) to the corresponding GID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the GID is stored in *gidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_ntsid2guid
extern int kauth_cred_ntsid2guid(ntsid_t *_sid, guid_t *_guidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a Windows NT security identifier (ntsid_t) to the corresponding GUID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the GUID is stored in *guidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_uid2guid
extern int kauth_cred_uid2guid(uid_t _uid, guid_t *_guidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a UID to the corresponding GUID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the GUID is stored in *guidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_getguid
extern int kauth_cred_getguid(kauth_cred_t _cred, guid_t *_guidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Returns the GUID associated with the credential's effective UID, storing it in *guidp. Equivalent to kauth_cred_uid2guid(kauth_cred_getuid(cred), guidp); the translation goes through the kauth identity cache and may call out to the user-space identity resolver. Returns 0 on success or an error from the lookup (EINVAL, ENOENT).
functionkauth_cred_gid2guid
extern int kauth_cred_gid2guid(gid_t _gid, guid_t *_guidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GID to the corresponding GUID via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the GUID is stored in *guidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_uid2ntsid
extern int kauth_cred_uid2ntsid(uid_t _uid, ntsid_t *_sidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a UID to the corresponding Windows NT security identifier via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the NTSID is stored in *sidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_getntsid
extern int kauth_cred_getntsid(kauth_cred_t _cred, ntsid_t *_sidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Returns the Windows NT security identifier associated with the credential's effective UID, storing it in *sidp. Equivalent to kauth_cred_uid2ntsid(kauth_cred_getuid(cred), sidp); the translation goes through the kauth identity cache and may call out to the user-space identity resolver. Returns 0 on success or an error from the lookup.
functionkauth_cred_gid2ntsid
extern int kauth_cred_gid2ntsid(gid_t _gid, ntsid_t *_sidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GID to the corresponding Windows NT security identifier via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the NTSID is stored in *sidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_guid2ntsid
extern int kauth_cred_guid2ntsid(guid_t *_guid, ntsid_t *_sidp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Translates a GUID to the corresponding Windows NT security identifier via the kauth identity cache, calling out to the user-space identity resolver on a cache miss. On success the NTSID is stored in *sidp. Returns 0 on success, EINVAL for an unknown identity type, or an error from the resolver.
functionkauth_cred_ismember_gid
extern int kauth_cred_ismember_gid(kauth_cred_t _cred, gid_t _gid, int *_resultp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Determines whether the given GID is among the groups associated with the credential; the effective GID is checked as well, since it is cr_groups[0]. When the credential carries an explicit group list, that list is searched directly; otherwise the group-membership cache is consulted and, on a miss, the request is submitted to the user-space resolver. On success *resultp is set to 1 (member) or 0 (not a member); *resultp is not modified on error. Returns 0 on success, or ENOENT, EWOULDBLOCK, EINTR, or ENOMEM if the lookup could not be performed.
functionkauth_cred_ismember_guid
extern int kauth_cred_ismember_guid(kauth_cred_t _cred, guid_t *_guidp, int *_resultp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Determines whether the credential is a member of the group named by GUID. Well-known GUIDs are handled directly: KAUTH_WKG_EVERYBODY yields membership, KAUTH_WKG_NOBODY yields non-membership. Otherwise the GUID is resolved; if it names a user record the result is 0 (not a group), and if it names a group the check is completed by kauth_cred_ismember_gid. On success *resultp is set to 1 (member) or 0 (not a member). Returns 0 on success, EINVAL if the GUID cannot be translated, or an error from the membership lookup (ENOENT, EWOULDBLOCK, EINTR, ENOMEM). Used by the ACL evaluator.
functionkauth_cred_nfs4domain2dsnode
extern int kauth_cred_nfs4domain2dsnode(char *nfs4domain, char *dsnode)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Stub; always returns ENOENT. Intended to translate an NFSv4 domain string to the corresponding Open Directory node string, storing the result in the dsnode buffer, but the translation is not implemented.
functionkauth_cred_dsnode2nfs4domain
extern int kauth_cred_dsnode2nfs4domain(char *dsnode, char *nfs4domain)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Stub; always returns ENOENT. Intended to translate an Open Directory node string to the corresponding NFSv4 domain string, storing the result in the nfs4domain buffer, but the translation is not implemented.
