1*8329232eSGordon Ross /*
2*8329232eSGordon Ross  * CDDL HEADER START
3*8329232eSGordon Ross  *
4*8329232eSGordon Ross  * The contents of this file are subject to the terms of the
5*8329232eSGordon Ross  * Common Development and Distribution License (the "License").
6*8329232eSGordon Ross  * You may not use this file except in compliance with the License.
7*8329232eSGordon Ross  *
8*8329232eSGordon Ross  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9*8329232eSGordon Ross  * or http://www.opensolaris.org/os/licensing.
10*8329232eSGordon Ross  * See the License for the specific language governing permissions
11*8329232eSGordon Ross  * and limitations under the License.
12*8329232eSGordon Ross  *
13*8329232eSGordon Ross  * When distributing Covered Code, include this CDDL HEADER in each
14*8329232eSGordon Ross  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15*8329232eSGordon Ross  * If applicable, add the following below this CDDL HEADER, with the
16*8329232eSGordon Ross  * fields enclosed by brackets "[]" replaced with your own identifying
17*8329232eSGordon Ross  * information: Portions Copyright [yyyy] [name of copyright owner]
18*8329232eSGordon Ross  *
19*8329232eSGordon Ross  * CDDL HEADER END
20*8329232eSGordon Ross  */
21*8329232eSGordon Ross /*
22*8329232eSGordon Ross  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23*8329232eSGordon Ross  * Copyright 2016 Joyent, Inc.
24*8329232eSGordon Ross  * Copyright (c) 2016 by Delphix. All rights reserved.
25*8329232eSGordon Ross  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
26*8329232eSGordon Ross  */
27*8329232eSGordon Ross 
28*8329232eSGordon Ross #include <sys/types.h>
29*8329232eSGordon Ross #include <sys/cred.h>
30*8329232eSGordon Ross #include <sys/errno.h>
31*8329232eSGordon Ross #include <sys/policy.h>
32*8329232eSGordon Ross 
33*8329232eSGordon Ross /* ARGSUSED */
34*8329232eSGordon Ross int
secpolicy_fs_allowed_mount(const char * fsname)35*8329232eSGordon Ross secpolicy_fs_allowed_mount(const char *fsname)
36*8329232eSGordon Ross {
37*8329232eSGordon Ross 	return (0);
38*8329232eSGordon Ross }
39*8329232eSGordon Ross 
40*8329232eSGordon Ross int
secpolicy_vnode_access2(const cred_t * cr,vnode_t * vp,uid_t owner,mode_t curmode,mode_t wantmode)41*8329232eSGordon Ross secpolicy_vnode_access2(const cred_t *cr, vnode_t *vp, uid_t owner,
42*8329232eSGordon Ross     mode_t curmode, mode_t wantmode)
43*8329232eSGordon Ross {
44*8329232eSGordon Ross 	mode_t mode;
45*8329232eSGordon Ross 
46*8329232eSGordon Ross 	mode = ~curmode & wantmode;
47*8329232eSGordon Ross 
48*8329232eSGordon Ross 	if (mode == 0)
49*8329232eSGordon Ross 		return (0);
50*8329232eSGordon Ross 	return (EACCES);
51*8329232eSGordon Ross }
52*8329232eSGordon Ross 
53*8329232eSGordon Ross int
secpolicy_vnode_owner(const cred_t * cr,uid_t owner)54*8329232eSGordon Ross secpolicy_vnode_owner(const cred_t *cr, uid_t owner)
55*8329232eSGordon Ross {
56*8329232eSGordon Ross 	/* cr->cr_uid */
57*8329232eSGordon Ross 	if (owner == crgetruid(cr))
58*8329232eSGordon Ross 		return (0);
59*8329232eSGordon Ross 
60*8329232eSGordon Ross 	return (EPERM);
61*8329232eSGordon Ross }
62*8329232eSGordon Ross 
63*8329232eSGordon Ross int
secpolicy_vnode_setattr(cred_t * cr,struct vnode * vp,struct vattr * vap,const struct vattr * ovap,int flags,int unlocked_access (void *,int,cred_t *),void * node)64*8329232eSGordon Ross secpolicy_vnode_setattr(cred_t *cr, struct vnode *vp, struct vattr *vap,
65*8329232eSGordon Ross     const struct vattr *ovap, int flags,
66*8329232eSGordon Ross     int unlocked_access(void *, int, cred_t *),
67*8329232eSGordon Ross     void *node)
68*8329232eSGordon Ross {
69*8329232eSGordon Ross 	int mask = vap->va_mask;
70*8329232eSGordon Ross 
71*8329232eSGordon Ross 	if (mask & AT_SIZE) {
72*8329232eSGordon Ross 		if (vp->v_type == VDIR)
73*8329232eSGordon Ross 			return (EISDIR);
74*8329232eSGordon Ross 	}
75*8329232eSGordon Ross 	if (mask & AT_MODE)
76*8329232eSGordon Ross 		return (EACCES);
77*8329232eSGordon Ross 	if (mask & (AT_UID|AT_GID))
78*8329232eSGordon Ross 		return (EACCES);
79*8329232eSGordon Ross 
80*8329232eSGordon Ross 	return (0);
81*8329232eSGordon Ross }
82*8329232eSGordon Ross 
83*8329232eSGordon Ross int
secpolicy_vnode_setdac(const cred_t * cred,uid_t owner)84*8329232eSGordon Ross secpolicy_vnode_setdac(const cred_t *cred, uid_t owner)
85*8329232eSGordon Ross {
86*8329232eSGordon Ross 	if (owner == crgetuid(cred))
87*8329232eSGordon Ross 		return (0);
88*8329232eSGordon Ross 
89*8329232eSGordon Ross 	return (EPERM);
90*8329232eSGordon Ross }