include/sys/priv.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
  23  *
  24  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  25  */
  26
  27 #ifndef _SYS_PRIV_H
  28 #define _SYS_PRIV_H
  29
  30 #include <sys/types.h>
  31 #include <sys/cred.h>
  32 #include <sys/priv_names.h>
  33
  34 #ifdef  __cplusplus
  35 extern "C" {
  36 #endif
  37
  38 typedef uint32_t priv_chunk_t;
  39 typedef struct priv_set priv_set_t;
  40
  41 #ifdef _KERNEL
  42
  43 /*
  44  * Kernel type definitions.
  45  */
  46 typedef int priv_ptype_t;
  47 typedef int priv_t;
  48
  49 #else /* _KERNEL */
  50
  51 /*
  52  * Userland type definitions.
  53  */
  54
  55 typedef const char *priv_ptype_t;
  56 typedef const char *priv_t;
  57
  58 #endif /* _KERNEL */
  59
  60 /*
  61  * priv_op_t indicates a privilege operation type
  62  */
  63 typedef enum priv_op {
  64         PRIV_ON,
  65         PRIV_OFF,
  66         PRIV_SET
  67 } priv_op_t;
  68
  69 /*
  70  * Privilege system call subcodes.
  71  */
  72
  73 #define PRIVSYS_SETPPRIV        0
  74 #define PRIVSYS_GETPPRIV        1
  75 #define PRIVSYS_GETIMPLINFO     2
  76 #define PRIVSYS_SETPFLAGS       3
  77 #define PRIVSYS_GETPFLAGS       4
  78 #define PRIVSYS_ISSETUGID       5
  79 #define PRIVSYS_KLPD_REG        6
  80 #define PRIVSYS_KLPD_UNREG      7
  81 #define PRIVSYS_PFEXEC_REG      8
  82 #define PRIVSYS_PFEXEC_UNREG    9
  83
  84
  85 /*
  86  * Maximum length of a user defined privilege name.
  87  */
  88 #define PRIVNAME_MAX            32
  89
  90 /*
  91  * Privilege interface functions for those parts of the kernel that
  92  * know nothing of the privilege internals.
  93  *
  94  * A privilege implementation can have a varying number of sets; sets
  95  * consist of a number of priv_chunk_t's and the size is expressed as such.
  96  * The privileges can be represented as
  97  *
  98  *              priv_chunk_t privs[info.priv_nsets][info.priv_setsize]
  99  *              ... priv_infosize of extra information ...
 100  *
 101  * Extra data contained in the privilege information consists of chunks
 102  * of data with specified size and type all headed by a priv_info_t header
 103  * which defines both the type of information as well as the size of the
 104  * information.  ((char*)&info)+info->priv_info_size should be rounded up
 105  * to point to the next piece of information.
 106  */
 107
 108 typedef struct priv_impl_info {
 109         uint32_t        priv_headersize;        /* sizeof (priv_impl_info) */
 110         uint32_t        priv_flags;             /* additional flags */
 111         uint32_t        priv_nsets;             /* number of priv sets */
 112         uint32_t        priv_setsize;           /* size in priv_chunk_t */
 113         uint32_t        priv_max;               /* highest actual valid priv */
 114         uint32_t        priv_infosize;          /* Per proc. additional info */
 115         uint32_t        priv_globalinfosize;    /* Per system info */
 116 } priv_impl_info_t;
 117
 118 #define PRIV_IMPL_INFO_SIZE(p) \
 119                         ((p)->priv_headersize + (p)->priv_globalinfosize)
 120
 121 #define PRIV_PRPRIV_INFO_OFFSET(p) \
 122                 (sizeof (*(p)) + \
 123                 ((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t))
 124
 125 #define PRIV_PRPRIV_SIZE(p) \
 126                 (PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize)
 127
 128 /*
 129  * Per credential flags.
 130  */
 131 #define PRIV_DEBUG                      0x0001          /* User debugging */
 132 #define PRIV_AWARE                      0x0002          /* Is privilege aware */
 133 #define PRIV_AWARE_INHERIT              0x0004          /* Inherit awareness */
 134 #define __PROC_PROTECT                  0x0008          /* Private */
 135 #define PRIV_AWARE_RESET                0x0040          /* Reset on setuid() */
 136 #define PRIV_XPOLICY                    0x0080          /* Extended policy */
 137 #define PRIV_PFEXEC                     0x0100          /* As if pfexec'ed */
 138
 139 /* user-settable flags: */
 140 #define PRIV_USER (PRIV_DEBUG | PRIV_XPOLICY | PRIV_AWARE_RESET | PRIV_PFEXEC)
 141
 142 /*
 143  * Header of the privilege info data structure; multiple structures can
 144  * follow the privilege sets and priv_impl_info structures.