functiongroupmember
extern int groupmember(gid_t gid, kauth_cred_t cred)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_prot.c
Returns 1 if the given GID is a member of the credential's group set (including the effective GID), and 0 otherwise or if the membership lookup fails. Legacy interface; use kauth_cred_ismember_gid, which distinguishes lookup failure from non-membership, instead.
functionkauth_acl_alloc
kauth_acl_t kauth_acl_alloc(int size)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Allocates a zero-filled kauth_acl structure with room for the given number of ACEs (KAUTH_ACL_SIZE(count) bytes), which must be freed with kauth_acl_free. Returns NULL if count is negative or exceeds KAUTH_ACL_MAX_ENTRIES.
functionkauth_acl_free
void kauth_acl_free(kauth_acl_t fsp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Frees an ACL buffer previously allocated with kauth_acl_alloc.
typedefkauth_scope_t
typedef struct kauth_scope *kauth_scope_t
typedefkauth_listener_t
typedef struct kauth_listener *kauth_listener_t
typedefkauth_scope_callback_t
typedef int (*)(kauth_cred_t, void *, kauth_action_t, uintptr_t, uintptr_t, uintptr_t, uintptr_t) kauth_scope_callback_t;
macroKAUTH_RESULT_ALLOW
#define KAUTH_RESULT_ALLOW (1)
macroKAUTH_RESULT_DENY
#define KAUTH_RESULT_DENY (2)
macroKAUTH_RESULT_DEFER
#define KAUTH_RESULT_DEFER (3)
structkauth_acl_eval
| kauth_ace_t | ae_acl | |
| int | ae_count | |
| kauth_ace_rights_t | ae_requested | |
| kauth_ace_rights_t | ae_residual | |
| int | ae_result | |
| boolean_t | ae_found_deny | |
| int | ae_options | |
| kauth_ace_rights_t | ae_exp_gall | expansions for 'generic' rights bits |
| kauth_ace_rights_t | ae_exp_gread | |
| kauth_ace_rights_t | ae_exp_gwrite | |
| kauth_ace_rights_t | ae_exp_gexec |
macroKAUTH_AEVAL_IN_GROUP_UNKNOWN
#define KAUTH_AEVAL_IN_GROUP_UNKNOWN (1<<2)
authorizing operation for unknown group membership
typedefkauth_acl_eval_t
typedef struct kauth_acl_eval *kauth_acl_eval_t
functionkauth_filesec_alloc
kauth_filesec_t kauth_filesec_alloc(int size)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Allocates a kauth_filesec structure immediately followed by room for the given number of kauth_ace structures, packed densely. The header is initialized with fsec_magic KAUTH_FILESEC_MAGIC, null owner and group GUIDs, and entry count KAUTH_FILESEC_NOACL (no ACL). Returns NULL if count is negative, exceeds KAUTH_ACL_MAX_ENTRIES, or memory is unavailable. The result must be freed with kauth_filesec_free.
functionkauth_filesec_free
void kauth_filesec_free(kauth_filesec_t fsp)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Frees a kauth_filesec_t previously allocated by kauth_filesec_alloc or by a function that calls it. The structure is assumed to be in host byte order. Must not be passed KAUTH_FILESEC_NONE or KAUTH_FILESEC_WANTED.
functionkauth_register_scope
extern kauth_scope_t kauth_register_scope( const char *_identifier, kauth_scope_callback_t _callback, void *_idata )
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Registers a new kauth authorization scope under the given identifier (by convention a reverse-DNS string, e.g. KAUTH_SCOPE_VNODE) with an optional default callback and callback-private data. Listeners previously registered for the identifier with kauth_listen_scope are attached to the new scope. Returns an opaque scope handle for use with kauth_authorize_action and kauth_deregister_scope, or NULL if a scope with the same identifier already exists. The identifier string is not copied and must remain valid for the life of the scope.
functionkauth_deregister_scope
extern void kauth_deregister_scope(kauth_scope_t _scope)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Deregisters a scope previously registered with kauth_register_scope and frees it. Any listeners attached to the scope are moved back to the waiting list, to be re-attached if the scope is registered again; authorization requests on the scope must no longer be in flight.
