17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cdjpk * Common Development and Distribution License (the "License").
645916cdjpk * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
217c478bdstevel@tonic-gate/*
22ba3594bGarrett D'Amore * Copyright 2014 Garrett D'Amore <garrett@damore.org>
23ba3594bGarrett D'Amore *
24134a1f4Casper H.S. Dik * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
257c478bdstevel@tonic-gate */
267c478bdstevel@tonic-gate
277c478bdstevel@tonic-gate#ifndef	_SYS_PRIV_H
287c478bdstevel@tonic-gate#define	_SYS_PRIV_H
297c478bdstevel@tonic-gate
307c478bdstevel@tonic-gate#include <sys/types.h>
317c478bdstevel@tonic-gate#include <sys/cred.h>
327c478bdstevel@tonic-gate#include <sys/priv_names.h>
337c478bdstevel@tonic-gate
347c478bdstevel@tonic-gate#ifdef	__cplusplus
357c478bdstevel@tonic-gateextern "C" {
367c478bdstevel@tonic-gate#endif
377c478bdstevel@tonic-gate
387c478bdstevel@tonic-gatetypedef uint32_t priv_chunk_t;
397c478bdstevel@tonic-gatetypedef struct priv_set priv_set_t;
407c478bdstevel@tonic-gate
417c478bdstevel@tonic-gate#ifdef _KERNEL
427c478bdstevel@tonic-gate
437c478bdstevel@tonic-gate/*
447c478bdstevel@tonic-gate * Kernel type definitions.
457c478bdstevel@tonic-gate */
467c478bdstevel@tonic-gatetypedef int priv_ptype_t;
477c478bdstevel@tonic-gatetypedef int priv_t;
487c478bdstevel@tonic-gate
497c478bdstevel@tonic-gate#else /* _KERNEL */
507c478bdstevel@tonic-gate
517c478bdstevel@tonic-gate/*
527c478bdstevel@tonic-gate * Userland type definitions.
537c478bdstevel@tonic-gate */
547c478bdstevel@tonic-gate
557c478bdstevel@tonic-gatetypedef const char *priv_ptype_t;
567c478bdstevel@tonic-gatetypedef const char *priv_t;
577c478bdstevel@tonic-gate
587c478bdstevel@tonic-gate#endif /* _KERNEL */
597c478bdstevel@tonic-gate
607c478bdstevel@tonic-gate/*
617c478bdstevel@tonic-gate * priv_op_t indicates a privilege operation type
627c478bdstevel@tonic-gate */
637c478bdstevel@tonic-gatetypedef enum priv_op {
647c478bdstevel@tonic-gate	PRIV_ON,
657c478bdstevel@tonic-gate	PRIV_OFF,
667c478bdstevel@tonic-gate	PRIV_SET
677c478bdstevel@tonic-gate} priv_op_t;
687c478bdstevel@tonic-gate
697c478bdstevel@tonic-gate/*
707c478bdstevel@tonic-gate * Privilege system call subcodes.
717c478bdstevel@tonic-gate */
727c478bdstevel@tonic-gate
737c478bdstevel@tonic-gate#define	PRIVSYS_SETPPRIV	0
747c478bdstevel@tonic-gate#define	PRIVSYS_GETPPRIV	1
757c478bdstevel@tonic-gate#define	PRIVSYS_GETIMPLINFO	2
767c478bdstevel@tonic-gate#define	PRIVSYS_SETPFLAGS	3
777c478bdstevel@tonic-gate#define	PRIVSYS_GETPFLAGS	4
78f48205bcasper#define	PRIVSYS_ISSETUGID	5
79ddf7fe9casper#define	PRIVSYS_KLPD_REG	6
80ddf7fe9casper#define	PRIVSYS_KLPD_UNREG	7
81134a1f4Casper H.S. Dik#define	PRIVSYS_PFEXEC_REG	8
82134a1f4Casper H.S. Dik#define	PRIVSYS_PFEXEC_UNREG	9
83134a1f4Casper H.S. Dik
847c478bdstevel@tonic-gate
857c478bdstevel@tonic-gate/*
867c478bdstevel@tonic-gate * Maximum length of a user defined privilege name.
