usr/src/uts/common/sys/priv.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #ifndef _SYS_PRIV_H
  27 #define _SYS_PRIV_H
  28
  29 #pragma ident   "%Z%%M% %I%     %E% SMI"        /* from TSOL 8 */
  30
  31 #include <sys/types.h>
  32 #include <sys/cred.h>
  33 #include <sys/priv_names.h>
  34
  35 #ifdef  __cplusplus
  36 extern "C" {
  37 #endif
  38
  39 typedef uint32_t priv_chunk_t;
  40 typedef struct priv_set priv_set_t;
  41
  42 #ifdef _KERNEL
  43
  44 /*
  45  * Kernel type definitions.
  46  */
  47 typedef int priv_ptype_t;
  48 typedef int priv_t;
  49
  50 #else /* _KERNEL */
  51
  52 /*
  53  * Userland type definitions.
  54  */
  55
  56 #ifdef __STDC__
  57 typedef const char *priv_ptype_t;
  58 typedef const char *priv_t;
  59 #else
  60 typedef char *priv_ptype_t;
  61 typedef char *priv_t;
  62 #endif
  63
  64 #endif /* _KERNEL */
  65
  66 /*
  67  * priv_op_t indicates a privilege operation type
  68  */
  69 typedef enum priv_op {
  70         PRIV_ON,
  71         PRIV_OFF,
  72         PRIV_SET
  73 } priv_op_t;
  74
  75 /*
  76  * Privilege system call subcodes.
  77  */
  78
  79 #define PRIVSYS_SETPPRIV        0
  80 #define PRIVSYS_GETPPRIV        1
  81 #define PRIVSYS_GETIMPLINFO     2
  82 #define PRIVSYS_SETPFLAGS       3
  83 #define PRIVSYS_GETPFLAGS       4
  84 #define PRIVSYS_ISSETUGID       5
  85 #define PRIVSYS_KLPD_REG        6
  86 #define PRIVSYS_KLPD_UNREG      7
  87
  88 /*
  89  * Maximum length of a user defined privilege name.
  90  */
  91 #define PRIVNAME_MAX            32
  92
  93 /*
  94  * Privilege interface functions for those parts of the kernel that
  95  * know nothing of the privilege internals.
  96  *
  97  * A privilege implementation can have a varying number of sets; sets
  98  * consist of a number of priv_chunk_t's and the size is expressed as such.
  99  * The privileges can be represented as
 100  *
 101  *              priv_chunk_t privs[info.priv_nsets][info.priv_setsize]
 102  *              ... priv_infosize of extra information ...
 103  *
 104  * Extra data contained in the privilege information consists of chunks
 105  * of data with specified size and type all headed by a priv_info_t header
 106  * which defines both the type of information as well as the size of the
 107  * information.  ((char*)&info)+info->priv_info_size should be rounded up
 108  * to point to the next piece of information.
 109  */
 110
 111 typedef struct priv_impl_info {
 112         uint32_t        priv_headersize;        /* sizeof (priv_impl_info) */
 113         uint32_t        priv_flags;             /* additional flags */
 114         uint32_t        priv_nsets;             /* number of priv sets */
 115         uint32_t        priv_setsize;           /* size in priv_chunk_t */
 116         uint32_t        priv_max;               /* highest actual valid priv */
 117         uint32_t        priv_infosize;          /* Per proc. additional info */
 118         uint32_t        priv_globalinfosize;    /* Per system info */
 119 } priv_impl_info_t;
 120
 121 #define PRIV_IMPL_INFO_SIZE(p) \
 122                         ((p)->priv_headersize + (p)->priv_globalinfosize)
 123
 124 #define PRIV_PRPRIV_INFO_OFFSET(p) \
 125                 (sizeof (*(p)) + \
 126                 ((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t))
 127
 128 #define PRIV_PRPRIV_SIZE(p) \
 129                 (PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize)
 130
 131 /*
 132  * Per credential flags.
 133  */
 134 #define PRIV_DEBUG                      0x0001          /* User debugging */
 135 #define PRIV_AWARE                      0x0002          /* Is privilege aware */
 136 #define PRIV_AWARE_INHERIT              0x0004          /* Inherit awareness */
 137 #define __PROC_PROTECT                  0x0008          /* Private */
 138 #define NET_MAC_AWARE                   0x0010          /* Is MAC aware */
 139 #define NET_MAC_AWARE_INHERIT           0x0020          /* Inherit MAC aware */
 140 #define PRIV_XPOLICY                    0x0080          /* Extended policy */
 141
 142 /* user-settable flags: */
 143 #define PRIV_USER       (PRIV_DEBUG | NET_MAC_AWARE | NET_MAC_AWARE_INHERIT |\
 144                             PRIV_XPOLICY)
 145
 146 /*
 147  * Header of the privilege info data structure; multiple structures can
 148  * follow the privilege sets and priv_impl_info structures.
