1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2008-2010, 2015 Robert N. M. Watson
5 * Copyright (c) 2012 FreeBSD Foundation
6 * All rights reserved.
7 *
8 * This software was developed at the University of Cambridge Computer
9 * Laboratory with support from a grant from Google, Inc.
10 *
11 * Portions of this software were developed by Pawel Jakub Dawidek under
12 * sponsorship from the FreeBSD Foundation.
13 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 /*
37 * Definitions for FreeBSD capabilities facility.
38 */
39 #ifndef _SYS_CAPSICUM_H_
40 #define _SYS_CAPSICUM_H_
41
42 #include <sys/param.h>
43
44 #include <sys/caprights.h>
45 #include <sys/file.h>
46 #include <sys/fcntl.h>
47
48 #ifndef _KERNEL
49 #include <stdbool.h>
50 #endif
51
52 #define CAPRIGHT(idx, bit) ((1ULL << (57 + (idx))) | (bit))
53
54 /*
55 * The top 7 bits are reserved in all indices.
56 * Index 0 - 2 bit array size + 5 bit array element
57 * Index N - 2 bits of 0 + 5 bit array element
58 */
59 #define CAP_RESERVED 0xFE00000000000000ULL
60
61 /*
62 * Possible rights on capabilities.
63 *
64 * Notes:
65 * Some system calls don't require a capability in order to perform an
66 * operation on an fd. These include: close, dup, dup2.
67 *
68 * sendfile is authorized using CAP_READ on the file and CAP_WRITE on the
69 * socket.
70 *
71 * mmap() and aio*() system calls will need special attention as they may
72 * involve reads or writes depending a great deal on context.
73 */
74
75 /* INDEX 0 */
76
77 /*
78 * General file I/O.
79 */
80 /* Allows for openat(O_RDONLY), read(2), readv(2). */
81 #define CAP_READ CAPRIGHT(0, 0x0000000000000001ULL)
82 /* Allows for openat(O_WRONLY | O_APPEND), write(2), writev(2). */
83 #define CAP_WRITE CAPRIGHT(0, 0x0000000000000002ULL)
84 /* Allows for lseek(fd, 0, SEEK_CUR). */
85 #define CAP_SEEK_TELL CAPRIGHT(0, 0x0000000000000004ULL)
86 /* Allows for lseek(2). */
87 #define CAP_SEEK (CAP_SEEK_TELL | 0x0000000000000008ULL)
88 /* Allows for aio_read(2), pread(2), preadv(2). */
89 #define CAP_PREAD (CAP_SEEK | CAP_READ)
90 /*
91 * Allows for aio_write(2), openat(O_WRONLY) (without O_APPEND), pwrite(2),
92 * pwritev(2).
93 */
94 #define CAP_PWRITE (CAP_SEEK | CAP_WRITE)
95 /* Allows for mmap(PROT_NONE). */
96 #define CAP_MMAP CAPRIGHT(0, 0x0000000000000010ULL)
97 /* Allows for mmap(PROT_READ). */
98 #define CAP_MMAP_R (CAP_MMAP | CAP_SEEK | CAP_READ)
99 /* Allows for mmap(PROT_WRITE). */
100 #define CAP_MMAP_W (CAP_MMAP | CAP_SEEK | CAP_WRITE)
101 /* Allows for mmap(PROT_EXEC). */
102 #define CAP_MMAP_X (CAP_MMAP | CAP_SEEK | 0x0000000000000020ULL)
103 /* Allows for mmap(PROT_READ | PROT_WRITE). */
104 #define CAP_MMAP_RW (CAP_MMAP_R | CAP_MMAP_W)
105 /* Allows for mmap(PROT_READ | PROT_EXEC). */
106 #define CAP_MMAP_RX (CAP_MMAP_R | CAP_MMAP_X)
107 /* Allows for mmap(PROT_WRITE | PROT_EXEC). */
108 #define CAP_MMAP_WX (CAP_MMAP_W | CAP_MMAP_X)
109 /* Allows for mmap(PROT_READ | PROT_WRITE | PROT_EXEC). */
110 #define CAP_MMAP_RWX (CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X)