877c478bdstevel@tonic-gate */
887c478bdstevel@tonic-gate#define	PRIVNAME_MAX		32
897c478bdstevel@tonic-gate
907c478bdstevel@tonic-gate/*
917c478bdstevel@tonic-gate * Privilege interface functions for those parts of the kernel that
927c478bdstevel@tonic-gate * know nothing of the privilege internals.
937c478bdstevel@tonic-gate *
947c478bdstevel@tonic-gate * A privilege implementation can have a varying number of sets; sets
957c478bdstevel@tonic-gate * consist of a number of priv_chunk_t's and the size is expressed as such.
967c478bdstevel@tonic-gate * The privileges can be represented as
977c478bdstevel@tonic-gate *
987c478bdstevel@tonic-gate *		priv_chunk_t privs[info.priv_nsets][info.priv_setsize]
997c478bdstevel@tonic-gate *		... priv_infosize of extra information ...
1007c478bdstevel@tonic-gate *
1017c478bdstevel@tonic-gate * Extra data contained in the privilege information consists of chunks
1027c478bdstevel@tonic-gate * of data with specified size and type all headed by a priv_info_t header
1037c478bdstevel@tonic-gate * which defines both the type of information as well as the size of the
1047c478bdstevel@tonic-gate * information.  ((char*)&info)+info->priv_info_size should be rounded up
1057c478bdstevel@tonic-gate * to point to the next piece of information.
1067c478bdstevel@tonic-gate */
1077c478bdstevel@tonic-gate
1087c478bdstevel@tonic-gatetypedef struct priv_impl_info {
1097c478bdstevel@tonic-gate	uint32_t	priv_headersize;	/* sizeof (priv_impl_info) */
1107c478bdstevel@tonic-gate	uint32_t	priv_flags;		/* additional flags */
1117c478bdstevel@tonic-gate	uint32_t	priv_nsets;		/* number of priv sets */
1127c478bdstevel@tonic-gate	uint32_t	priv_setsize;		/* size in priv_chunk_t */
1137c478bdstevel@tonic-gate	uint32_t	priv_max;		/* highest actual valid priv */
1147c478bdstevel@tonic-gate	uint32_t	priv_infosize;		/* Per proc. additional info */
1157c478bdstevel@tonic-gate	uint32_t	priv_globalinfosize;	/* Per system info */
1167c478bdstevel@tonic-gate} priv_impl_info_t;
1177c478bdstevel@tonic-gate
1187c478bdstevel@tonic-gate#define	PRIV_IMPL_INFO_SIZE(p) \
1197c478bdstevel@tonic-gate			((p)->priv_headersize + (p)->priv_globalinfosize)
1207c478bdstevel@tonic-gate
1217c478bdstevel@tonic-gate#define	PRIV_PRPRIV_INFO_OFFSET(p) \
1227c478bdstevel@tonic-gate		(sizeof (*(p)) + \
1237c478bdstevel@tonic-gate		((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t))
1247c478bdstevel@tonic-gate
1257c478bdstevel@tonic-gate#define	PRIV_PRPRIV_SIZE(p) \
1267c478bdstevel@tonic-gate		(PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize)
1277c478bdstevel@tonic-gate
1287c478bdstevel@tonic-gate/*
1297c478bdstevel@tonic-gate * Per credential flags.
1307c478bdstevel@tonic-gate */
1317c478bdstevel@tonic-gate#define	PRIV_DEBUG			0x0001		/* User debugging */
1327c478bdstevel@tonic-gate#define	PRIV_AWARE			0x0002		/* Is privilege aware */
1337c478bdstevel@tonic-gate#define	PRIV_AWARE_INHERIT		0x0004		/* Inherit awareness */
1347c478bdstevel@tonic-gate#define	__PROC_PROTECT			0x0008		/* Private */
13545916cdjpk#define	NET_MAC_AWARE			0x0010		/* Is MAC aware */
13645916cdjpk#define	NET_MAC_AWARE_INHERIT		0x0020		/* Inherit MAC aware */
137982b4adCasper H.S. Dik#define	PRIV_AWARE_RESET		0x0040		/* Reset on setuid() */
138ddf7fe9casper#define	PRIV_XPOLICY			0x0080		/* Extended policy */
139134a1f4Casper H.S. Dik#define	PRIV_PFEXEC			0x0100		/* As if pfexec'ed */
14045916cdjpk
14145916cdjpk/* user-settable flags: */
142ddf7fe9casper#define	PRIV_USER	(PRIV_DEBUG | NET_MAC_AWARE | NET_MAC_AWARE_INHERIT |\
143134a1f4Casper H.S. Dik			    PRIV_XPOLICY | PRIV_AWARE_RESET | PRIV_PFEXEC)
1447c478bdstevel@tonic-gate
1457c478bdstevel@tonic-gate/*
1467c478bdstevel@tonic-gate * Header of the privilege info data structure; multiple structures can
1477c478bdstevel@tonic-gate * follow the privilege sets and priv_impl_info structures.
