xref: /illumos-gate/usr/src/uts/common/sys/priv.h (revision ba3594ba9b5dd4c846c472a8d657edcb7c8109ac)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22*ba3594baSGarrett D'Amore  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
23*ba3594baSGarrett D'Amore  *
24134a1f4eSCasper H.S. Dik  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
257c478bd9Sstevel@tonic-gate  */
267c478bd9Sstevel@tonic-gate 
277c478bd9Sstevel@tonic-gate #ifndef	_SYS_PRIV_H
287c478bd9Sstevel@tonic-gate #define	_SYS_PRIV_H
297c478bd9Sstevel@tonic-gate 
307c478bd9Sstevel@tonic-gate #include <sys/types.h>
317c478bd9Sstevel@tonic-gate #include <sys/cred.h>
327c478bd9Sstevel@tonic-gate #include <sys/priv_names.h>
337c478bd9Sstevel@tonic-gate 
347c478bd9Sstevel@tonic-gate #ifdef	__cplusplus
357c478bd9Sstevel@tonic-gate extern "C" {
367c478bd9Sstevel@tonic-gate #endif
377c478bd9Sstevel@tonic-gate 
387c478bd9Sstevel@tonic-gate typedef uint32_t priv_chunk_t;
397c478bd9Sstevel@tonic-gate typedef struct priv_set priv_set_t;
407c478bd9Sstevel@tonic-gate 
417c478bd9Sstevel@tonic-gate #ifdef _KERNEL
427c478bd9Sstevel@tonic-gate 
437c478bd9Sstevel@tonic-gate /*
447c478bd9Sstevel@tonic-gate  * Kernel type definitions.
457c478bd9Sstevel@tonic-gate  */
467c478bd9Sstevel@tonic-gate typedef int priv_ptype_t;
477c478bd9Sstevel@tonic-gate typedef int priv_t;
487c478bd9Sstevel@tonic-gate 
497c478bd9Sstevel@tonic-gate #else /* _KERNEL */
507c478bd9Sstevel@tonic-gate 
517c478bd9Sstevel@tonic-gate /*
527c478bd9Sstevel@tonic-gate  * Userland type definitions.
537c478bd9Sstevel@tonic-gate  */
547c478bd9Sstevel@tonic-gate 
557c478bd9Sstevel@tonic-gate typedef const char *priv_ptype_t;
567c478bd9Sstevel@tonic-gate typedef const char *priv_t;
577c478bd9Sstevel@tonic-gate 
587c478bd9Sstevel@tonic-gate #endif /* _KERNEL */
597c478bd9Sstevel@tonic-gate 
607c478bd9Sstevel@tonic-gate /*
617c478bd9Sstevel@tonic-gate  * priv_op_t indicates a privilege operation type
627c478bd9Sstevel@tonic-gate  */
637c478bd9Sstevel@tonic-gate typedef enum priv_op {
647c478bd9Sstevel@tonic-gate 	PRIV_ON,
657c478bd9Sstevel@tonic-gate 	PRIV_OFF,
667c478bd9Sstevel@tonic-gate 	PRIV_SET
677c478bd9Sstevel@tonic-gate } priv_op_t;
687c478bd9Sstevel@tonic-gate 
697c478bd9Sstevel@tonic-gate /*
707c478bd9Sstevel@tonic-gate  * Privilege system call subcodes.
717c478bd9Sstevel@tonic-gate  */
727c478bd9Sstevel@tonic-gate 
737c478bd9Sstevel@tonic-gate #define	PRIVSYS_SETPPRIV	0
747c478bd9Sstevel@tonic-gate #define	PRIVSYS_GETPPRIV	1
757c478bd9Sstevel@tonic-gate #define	PRIVSYS_GETIMPLINFO	2
767c478bd9Sstevel@tonic-gate #define	PRIVSYS_SETPFLAGS	3
777c478bd9Sstevel@tonic-gate #define	PRIVSYS_GETPFLAGS	4
78f48205beScasper #define	PRIVSYS_ISSETUGID	5
79ddf7fe95Scasper #define	PRIVSYS_KLPD_REG	6
80ddf7fe95Scasper #define	PRIVSYS_KLPD_UNREG	7
81134a1f4eSCasper H.S. Dik #define	PRIVSYS_PFEXEC_REG	8
82134a1f4eSCasper H.S. Dik #define	PRIVSYS_PFEXEC_UNREG	9
83134a1f4eSCasper H.S. Dik 
847c478bd9Sstevel@tonic-gate 
857c478bd9Sstevel@tonic-gate /*
867c478bd9Sstevel@tonic-gate  * Maximum length of a user defined privilege name.