111 /* Allows for openat(O_CREAT). */
112 #define CAP_CREATE CAPRIGHT(0, 0x0000000000000040ULL)
113 /* Allows for openat(O_EXEC) and fexecve(2) in turn. */
114 #define CAP_FEXECVE CAPRIGHT(0, 0x0000000000000080ULL)
115 /* Allows for openat(O_SYNC), openat(O_FSYNC), fsync(2), aio_fsync(2). */
116 #define CAP_FSYNC CAPRIGHT(0, 0x0000000000000100ULL)
117 /* Allows for openat(O_TRUNC), ftruncate(2). */
118 #define CAP_FTRUNCATE CAPRIGHT(0, 0x0000000000000200ULL)
119
120 /* Lookups - used to constrain *at() calls. */
121 #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL)
122
123 /* VFS methods. */
124 /* Allows for fchdir(2). */
125 #define CAP_FCHDIR CAPRIGHT(0, 0x0000000000000800ULL)
126 /* Allows for fchflags(2). */
127 #define CAP_FCHFLAGS CAPRIGHT(0, 0x0000000000001000ULL)
128 /* Allows for fchflags(2) and chflagsat(2). */
129 #define CAP_CHFLAGSAT (CAP_FCHFLAGS | CAP_LOOKUP)
130 /* Allows for fchmod(2). */
131 #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL)
132 /* Allows for fchmod(2) and fchmodat(2). */
133 #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP)
134 /* Allows for fchown(2). */
135 #define CAP_FCHOWN CAPRIGHT(0, 0x0000000000004000ULL)
136 /* Allows for fchown(2) and fchownat(2). */
137 #define CAP_FCHOWNAT (CAP_FCHOWN | CAP_LOOKUP)
138 /* Allows for fcntl(2). */
139 #define CAP_FCNTL CAPRIGHT(0, 0x0000000000008000ULL)
140 /*
141 * Allows for flock(2), openat(O_SHLOCK), openat(O_EXLOCK),
142 * fcntl(F_SETLK_REMOTE), fcntl(F_SETLKW), fcntl(F_SETLK), fcntl(F_GETLK).
143 */
144 #define CAP_FLOCK CAPRIGHT(0, 0x0000000000010000ULL)
145 /* Allows for fpathconf(2). */
146 #define CAP_FPATHCONF CAPRIGHT(0, 0x0000000000020000ULL)
147 /* Allows for UFS background-fsck operations. */
148 #define CAP_FSCK CAPRIGHT(0, 0x0000000000040000ULL)
149 /* Allows for fstat(2). */
150 #define CAP_FSTAT CAPRIGHT(0, 0x0000000000080000ULL)
151 /* Allows for fstat(2), fstatat(2) and faccessat(2). */
152 #define CAP_FSTATAT (CAP_FSTAT | CAP_LOOKUP)
153 /* Allows for fstatfs(2). */
154 #define CAP_FSTATFS CAPRIGHT(0, 0x0000000000100000ULL)
155 /* Allows for futimens(2) and futimes(2). */
156 #define CAP_FUTIMES CAPRIGHT(0, 0x0000000000200000ULL)
157 /* Allows for futimens(2), futimes(2), futimesat(2) and utimensat(2). */
158 #define CAP_FUTIMESAT (CAP_FUTIMES | CAP_LOOKUP)
159 /* Allows for linkat(2) (target directory descriptor). */
160 #define CAP_LINKAT_TARGET (CAP_LOOKUP | 0x0000000000400000ULL)
161 /* Allows for mkdirat(2). */
162 #define CAP_MKDIRAT (CAP_LOOKUP | 0x0000000000800000ULL)
163 /* Allows for mkfifoat(2). */
164 #define CAP_MKFIFOAT (CAP_LOOKUP | 0x0000000001000000ULL)
165 /* Allows for mknodat(2). */
166 #define CAP_MKNODAT (CAP_LOOKUP | 0x0000000002000000ULL)
167 /* Allows for renameat(2) (source directory descriptor). */
168 #define CAP_RENAMEAT_SOURCE (CAP_LOOKUP | 0x0000000004000000ULL)
169 /* Allows for symlinkat(2). */
170 #define CAP_SYMLINKAT (CAP_LOOKUP | 0x0000000008000000ULL)
171 /*
172 * Allows for unlinkat(2) and renameat(2) if destination object exists and
173 * will be removed.