functionkauth_listen_scope
__kpi_deprecated("Use EndpointSecurity instead") extern kauth_listener_t kauth_listen_scope( const char *_identifier, kauth_scope_callback_t _callback, void *_idata )
deprecated
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Deprecated; use the EndpointSecurity framework instead. Registers a listener callback on the scope named by identifier; the callback is invoked, with idata as its private data, for each authorization request evaluated in that scope and returns KAUTH_RESULT_ALLOW, KAUTH_RESULT_DENY, or KAUTH_RESULT_DEFER. If the scope is not yet registered the listener is parked and attached when the scope appears. Returns a listener handle for kauth_unlisten_scope, or NULL if the scope's listener table (KAUTH_SCOPE_MAX_LISTENERS entries) is full.
functionkauth_unlisten_scope
__kpi_deprecated("Use EndpointSecurity instead") extern void kauth_unlisten_scope(kauth_listener_t _scope)
deprecated
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Deprecated; use the EndpointSecurity framework instead. Removes and frees a listener previously registered with kauth_listen_scope, whether attached to an active scope or still waiting for one. Callbacks already in progress may still be executing when this call returns; callers remain responsible for requests already on the way to their callback.
functionkauth_authorize_action
extern int kauth_authorize_action( kauth_scope_t _scope, kauth_cred_t _credential, kauth_action_t _action, uintptr_t _arg0, uintptr_t _arg1, uintptr_t _arg2, uintptr_t _arg3 )
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Evaluates an authorization request in the given scope. The scope's own callback, if any, is consulted first, then every listener; each returns KAUTH_RESULT_ALLOW, KAUTH_RESULT_DENY, or KAUTH_RESULT_DEFER. A KAUTH_RESULT_DENY from any party denies the request, and an explicit KAUTH_RESULT_ALLOW is required for success. The meanings of arg0 through arg3 are defined by the scope; a callback may return data through *arg3. Returns 0 if the action is authorized, EPERM otherwise.
macroKAUTH_PROCESS_CANTRACE
#define KAUTH_PROCESS_CANTRACE 2
functionkauth_authorize_process
extern int kauth_authorize_process( kauth_cred_t _credential, kauth_action_t _action, struct proc *_process, uintptr_t _arg1, uintptr_t _arg2, uintptr_t _arg3 )
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_authorization.c
Evaluates an authorization request in the KAUTH_SCOPE_PROCESS scope, with the target process as arg0; equivalent to kauth_authorize_action on that scope. The default callback handles KAUTH_PROCESS_CANTRACE (arg1 is the process to be traced, arg2 a pointer to an int receiving the errno reason for denial, evaluated via cantrace); listeners registered on the scope are also consulted. Returns 0 if the action is authorized, EPERM otherwise.
macroKAUTH_SCOPE_VNODE
Vnode operation scope.
Prototype for vnode_authorize is in vnode.h
#define KAUTH_SCOPE_VNODE "com.apple.kauth.vnode"
macroKAUTH_SCOPE_FILEOP
File system operation scope.
#define KAUTH_SCOPE_FILEOP "com.apple.kauth.fileop"
macroKAUTH_FILEOP_CLOSE
#define KAUTH_FILEOP_CLOSE 2
macroKAUTH_FILEOP_RENAME
#define KAUTH_FILEOP_RENAME 3
macroKAUTH_FILEOP_EXCHANGE
#define KAUTH_FILEOP_EXCHANGE 4
macroKAUTH_FILEOP_LINK
#define KAUTH_FILEOP_LINK 5
macroKAUTH_FILEOP_EXEC
#define KAUTH_FILEOP_EXEC 6
macroKAUTH_FILEOP_DELETE
#define KAUTH_FILEOP_DELETE 7
macroKAUTH_FILEOP_WILL_RENAME
#define KAUTH_FILEOP_WILL_RENAME 8
macroKAUTH_FILEOP_CLOSE_MODIFIED
Flag values returned to close listeners.
#define KAUTH_FILEOP_CLOSE_MODIFIED (1<<1)
functionkauth_guid_equal
extern int kauth_guid_equal(guid_t *_guid1, guid_t *_guid2)
▾
claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu bsd/kern/kern_credential.c
Compares two GUIDs for equality with bcmp. Returns nonzero if the GUIDs are equal, 0 if they differ.
macroKAUTH_DEBUG
#define KAUTH_DEBUG(fmt, args, ...) do { } while (0)macroVFS_DEBUG
#define VFS_DEBUG(ctx, vp, fmt, args, ...) do { } while(0)