877c478bd9Sstevel@tonic-gate  */
887c478bd9Sstevel@tonic-gate #define	PRIVNAME_MAX		32
897c478bd9Sstevel@tonic-gate 
907c478bd9Sstevel@tonic-gate /*
917c478bd9Sstevel@tonic-gate  * Privilege interface functions for those parts of the kernel that
927c478bd9Sstevel@tonic-gate  * know nothing of the privilege internals.
937c478bd9Sstevel@tonic-gate  *
947c478bd9Sstevel@tonic-gate  * A privilege implementation can have a varying number of sets; sets
957c478bd9Sstevel@tonic-gate  * consist of a number of priv_chunk_t's and the size is expressed as such.
967c478bd9Sstevel@tonic-gate  * The privileges can be represented as
977c478bd9Sstevel@tonic-gate  *
987c478bd9Sstevel@tonic-gate  *		priv_chunk_t privs[info.priv_nsets][info.priv_setsize]
997c478bd9Sstevel@tonic-gate  *		... priv_infosize of extra information ...
1007c478bd9Sstevel@tonic-gate  *
1017c478bd9Sstevel@tonic-gate  * Extra data contained in the privilege information consists of chunks
1027c478bd9Sstevel@tonic-gate  * of data with specified size and type all headed by a priv_info_t header
1037c478bd9Sstevel@tonic-gate  * which defines both the type of information as well as the size of the
1047c478bd9Sstevel@tonic-gate  * information.  ((char*)&info)+info->priv_info_size should be rounded up
1057c478bd9Sstevel@tonic-gate  * to point to the next piece of information.
1067c478bd9Sstevel@tonic-gate  */
1077c478bd9Sstevel@tonic-gate 
1087c478bd9Sstevel@tonic-gate typedef struct priv_impl_info {
1097c478bd9Sstevel@tonic-gate 	uint32_t	priv_headersize;	/* sizeof (priv_impl_info) */
1107c478bd9Sstevel@tonic-gate 	uint32_t	priv_flags;		/* additional flags */
1117c478bd9Sstevel@tonic-gate 	uint32_t	priv_nsets;		/* number of priv sets */
1127c478bd9Sstevel@tonic-gate 	uint32_t	priv_setsize;		/* size in priv_chunk_t */
1137c478bd9Sstevel@tonic-gate 	uint32_t	priv_max;		/* highest actual valid priv */
1147c478bd9Sstevel@tonic-gate 	uint32_t	priv_infosize;		/* Per proc. additional info */
1157c478bd9Sstevel@tonic-gate 	uint32_t	priv_globalinfosize;	/* Per system info */
1167c478bd9Sstevel@tonic-gate } priv_impl_info_t;
1177c478bd9Sstevel@tonic-gate 
1187c478bd9Sstevel@tonic-gate #define	PRIV_IMPL_INFO_SIZE(p) \
1197c478bd9Sstevel@tonic-gate 			((p)->priv_headersize + (p)->priv_globalinfosize)
1207c478bd9Sstevel@tonic-gate 
1217c478bd9Sstevel@tonic-gate #define	PRIV_PRPRIV_INFO_OFFSET(p) \
1227c478bd9Sstevel@tonic-gate 		(sizeof (*(p)) + \
1237c478bd9Sstevel@tonic-gate 		((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t))
1247c478bd9Sstevel@tonic-gate 
1257c478bd9Sstevel@tonic-gate #define	PRIV_PRPRIV_SIZE(p) \
1267c478bd9Sstevel@tonic-gate 		(PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize)
1277c478bd9Sstevel@tonic-gate 
1287c478bd9Sstevel@tonic-gate /*
1297c478bd9Sstevel@tonic-gate  * Per credential flags.
1307c478bd9Sstevel@tonic-gate  */
1317c478bd9Sstevel@tonic-gate #define	PRIV_DEBUG			0x0001		/* User debugging */
1327c478bd9Sstevel@tonic-gate #define	PRIV_AWARE			0x0002		/* Is privilege aware */
1337c478bd9Sstevel@tonic-gate #define	PRIV_AWARE_INHERIT		0x0004		/* Inherit awareness */
1347c478bd9Sstevel@tonic-gate #define	__PROC_PROTECT			0x0008		/* Private */
13545916cd2Sjpk #define	NET_MAC_AWARE			0x0010		/* Is MAC aware */
13645916cd2Sjpk #define	NET_MAC_AWARE_INHERIT		0x0020		/* Inherit MAC aware */
137982b4ad2SCasper H.S. Dik #define	PRIV_AWARE_RESET		0x0040		/* Reset on setuid() */
138ddf7fe95Scasper #define	PRIV_XPOLICY			0x0080		/* Extended policy */
139134a1f4eSCasper H.S. Dik #define	PRIV_PFEXEC			0x0100		/* As if pfexec'ed */
14045916cd2Sjpk 
14145916cd2Sjpk /* user-settable flags: */
142ddf7fe95Scasper #define	PRIV_USER	(PRIV_DEBUG | NET_MAC_AWARE | NET_MAC_AWARE_INHERIT |\
143134a1f4eSCasper H.S. Dik 			    PRIV_XPOLICY | PRIV_AWARE_RESET | PRIV_PFEXEC)
1447c478bd9Sstevel@tonic-gate 
1457c478bd9Sstevel@tonic-gate /*
1467c478bd9Sstevel@tonic-gate  * Header of the privilege info data structure; multiple structures can
1477c478bd9Sstevel@tonic-gate  * follow the privilege sets and priv_impl_info structures.