174 */
175 #define CAP_UNLINKAT (CAP_LOOKUP | 0x0000000010000000ULL)
176
177 /* Socket operations. */
178 /* Allows for accept(2) and accept4(2). */
179 #define CAP_ACCEPT CAPRIGHT(0, 0x0000000020000000ULL)
180 /* Allows for bind(2). */
181 #define CAP_BIND CAPRIGHT(0, 0x0000000040000000ULL)
182 /* Allows for connect(2). */
183 #define CAP_CONNECT CAPRIGHT(0, 0x0000000080000000ULL)
184 /* Allows for getpeername(2). */
185 #define CAP_GETPEERNAME CAPRIGHT(0, 0x0000000100000000ULL)
186 /* Allows for getsockname(2). */
187 #define CAP_GETSOCKNAME CAPRIGHT(0, 0x0000000200000000ULL)
188 /* Allows for getsockopt(2). */
189 #define CAP_GETSOCKOPT CAPRIGHT(0, 0x0000000400000000ULL)
190 /* Allows for listen(2). */
191 #define CAP_LISTEN CAPRIGHT(0, 0x0000000800000000ULL)
192 /* Allows for sctp_peeloff(2). */
193 #define CAP_PEELOFF CAPRIGHT(0, 0x0000001000000000ULL)
194 #define CAP_RECV CAP_READ
195 #define CAP_SEND CAP_WRITE
196 /* Allows for setsockopt(2). */
197 #define CAP_SETSOCKOPT CAPRIGHT(0, 0x0000002000000000ULL)
198 /* Allows for shutdown(2). */
199 #define CAP_SHUTDOWN CAPRIGHT(0, 0x0000004000000000ULL)
200
201 /* Allows for bindat(2) on a directory descriptor. */
202 #define CAP_BINDAT (CAP_LOOKUP | 0x0000008000000000ULL)
203 /* Allows for connectat(2) on a directory descriptor. */
204 #define CAP_CONNECTAT (CAP_LOOKUP | 0x0000010000000000ULL)
205
206 /* Allows for linkat(2) (source directory descriptor). */
207 #define CAP_LINKAT_SOURCE (CAP_LOOKUP | 0x0000020000000000ULL)
208 /* Allows for renameat(2) (target directory descriptor). */
209 #define CAP_RENAMEAT_TARGET (CAP_LOOKUP | 0x0000040000000000ULL)
210
211 /* Allows for fchroot(2). */
212 #define CAP_FCHROOT CAPRIGHT(0, 0x0000080000000000ULL)
213
214 #define CAP_SOCK_CLIENT \
215 (CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \
216 CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN)
217 #define CAP_SOCK_SERVER \
218 (CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \
219 CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \
220 CAP_SETSOCKOPT | CAP_SHUTDOWN)
221
222 #define CAP_UNUSED0_45 CAPRIGHT(0, 0x0000100000000000ULL)
223 #define CAP_UNUSED0_46 CAPRIGHT(0, 0x0000200000000000ULL)
224 #define CAP_UNUSED0_47 CAPRIGHT(0, 0x0000400000000000ULL)
225 #define CAP_UNUSED0_48 CAPRIGHT(0, 0x0000800000000000ULL)
226 #define CAP_UNUSED0_49 CAPRIGHT(0, 0x0001000000000000ULL)
227 #define CAP_UNUSED0_50 CAPRIGHT(0, 0x0002000000000000ULL)
228 #define CAP_UNUSED0_51 CAPRIGHT(0, 0x0004000000000000ULL)
229 #define CAP_UNUSED0_52 CAPRIGHT(0, 0x0008000000000000ULL)
230 #define CAP_UNUSED0_53 CAPRIGHT(0, 0x0010000000000000ULL)
231 #define CAP_UNUSED0_54 CAPRIGHT(0, 0x0020000000000000ULL)
232 #define CAP_UNUSED0_55 CAPRIGHT(0, 0x0040000000000000ULL)
233 #define CAP_UNUSED0_56 CAPRIGHT(0, 0x0080000000000000ULL)
234 #define CAP_UNUSED0_57 CAPRIGHT(0, 0x0100000000000000ULL)