1487c478bdstevel@tonic-gate */
1497c478bdstevel@tonic-gatetypedef struct priv_info {
1507c478bdstevel@tonic-gate	uint32_t	priv_info_type;
1517c478bdstevel@tonic-gate	uint32_t	priv_info_size;
1527c478bdstevel@tonic-gate} priv_info_t;
1537c478bdstevel@tonic-gate
1547c478bdstevel@tonic-gatetypedef struct priv_info_uint {
1557c478bdstevel@tonic-gate	priv_info_t	info;
1567c478bdstevel@tonic-gate	uint_t		val;
1577c478bdstevel@tonic-gate} priv_info_uint_t;
1587c478bdstevel@tonic-gate
1597c478bdstevel@tonic-gate/*
1607c478bdstevel@tonic-gate * Global privilege set information item; the actual size of the array is
1617c478bdstevel@tonic-gate * {priv_setsize}.
1627c478bdstevel@tonic-gate */
1637c478bdstevel@tonic-gatetypedef struct priv_info_set {
1647c478bdstevel@tonic-gate	priv_info_t	info;
1657c478bdstevel@tonic-gate	priv_chunk_t	set[1];
1667c478bdstevel@tonic-gate} priv_info_set_t;
1677c478bdstevel@tonic-gate
1687c478bdstevel@tonic-gate/*
1697c478bdstevel@tonic-gate * names[1] is a place holder which can contain multiple NUL terminated,
1707c478bdstevel@tonic-gate * non-empty strings.
1717c478bdstevel@tonic-gate */
1727c478bdstevel@tonic-gate
1737c478bdstevel@tonic-gatetypedef struct priv_info_names {
1747c478bdstevel@tonic-gate	priv_info_t	info;
1757c478bdstevel@tonic-gate	int		cnt;		/* number of strings */
1767c478bdstevel@tonic-gate	char		names[1];	/* "string1\0string2\0 ..stringN\0" */
1777c478bdstevel@tonic-gate} priv_info_names_t;
1787c478bdstevel@tonic-gate
1797c478bdstevel@tonic-gate/*
1807c478bdstevel@tonic-gate * Privilege information types.
1817c478bdstevel@tonic-gate */
1827c478bdstevel@tonic-gate#define	PRIV_INFO_SETNAMES		0x0001
1837c478bdstevel@tonic-gate#define	PRIV_INFO_PRIVNAMES		0x0002
1847c478bdstevel@tonic-gate#define	PRIV_INFO_BASICPRIVS		0x0003
1857c478bdstevel@tonic-gate#define	PRIV_INFO_FLAGS			0x0004
1867c478bdstevel@tonic-gate
1877c478bdstevel@tonic-gate/*
1887c478bdstevel@tonic-gate * Special "privileges" used to indicate special conditions in privilege
1897c478bdstevel@tonic-gate * debugging/tracing code.