 145  */
 146 typedef struct priv_info {
 147         uint32_t        priv_info_type;
 148         uint32_t        priv_info_size;
 149 } priv_info_t;
 150
 151 typedef struct priv_info_uint {
 152         priv_info_t     info;
 153         uint_t          val;
 154 } priv_info_uint_t;
 155
 156 /*
 157  * Global privilege set information item; the actual size of the array is
 158  * {priv_setsize}.
 159  */
 160 typedef struct priv_info_set {
 161         priv_info_t     info;
 162         priv_chunk_t    set[1];
 163 } priv_info_set_t;
 164
 165 /*
 166  * names[1] is a place holder which can contain multiple NUL terminated,
 167  * non-empty strings.
 168  */
 169
 170 typedef struct priv_info_names {
 171         priv_info_t     info;
 172         int             cnt;            /* number of strings */
 173         char            names[1];       /* "string1\0string2\0 ..stringN\0" */
 174 } priv_info_names_t;
 175
 176 /*
 177  * Privilege information types.
 178  */
 179 #define PRIV_INFO_SETNAMES              0x0001
 180 #define PRIV_INFO_PRIVNAMES             0x0002
 181 #define PRIV_INFO_BASICPRIVS            0x0003
 182 #define PRIV_INFO_FLAGS                 0x0004
 183
 184 /*
 185  * Special "privileges" used to indicate special conditions in privilege
 186  * debugging/tracing code.
 187  */
 188 #define PRIV_ALL                        (-1)    /* All privileges required */
 189 #define PRIV_MULTIPLE                   (-2)    /* More than one */
 190 #define PRIV_NONE                       (-3)    /* No value */
 191 #define PRIV_ALLZONE                    (-4)    /* All privileges in zone */
 192 #define PRIV_GLOBAL                     (-5)    /* Must be in global zone */
 193
 194 #ifdef _KERNEL
 195
 196 #define PRIV_ALLOC                      0x1
 197
 198 extern int priv_debug;
 199 extern int priv_basic_test;
 200
 201 struct proc;
 202 struct prpriv;
 203 struct cred;
 204
 205 extern int priv_prgetprivsize(struct prpriv *);
 206 extern void cred2prpriv(const struct cred *, struct prpriv *);
 207 extern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *);
 208
 209 extern priv_impl_info_t *priv_hold_implinfo(void);
 210 extern void priv_release_implinfo(void);
 211 extern size_t priv_get_implinfo_size(void);
 212 extern const priv_set_t *priv_getset(const struct cred *, int);
 213 extern void priv_getinfo(const struct cred *, void *);
 214 extern int priv_getbyname(const char *, uint_t);
 215 extern int priv_getsetbyname(const char *, int);
 216 extern const char *priv_getbynum(int);
 217 extern const char *priv_getsetbynum(int);
 218
 219 extern void priv_emptyset(priv_set_t *);
 220 extern void priv_fillset(priv_set_t *);
 221 extern void priv_addset(priv_set_t *, int);
 222 extern void priv_delset(priv_set_t *, int);
 223 extern boolean_t priv_ismember(const priv_set_t *, int);
 224 extern boolean_t priv_isemptyset(const priv_set_t *);
 225 extern boolean_t priv_isfullset(const priv_set_t *);
 226 extern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *);
 227 extern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *);
 228 extern int priv_proc_cred_perm(const struct cred *, struct proc *,
 229         struct cred **, int);
 230 extern void priv_intersect(const priv_set_t *, priv_set_t *);
 231 extern void priv_union(const priv_set_t *, priv_set_t *);
 232 extern void priv_inverse(priv_set_t *);
 233
 234 extern void priv_set_PA(cred_t *);
 235 extern void priv_adjust_PA(cred_t *);
 236 extern void priv_reset_PA(cred_t *, boolean_t);
 237 extern boolean_t priv_can_clear_PA(const cred_t *);
 238
 239 extern int setpflags(uint_t, uint_t, cred_t *);
 240 extern uint_t getpflags(uint_t, const cred_t *);
 241
 242 #endif /* _KERNEL */
 243
 244 #ifdef  __cplusplus
 245 }
 246 #endif
 247
 248 #endif  /* _SYS_PRIV_H */