235
236 /* All used bits for index 0. */
237 #define CAP_ALL0 CAPRIGHT(0, 0x00000FFFFFFFFFFFULL)
238
239 /* INDEX 1 */
240
241 /* Mandatory Access Control. */
242 /* Allows for mac_get_fd(3). */
243 #define CAP_MAC_GET CAPRIGHT(1, 0x0000000000000001ULL)
244 /* Allows for mac_set_fd(3). */
245 #define CAP_MAC_SET CAPRIGHT(1, 0x0000000000000002ULL)
246
247 /* Methods on semaphores. */
248 #define CAP_SEM_GETVALUE CAPRIGHT(1, 0x0000000000000004ULL)
249 #define CAP_SEM_POST CAPRIGHT(1, 0x0000000000000008ULL)
250 #define CAP_SEM_WAIT CAPRIGHT(1, 0x0000000000000010ULL)
251
252 /* Allows select(2) and poll(2) on descriptor. */
253 #define CAP_EVENT CAPRIGHT(1, 0x0000000000000020ULL)
254 /* Allows for kevent(2) on kqueue descriptor with eventlist != NULL. */
255 #define CAP_KQUEUE_EVENT CAPRIGHT(1, 0x0000000000000040ULL)
256
257 /* Strange and powerful rights that should not be given lightly. */
258 /* Allows for ioctl(2). */
259 #define CAP_IOCTL CAPRIGHT(1, 0x0000000000000080ULL)
260 #define CAP_TTYHOOK CAPRIGHT(1, 0x0000000000000100ULL)
261
262 /* Process management via process descriptors. */
263 /* Allows for pdgetpid(2). */
264 #define CAP_PDGETPID CAPRIGHT(1, 0x0000000000000200ULL)
265 /* Allows for pdwait(2). */
266 #define CAP_PDWAIT CAPRIGHT(1, 0x0000000000000400ULL)
267 /* Allows for pdkill(2). */
268 #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL)
269
270 /* Extended attributes. */
271 /* Allows for extattr_delete_fd(2). */
272 #define CAP_EXTATTR_DELETE CAPRIGHT(1, 0x0000000000001000ULL)
273 /* Allows for extattr_get_fd(2). */
274 #define CAP_EXTATTR_GET CAPRIGHT(1, 0x0000000000002000ULL)
275 /* Allows for extattr_list_fd(2). */
276 #define CAP_EXTATTR_LIST CAPRIGHT(1, 0x0000000000004000ULL)
277 /* Allows for extattr_set_fd(2). */
278 #define CAP_EXTATTR_SET CAPRIGHT(1, 0x0000000000008000ULL)
279
280 /* Access Control Lists. */
281 /* Allows for acl_valid_fd_np(3). */
282 #define CAP_ACL_CHECK CAPRIGHT(1, 0x0000000000010000ULL)
283 /* Allows for acl_delete_fd_np(3). */
284 #define CAP_ACL_DELETE CAPRIGHT(1, 0x0000000000020000ULL)
285 /* Allows for acl_get_fd(3) and acl_get_fd_np(3). */
286 #define CAP_ACL_GET CAPRIGHT(1, 0x0000000000040000ULL)
287 /* Allows for acl_set_fd(3) and acl_set_fd_np(3). */
288 #define CAP_ACL_SET CAPRIGHT(1, 0x0000000000080000ULL)
289
290 /* Allows for kevent(2) on kqueue descriptor with changelist != NULL. */
291 #define CAP_KQUEUE_CHANGE CAPRIGHT(1, 0x0000000000100000ULL)
292
293 #define CAP_KQUEUE (CAP_KQUEUE_EVENT | CAP_KQUEUE_CHANGE)
294
295 /* Allows operations on inotify descriptors. */
296 #define CAP_INOTIFY_ADD CAPRIGHT(1, 0x0000000000200000ULL)
297 #define CAP_INOTIFY_RM CAPRIGHT(1, 0x0000000000400000ULL)
298
299 /* Allows pddupfd(2). */
300 #define CAP_PDDUPFD CAPRIGHT(1, 0x0000000000800000ULL)
301
302 /* Allows ptrace(PT_PROCDESC) */