1487c478bd9Sstevel@tonic-gate  */
1497c478bd9Sstevel@tonic-gate typedef struct priv_info {
1507c478bd9Sstevel@tonic-gate 	uint32_t	priv_info_type;
1517c478bd9Sstevel@tonic-gate 	uint32_t	priv_info_size;
1527c478bd9Sstevel@tonic-gate } priv_info_t;
1537c478bd9Sstevel@tonic-gate 
1547c478bd9Sstevel@tonic-gate typedef struct priv_info_uint {
1557c478bd9Sstevel@tonic-gate 	priv_info_t	info;
1567c478bd9Sstevel@tonic-gate 	uint_t		val;
1577c478bd9Sstevel@tonic-gate } priv_info_uint_t;
1587c478bd9Sstevel@tonic-gate 
1597c478bd9Sstevel@tonic-gate /*
1607c478bd9Sstevel@tonic-gate  * Global privilege set information item; the actual size of the array is
1617c478bd9Sstevel@tonic-gate  * {priv_setsize}.
1627c478bd9Sstevel@tonic-gate  */
1637c478bd9Sstevel@tonic-gate typedef struct priv_info_set {
1647c478bd9Sstevel@tonic-gate 	priv_info_t	info;
1657c478bd9Sstevel@tonic-gate 	priv_chunk_t	set[1];
1667c478bd9Sstevel@tonic-gate } priv_info_set_t;
1677c478bd9Sstevel@tonic-gate 
1687c478bd9Sstevel@tonic-gate /*
1697c478bd9Sstevel@tonic-gate  * names[1] is a place holder which can contain multiple NUL terminated,
1707c478bd9Sstevel@tonic-gate  * non-empty strings.
1717c478bd9Sstevel@tonic-gate  */
1727c478bd9Sstevel@tonic-gate 
1737c478bd9Sstevel@tonic-gate typedef struct priv_info_names {
1747c478bd9Sstevel@tonic-gate 	priv_info_t	info;
1757c478bd9Sstevel@tonic-gate 	int		cnt;		/* number of strings */
1767c478bd9Sstevel@tonic-gate 	char		names[1];	/* "string1\0string2\0 ..stringN\0" */
1777c478bd9Sstevel@tonic-gate } priv_info_names_t;
1787c478bd9Sstevel@tonic-gate 
1797c478bd9Sstevel@tonic-gate /*
1807c478bd9Sstevel@tonic-gate  * Privilege information types.
1817c478bd9Sstevel@tonic-gate  */
1827c478bd9Sstevel@tonic-gate #define	PRIV_INFO_SETNAMES		0x0001
1837c478bd9Sstevel@tonic-gate #define	PRIV_INFO_PRIVNAMES		0x0002
1847c478bd9Sstevel@tonic-gate #define	PRIV_INFO_BASICPRIVS		0x0003
1857c478bd9Sstevel@tonic-gate #define	PRIV_INFO_FLAGS			0x0004
1867c478bd9Sstevel@tonic-gate 
1877c478bd9Sstevel@tonic-gate /*
1887c478bd9Sstevel@tonic-gate  * Special "privileges" used to indicate special conditions in privilege
1897c478bd9Sstevel@tonic-gate  * debugging/tracing code.