 149  */
 150 typedef struct priv_info {
 151         uint32_t        priv_info_type;
 152         uint32_t        priv_info_size;
 153 } priv_info_t;
 154
 155 typedef struct priv_info_uint {
 156         priv_info_t     info;
 157         uint_t          val;
 158 } priv_info_uint_t;
 159
 160 /*
 161  * Global privilege set information item; the actual size of the array is
 162  * {priv_setsize}.
 163  */
 164 typedef struct priv_info_set {
 165         priv_info_t     info;
 166         priv_chunk_t    set[1];
 167 } priv_info_set_t;
 168
 169 /*
 170  * names[1] is a place holder which can contain multiple NUL terminated,
 171  * non-empty strings.
 172  */
 173
 174 typedef struct priv_info_names {
 175         priv_info_t     info;
 176         int             cnt;            /* number of strings */
 177         char            names[1];       /* "string1\0string2\0 ..stringN\0" */
 178 } priv_info_names_t;
 179
 180 /*
 181  * Privilege information types.
 182  */
 183 #define PRIV_INFO_SETNAMES              0x0001
 184 #define PRIV_INFO_PRIVNAMES             0x0002
 185 #define PRIV_INFO_BASICPRIVS            0x0003
 186 #define PRIV_INFO_FLAGS                 0x0004
 187
 188 /*
 189  * Special "privileges" used to indicate special conditions in privilege
 190  * debugging/tracing code.
 191  */
 192 #define PRIV_ALL                        (-1)    /* All privileges required */
 193 #define PRIV_MULTIPLE                   (-2)    /* More than one */
 194 #define PRIV_NONE                       (-3)    /* No value */
 195 #define PRIV_ALLZONE                    (-4)    /* All privileges in zone */
 196 #define PRIV_GLOBAL                     (-5)    /* Must be in global zone */
 197
 198 #ifdef _KERNEL
 199
 200 #define PRIV_ALLOC                      0x1
 201
 202 struct proc;
 203 struct prpriv;
 204 struct cred;
 205
 206 extern int priv_prgetprivsize(struct prpriv *);
 207 extern void cred2prpriv(const struct cred *, struct prpriv *);
 208 extern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *);
 209
 210 extern priv_impl_info_t *priv_hold_implinfo(void);
 211 extern void priv_release_implinfo(void);
 212 extern size_t priv_get_implinfo_size(void);
 213 extern const priv_set_t *priv_getset(const struct cred *, int);
 214 extern void priv_getinfo(const struct cred *, void *);
 215 extern int priv_getbyname(const char *, uint_t);
 216 extern int priv_getsetbyname(const char *, int);
 217 extern const char *priv_getbynum(int);
 218 extern const char *priv_getsetbynum(int);
 219
 220 extern void priv_emptyset(priv_set_t *);
 221 extern void priv_fillset(priv_set_t *);
 222 extern void priv_addset(priv_set_t *, int);
 223 extern void priv_delset(priv_set_t *, int);
 224 extern boolean_t priv_ismember(const priv_set_t *, int);
 225 extern boolean_t priv_isemptyset(const priv_set_t *);
 226 extern boolean_t priv_isfullset(const priv_set_t *);
 227 extern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *);
 228 extern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *);
 229 extern int priv_proc_cred_perm(const struct cred *, struct proc *,
 230         struct cred **, int);
 231 extern void priv_intersect(const priv_set_t *, priv_set_t *);
 232 extern void priv_union(const priv_set_t *, priv_set_t *);
 233 extern void priv_inverse(priv_set_t *);
 234
 235 extern void priv_set_PA(cred_t *);
 236 extern void priv_adjust_PA(cred_t *);
 237 extern boolean_t priv_can_clear_PA(const cred_t *);
 238
 239 extern int setpflags(uint_t, uint_t, cred_t *);
 240 extern uint_t getpflags(uint_t, const cred_t *);
 241
 242 #endif /* _KERNEL */
 243
 244 #ifdef  __cplusplus
 245 }
 246 #endif
 247
 248 #endif  /* _SYS_PRIV_H */