303 #define CAP_PTRACE CAPRIGHT(1, 0x0000000001000000ULL)
304
305 #define CAP_UNUSED1_26 CAPRIGHT(1, 0x0000000002000000ULL)
306 #define CAP_UNUSED1_27 CAPRIGHT(1, 0x0000000004000000ULL)
307 #define CAP_UNUSED1_28 CAPRIGHT(1, 0x0000000008000000ULL)
308 #define CAP_UNUSED1_29 CAPRIGHT(1, 0x0000000010000000ULL)
309 #define CAP_UNUSED1_30 CAPRIGHT(1, 0x0000000020000000ULL)
310 #define CAP_UNUSED1_31 CAPRIGHT(1, 0x0000000040000000ULL)
311 #define CAP_UNUSED1_32 CAPRIGHT(1, 0x0000000080000000ULL)
312 #define CAP_UNUSED1_33 CAPRIGHT(1, 0x0000000100000000ULL)
313 #define CAP_UNUSED1_34 CAPRIGHT(1, 0x0000000200000000ULL)
314 #define CAP_UNUSED1_35 CAPRIGHT(1, 0x0000000400000000ULL)
315 #define CAP_UNUSED1_36 CAPRIGHT(1, 0x0000000800000000ULL)
316 #define CAP_UNUSED1_37 CAPRIGHT(1, 0x0000001000000000ULL)
317 #define CAP_UNUSED1_38 CAPRIGHT(1, 0x0000002000000000ULL)
318 #define CAP_UNUSED1_39 CAPRIGHT(1, 0x0000004000000000ULL)
319 #define CAP_UNUSED1_40 CAPRIGHT(1, 0x0000008000000000ULL)
320 #define CAP_UNUSED1_41 CAPRIGHT(1, 0x0000010000000000ULL)
321 #define CAP_UNUSED1_42 CAPRIGHT(1, 0x0000020000000000ULL)
322 #define CAP_UNUSED1_43 CAPRIGHT(1, 0x0000040000000000ULL)
323 #define CAP_UNUSED1_44 CAPRIGHT(1, 0x0000080000000000ULL)
324 #define CAP_UNUSED1_45 CAPRIGHT(1, 0x0000100000000000ULL)
325 #define CAP_UNUSED1_46 CAPRIGHT(1, 0x0000200000000000ULL)
326 #define CAP_UNUSED1_47 CAPRIGHT(1, 0x0000400000000000ULL)
327 #define CAP_UNUSED1_48 CAPRIGHT(1, 0x0000800000000000ULL)
328 #define CAP_UNUSED1_49 CAPRIGHT(1, 0x0001000000000000ULL)
329 #define CAP_UNUSED1_50 CAPRIGHT(1, 0x0002000000000000ULL)
330 #define CAP_UNUSED1_51 CAPRIGHT(1, 0x0004000000000000ULL)
331 #define CAP_UNUSED1_52 CAPRIGHT(1, 0x0008000000000000ULL)
332 #define CAP_UNUSED1_53 CAPRIGHT(1, 0x0010000000000000ULL)
333 #define CAP_UNUSED1_54 CAPRIGHT(1, 0x0020000000000000ULL)
334 #define CAP_UNUSED1_55 CAPRIGHT(1, 0x0040000000000000ULL)
335 #define CAP_UNUSED1_56 CAPRIGHT(1, 0x0080000000000000ULL)
336 #define CAP_UNUSED1_57 CAPRIGHT(1, 0x0100000000000000ULL)
337
338 /* All default bits for index 1. */
339 #define CAP_ALL1 CAPRIGHT(1, 0x0000000001FFFFFFULL)
340
341 /* Backward compatibility. */
342 #define CAP_POLL_EVENT CAP_EVENT
343
344 #define CAP_ALL(rights) do { \
345 (rights)->cr_rights[0] = \
346 ((uint64_t)CAP_RIGHTS_VERSION << 62) | CAP_ALL0; \
347 (rights)->cr_rights[1] = CAP_ALL1; \
348 } while (0)
349
350 #define CAP_NONE(rights) do { \
351 (rights)->cr_rights[0] = \
352 ((uint64_t)CAP_RIGHTS_VERSION << 62) | CAPRIGHT(0, 0ULL); \
353 (rights)->cr_rights[1] = CAPRIGHT(1, 0ULL); \
354 } while (0)
355
356 #define CAPRVER(right) ((int)((right) >> 62))
357 #define CAPVER(rights) CAPRVER((rights)->cr_rights[0])
358 #define CAPARSIZE(rights) (CAPVER(rights) + 2)
359 #define CAPIDXBIT(right) ((int)(((right) >> 57) & 0x1F))
360
361 /*
362 * Allowed fcntl(2) commands.