1907c478bd9Sstevel@tonic-gate  */
1917c478bd9Sstevel@tonic-gate #define	PRIV_ALL			(-1)	/* All privileges required */
1927c478bd9Sstevel@tonic-gate #define	PRIV_MULTIPLE			(-2)	/* More than one */
1937c478bd9Sstevel@tonic-gate #define	PRIV_NONE			(-3)	/* No value */
1947c478bd9Sstevel@tonic-gate #define	PRIV_ALLZONE			(-4)	/* All privileges in zone */
1957c478bd9Sstevel@tonic-gate #define	PRIV_GLOBAL			(-5)	/* Must be in global zone */
1967c478bd9Sstevel@tonic-gate 
1977c478bd9Sstevel@tonic-gate #ifdef _KERNEL
1987c478bd9Sstevel@tonic-gate 
1997c478bd9Sstevel@tonic-gate #define	PRIV_ALLOC			0x1
2007c478bd9Sstevel@tonic-gate 
201634e26ecSCasper H.S. Dik extern int priv_debug;
202634e26ecSCasper H.S. Dik extern int priv_basic_test;
203634e26ecSCasper H.S. Dik 
2047c478bd9Sstevel@tonic-gate struct proc;
2057c478bd9Sstevel@tonic-gate struct prpriv;
2067c478bd9Sstevel@tonic-gate struct cred;
2077c478bd9Sstevel@tonic-gate 
2087c478bd9Sstevel@tonic-gate extern int priv_prgetprivsize(struct prpriv *);
2097c478bd9Sstevel@tonic-gate extern void cred2prpriv(const struct cred *, struct prpriv *);
2107c478bd9Sstevel@tonic-gate extern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *);
2117c478bd9Sstevel@tonic-gate 
2127c478bd9Sstevel@tonic-gate extern priv_impl_info_t *priv_hold_implinfo(void);
2137c478bd9Sstevel@tonic-gate extern void priv_release_implinfo(void);
2147c478bd9Sstevel@tonic-gate extern size_t priv_get_implinfo_size(void);
2157c478bd9Sstevel@tonic-gate extern const priv_set_t *priv_getset(const struct cred *, int);
2167c478bd9Sstevel@tonic-gate extern void priv_getinfo(const struct cred *, void *);
2177c478bd9Sstevel@tonic-gate extern int priv_getbyname(const char *, uint_t);
2187c478bd9Sstevel@tonic-gate extern int priv_getsetbyname(const char *, int);
2197c478bd9Sstevel@tonic-gate extern const char *priv_getbynum(int);
2207c478bd9Sstevel@tonic-gate extern const char *priv_getsetbynum(int);
2217c478bd9Sstevel@tonic-gate 
2227c478bd9Sstevel@tonic-gate extern void priv_emptyset(priv_set_t *);
2237c478bd9Sstevel@tonic-gate extern void priv_fillset(priv_set_t *);
2247c478bd9Sstevel@tonic-gate extern void priv_addset(priv_set_t *, int);
2257c478bd9Sstevel@tonic-gate extern void priv_delset(priv_set_t *, int);
2267c478bd9Sstevel@tonic-gate extern boolean_t priv_ismember(const priv_set_t *, int);
2277c478bd9Sstevel@tonic-gate extern boolean_t priv_isemptyset(const priv_set_t *);
2287c478bd9Sstevel@tonic-gate extern boolean_t priv_isfullset(const priv_set_t *);
2297c478bd9Sstevel@tonic-gate extern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *);
2307c478bd9Sstevel@tonic-gate extern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *);
2317c478bd9Sstevel@tonic-gate extern int priv_proc_cred_perm(const struct cred *, struct proc *,
2327c478bd9Sstevel@tonic-gate 	struct cred **, int);
2337c478bd9Sstevel@tonic-gate extern void priv_intersect(const priv_set_t *, priv_set_t *);
2347c478bd9Sstevel@tonic-gate extern void priv_union(const priv_set_t *, priv_set_t *);
2357c478bd9Sstevel@tonic-gate extern void priv_inverse(priv_set_t *);
2367c478bd9Sstevel@tonic-gate 
2377c478bd9Sstevel@tonic-gate extern void priv_set_PA(cred_t *);
2387c478bd9Sstevel@tonic-gate extern void priv_adjust_PA(cred_t *);
239982b4ad2SCasper H.S. Dik extern void priv_reset_PA(cred_t *, boolean_t);
2407c478bd9Sstevel@tonic-gate extern boolean_t priv_can_clear_PA(const cred_t *);
2417c478bd9Sstevel@tonic-gate 
24245916cd2Sjpk extern int setpflags(uint_t, uint_t, cred_t *);
24345916cd2Sjpk extern uint_t getpflags(uint_t, const cred_t *);
24445916cd2Sjpk 
2457c478bd9Sstevel@tonic-gate #endif /* _KERNEL */
2467c478bd9Sstevel@tonic-gate 
2477c478bd9Sstevel@tonic-gate #ifdef	__cplusplus
2487c478bd9Sstevel@tonic-gate }
2497c478bd9Sstevel@tonic-gate #endif
2507c478bd9Sstevel@tonic-gate 
2517c478bd9Sstevel@tonic-gate #endif	/* _SYS_PRIV_H */
252