1907c478bdstevel@tonic-gate */
1917c478bdstevel@tonic-gate#define	PRIV_ALL			(-1)	/* All privileges required */
1927c478bdstevel@tonic-gate#define	PRIV_MULTIPLE			(-2)	/* More than one */
1937c478bdstevel@tonic-gate#define	PRIV_NONE			(-3)	/* No value */
1947c478bdstevel@tonic-gate#define	PRIV_ALLZONE			(-4)	/* All privileges in zone */
1957c478bdstevel@tonic-gate#define	PRIV_GLOBAL			(-5)	/* Must be in global zone */
1967c478bdstevel@tonic-gate
1977c478bdstevel@tonic-gate#ifdef _KERNEL
1987c478bdstevel@tonic-gate
1997c478bdstevel@tonic-gate#define	PRIV_ALLOC			0x1
2007c478bdstevel@tonic-gate
201634e26eCasper H.S. Dikextern int priv_debug;
202634e26eCasper H.S. Dikextern int priv_basic_test;
203634e26eCasper H.S. Dik
2047c478bdstevel@tonic-gatestruct proc;
2057c478bdstevel@tonic-gatestruct prpriv;
2067c478bdstevel@tonic-gatestruct cred;
2077c478bdstevel@tonic-gate
2087c478bdstevel@tonic-gateextern int priv_prgetprivsize(struct prpriv *);
2097c478bdstevel@tonic-gateextern void cred2prpriv(const struct cred *, struct prpriv *);
2107c478bdstevel@tonic-gateextern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *);
2117c478bdstevel@tonic-gate
2127c478bdstevel@tonic-gateextern priv_impl_info_t *priv_hold_implinfo(void);
2137c478bdstevel@tonic-gateextern void priv_release_implinfo(void);
2147c478bdstevel@tonic-gateextern size_t priv_get_implinfo_size(void);
2157c478bdstevel@tonic-gateextern const priv_set_t *priv_getset(const struct cred *, int);
2167c478bdstevel@tonic-gateextern void priv_getinfo(const struct cred *, void *);
2177c478bdstevel@tonic-gateextern int priv_getbyname(const char *, uint_t);
2187c478bdstevel@tonic-gateextern int priv_getsetbyname(const char *, int);
2197c478bdstevel@tonic-gateextern const char *priv_getbynum(int);
2207c478bdstevel@tonic-gateextern const char *priv_getsetbynum(int);
2217c478bdstevel@tonic-gate
2227c478bdstevel@tonic-gateextern void priv_emptyset(priv_set_t *);
2237c478bdstevel@tonic-gateextern void priv_fillset(priv_set_t *);
2247c478bdstevel@tonic-gateextern void priv_addset(priv_set_t *, int);
2257c478bdstevel@tonic-gateextern void priv_delset(priv_set_t *, int);
2267c478bdstevel@tonic-gateextern boolean_t priv_ismember(const priv_set_t *, int);
2277c478bdstevel@tonic-gateextern boolean_t priv_isemptyset(const priv_set_t *);
2287c478bdstevel@tonic-gateextern boolean_t priv_isfullset(const priv_set_t *);
2297c478bdstevel@tonic-gateextern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *);
2307c478bdstevel@tonic-gateextern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *);
2317c478bdstevel@tonic-gateextern int priv_proc_cred_perm(const struct cred *, struct proc *,
2327c478bdstevel@tonic-gate	struct cred **, int);
2337c478bdstevel@tonic-gateextern void priv_intersect(const priv_set_t *, priv_set_t *);
2347c478bdstevel@tonic-gateextern void priv_union(const priv_set_t *, priv_set_t *);
2357c478bdstevel@tonic-gateextern void priv_inverse(priv_set_t *);
2367c478bdstevel@tonic-gate
2377c478bdstevel@tonic-gateextern void priv_set_PA(cred_t *);
2387c478bdstevel@tonic-gateextern void priv_adjust_PA(cred_t *);
239982b4adCasper H.S. Dikextern void priv_reset_PA(cred_t *, boolean_t);
2407c478bdstevel@tonic-gateextern boolean_t priv_can_clear_PA(const cred_t *);
2417c478bdstevel@tonic-gate
24245916cdjpkextern int setpflags(uint_t, uint_t, cred_t *);
24345916cdjpkextern uint_t getpflags(uint_t, const cred_t *);
24445916cdjpk
2457c478bdstevel@tonic-gate#endif /* _KERNEL */
2467c478bdstevel@tonic-gate
2477c478bdstevel@tonic-gate#ifdef	__cplusplus
2487c478bdstevel@tonic-gate}
2497c478bdstevel@tonic-gate#endif
2507c478bdstevel@tonic-gate
2517c478bdstevel@tonic-gate#endif	/* _SYS_PRIV_H */
252