363 */
364 #define CAP_FCNTL_GETFL (1 << F_GETFL)
365 #define CAP_FCNTL_SETFL (1 << F_SETFL)
366 #define CAP_FCNTL_GETOWN (1 << F_GETOWN)
367 #define CAP_FCNTL_SETOWN (1 << F_SETOWN)
368 #define CAP_FCNTL_ALL (CAP_FCNTL_GETFL | CAP_FCNTL_SETFL | \
369 CAP_FCNTL_GETOWN | CAP_FCNTL_SETOWN)
370
371 #define CAP_IOCTLS_ALL SSIZE_MAX
372
373 __BEGIN_DECLS
374
375 #define cap_rights_init(...) \
376 __cap_rights_init(CAP_RIGHTS_VERSION, __VA_ARGS__, 0ULL)
377 cap_rights_t *__cap_rights_init(int version, cap_rights_t *rights, ...);
378
379 #define cap_rights_set(...) \
380 __cap_rights_set(__VA_ARGS__, 0ULL)
381 cap_rights_t *__cap_rights_set(cap_rights_t *rights, ...);
382
383 #define cap_rights_clear(...) \
384 __cap_rights_clear(__VA_ARGS__, 0ULL)
385 cap_rights_t *__cap_rights_clear(cap_rights_t *rights, ...);
386
387 #define cap_rights_is_set(...) \
388 __cap_rights_is_set(__VA_ARGS__, 0ULL)
389 bool __cap_rights_is_set(const cap_rights_t *rights, ...);
390
391 bool cap_rights_is_empty(const cap_rights_t *rights);
392
393 bool cap_rights_is_valid(const cap_rights_t *rights);
394 cap_rights_t *cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
395 cap_rights_t *cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
396
397 #ifdef _KERNEL
398 /*
399 * We only support one size to reduce branching.
400 */
401 _Static_assert(CAP_RIGHTS_VERSION == CAP_RIGHTS_VERSION_00,
402 "unsupported version of capsicum rights");
403
404 #define cap_rights_init_zero(r) ({ \
405 cap_rights_t *_r = (r); \
406 CAP_NONE(_r); \
407 _r; \
408 })
409
410 #define cap_rights_init_one(r, right) ({ \
411 CTASSERT(CAPRVER(right) == CAP_RIGHTS_VERSION); \
412 cap_rights_t *_r = (r); \
413 CAP_NONE(_r); \
414 _r->cr_rights[CAPIDXBIT(right) - 1] |= right; \
415 _r; \
416 })
417
418 #define cap_rights_set_one(r, right) ({ \
419 CTASSERT(CAPRVER(right) == CAP_RIGHTS_VERSION); \
420 cap_rights_t *_r = (r); \
421 _r->cr_rights[CAPIDXBIT(right) - 1] |= right; \
422 _r; \
423 })
424
425 #define _CAP_RIGHTS_WORD_INITIALIZER(i, r) \
426 (CAPIDXBIT(r) == (i) + 1 ? (r) : 0ULL)
427
428 /*
429 * Define a set of up to two rights at compile time.
430 */
431 #define CAP_RIGHTS_INITIALIZER2(r1, r2) ((struct cap_rights){ \
432 .cr_rights = { \
433 [0] = ((uint64_t)CAP_RIGHTS_VERSION << 62) | \
434 _CAP_RIGHTS_WORD_INITIALIZER(0, r1) | \
435 _CAP_RIGHTS_WORD_INITIALIZER(0, r2), \
436 [1] = _CAP_RIGHTS_WORD_INITIALIZER(1, r1) | \
437 _CAP_RIGHTS_WORD_INITIALIZER(1, r2), \
438 }, \
439 })
440 #define CAP_RIGHTS_INITIALIZER(r) \
441 CAP_RIGHTS_INITIALIZER2(r, 0ULL)
442
443 /*
444 * Allow checking caps which are possibly getting modified at the same time.
445 * The caller is expected to determine whether the result is legitimate via
446 * other means, see fget_unlocked for an example.
447 */
448
449 static inline bool
cap_rights_contains_transient(const cap_rights_t * big,const cap_rights_t * little)450 cap_rights_contains_transient(const cap_rights_t *big, const cap_rights_t *little)
451 {
452
453 if (__predict_true(
454 (big->cr_rights[0] & little->cr_rights[0]) == little->cr_rights[0] &&
455 (big->cr_rights[1] & little->cr_rights[1]) == little->cr_rights[1]))
456 return (true);
457 return (false);
458 }
459
460 #define cap_rights_contains cap_rights_contains_transient
461
462 int cap_check_failed_notcapable(const cap_rights_t *havep,
463 const cap_rights_t *needp);
464
465 static inline int
cap_check_inline(const cap_rights_t * havep,const cap_rights_t * needp)466 cap_check_inline(const cap_rights_t *havep, const cap_rights_t *needp)
467 {
468
469 if (__predict_false(!cap_rights_contains(havep, needp)))
470 return (cap_check_failed_notcapable(havep, needp));
471 return (0);
472 }
473
474 static inline int
cap_check_inline_transient(const cap_rights_t * havep,const cap_rights_t * needp)475 cap_check_inline_transient(const cap_rights_t *havep, const cap_rights_t *needp)
476 {
477
478 if (__predict_false(!cap_rights_contains(havep, needp)))
479 return (1);
480 return (0);
481 }
482 #else
483 bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);
484 #endif
485
486 __END_DECLS
487
488 #ifdef _KERNEL
489
490 #include <sys/systm.h>
491 #include <sys/ktrace.h>
492
493 #ifdef KTRACE
494 #define CAP_TRACING(td) KTRPOINT((td), KTR_CAPFAIL)
495 #else
496 #define CAP_TRACING(td) 0
497 #endif
498
499 #define IN_CAPABILITY_MODE(td) (((td)->td_ucred->cr_flags & CRED_FLAG_CAPMODE) != 0)
500
501 struct filedesc;
502 struct filedescent;
503
504 /*
505 * Test whether a capability grants the requested rights.
506 */
507 int cap_check(const cap_rights_t *havep, const cap_rights_t *needp);
508 /*
509 * Convert capability rights into VM access flags.
510 */
511 vm_prot_t cap_rights_to_vmprot(const cap_rights_t *havep);
512
513 /*
514 * For the purposes of procstat(1) and similar tools, allow kern_descrip.c to
515 * extract the rights from a capability.
516 *
517 * Dereferencing fdep requires filedesc.h, but including it would cause
518 * significant pollution. Instead add a macro for consumers which want it,
519 * most notably kern_descrip.c.
520 */
521 #define cap_rights_fde_inline(fdep) (&(fdep)->fde_rights)
522
523 const cap_rights_t *cap_rights_fde(const struct filedescent *fde);
524 const cap_rights_t *cap_rights(struct filedesc *fdp, int fd);
525
526 int cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd);
527 int cap_fcntl_check_fde(struct filedescent *fde, int cmd);
528 int cap_fcntl_check(struct filedesc *fdp, int fd, int cmd);
529
530 extern bool trap_enotcap;
531
532 #else /* !_KERNEL */
533
534 __BEGIN_DECLS
535 /*
536 * cap_enter(): Cause the process to enter capability mode, which will
537 * prevent it from directly accessing global namespaces. System calls will
538 * be limited to process-local, process-inherited, or file descriptor
539 * operations. If already in capability mode, a no-op.
540 */
541 int cap_enter(void);
542
543 /*
544 * Are we sandboxed (in capability mode)?
545 * This is a libc wrapper around the cap_getmode(2) system call.
546 */
547 bool cap_sandboxed(void);
548
549 /*
550 * cap_getmode(): Are we in capability mode?
551 */
552 int cap_getmode(u_int *modep);
553
554 /*
555 * Limits capability rights for the given descriptor (CAP_*).
556 */
557 int cap_rights_limit(int fd, const cap_rights_t *rights);
558 /*
559 * Returns capability rights for the given descriptor.
560 */
561 #define cap_rights_get(fd, rights) \
562 __cap_rights_get(CAP_RIGHTS_VERSION, (fd), (rights))
563 int __cap_rights_get(int version, int fd, cap_rights_t *rights);
564 /*
565 * Limits allowed ioctls for the given descriptor.
566 */
567 int cap_ioctls_limit(int fd, const cap_ioctl_t *cmds, size_t ncmds);
568 /*
569 * Returns array of allowed ioctls for the given descriptor.
570 * If all ioctls are allowed, the cmds array is not populated and
571 * the function returns CAP_IOCTLS_ALL.
572 */
573 ssize_t cap_ioctls_get(int fd, cap_ioctl_t *cmds, size_t maxcmds);
574 /*
575 * Limits allowed fcntls for the given descriptor (CAP_FCNTL_*).
576 */
577 int cap_fcntls_limit(int fd, uint32_t fcntlrights);
578 /*
579 * Returns bitmask of allowed fcntls for the given descriptor.
580 */
581 int cap_fcntls_get(int fd, uint32_t *fcntlrightsp);
582
583 __END_DECLS
584
585 #endif /* !_KERNEL */
586
587 #endif /* !_SYS_CAPSICUM_H_ */
588