xref: /freebsd/sys/sys/capsicum.h (revision 5f82dd8e91610ceafe7ddbc702d97ffe7573f53f)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2008-2010, 2015 Robert N. M. Watson
5  * Copyright (c) 2012 FreeBSD Foundation
6  * All rights reserved.
7  *
8  * This software was developed at the University of Cambridge Computer
9  * Laboratory with support from a grant from Google, Inc.
10  *
11  * Portions of this software were developed by Pawel Jakub Dawidek under
12  * sponsorship from the FreeBSD Foundation.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 /*
37  * Definitions for FreeBSD capabilities facility.
38  */
39 #ifndef _SYS_CAPSICUM_H_
40 #define	_SYS_CAPSICUM_H_
41 
42 #include <sys/param.h>
43 
44 #include <sys/caprights.h>
45 #include <sys/file.h>
46 #include <sys/fcntl.h>
47 
48 #ifndef _KERNEL
49 #include <stdbool.h>
50 #endif
51 
52 #define	CAPRIGHT(idx, bit)	((1ULL << (57 + (idx))) | (bit))
53 
54 /*
55  * The top 7 bits are reserved in all indices.
56  *   Index 0 - 2 bit array size + 5 bit array element
57  *   Index N - 2 bits of 0 + 5 bit array element
58  */
59 #define	CAP_RESERVED		0xFE00000000000000ULL
60 
61 /*
62  * Possible rights on capabilities.
63  *
64  * Notes:
65  * Some system calls don't require a capability in order to perform an
66  * operation on an fd.  These include: close, dup, dup2.
67  *
68  * sendfile is authorized using CAP_READ on the file and CAP_WRITE on the
69  * socket.
70  *
71  * mmap() and aio*() system calls will need special attention as they may
72  * involve reads or writes depending a great deal on context.
73  */
74 
75 /* INDEX 0 */
76 
77 /*
78  * General file I/O.
79  */
80 /* Allows for openat(O_RDONLY), read(2), readv(2). */
81 #define	CAP_READ		CAPRIGHT(0, 0x0000000000000001ULL)
82 /* Allows for openat(O_WRONLY | O_APPEND), write(2), writev(2). */
83 #define	CAP_WRITE		CAPRIGHT(0, 0x0000000000000002ULL)
84 /* Allows for lseek(fd, 0, SEEK_CUR). */
85 #define	CAP_SEEK_TELL		CAPRIGHT(0, 0x0000000000000004ULL)
86 /* Allows for lseek(2). */
87 #define	CAP_SEEK		(CAP_SEEK_TELL | 0x0000000000000008ULL)
88 /* Allows for aio_read(2), pread(2), preadv(2). */
89 #define	CAP_PREAD		(CAP_SEEK | CAP_READ)
90 /*
91  * Allows for aio_write(2), openat(O_WRONLY) (without O_APPEND), pwrite(2),
92  * pwritev(2).
93  */
94 #define	CAP_PWRITE		(CAP_SEEK | CAP_WRITE)
95 /* Allows for mmap(PROT_NONE). */
96 #define	CAP_MMAP		CAPRIGHT(0, 0x0000000000000010ULL)
97 /* Allows for mmap(PROT_READ). */
98 #define	CAP_MMAP_R		(CAP_MMAP | CAP_SEEK | CAP_READ)
99 /* Allows for mmap(PROT_WRITE). */
100 #define	CAP_MMAP_W		(CAP_MMAP | CAP_SEEK | CAP_WRITE)
101 /* Allows for mmap(PROT_EXEC). */
102 #define	CAP_MMAP_X		(CAP_MMAP | CAP_SEEK | 0x0000000000000020ULL)
103 /* Allows for mmap(PROT_READ | PROT_WRITE). */
104 #define	CAP_MMAP_RW		(CAP_MMAP_R | CAP_MMAP_W)
105 /* Allows for mmap(PROT_READ | PROT_EXEC). */
106 #define	CAP_MMAP_RX		(CAP_MMAP_R | CAP_MMAP_X)
107 /* Allows for mmap(PROT_WRITE | PROT_EXEC). */
108 #define	CAP_MMAP_WX		(CAP_MMAP_W | CAP_MMAP_X)
109 /* Allows for mmap(PROT_READ | PROT_WRITE | PROT_EXEC). */
110 #define	CAP_MMAP_RWX		(CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X)
111 /* Allows for openat(O_CREAT). */
112 #define	CAP_CREATE		CAPRIGHT(0, 0x0000000000000040ULL)
113 /* Allows for openat(O_EXEC) and fexecve(2) in turn. */
114 #define	CAP_FEXECVE		CAPRIGHT(0, 0x0000000000000080ULL)
115 /* Allows for openat(O_SYNC), openat(O_FSYNC), fsync(2), aio_fsync(2). */
116 #define	CAP_FSYNC		CAPRIGHT(0, 0x0000000000000100ULL)
117 /* Allows for openat(O_TRUNC), ftruncate(2). */
118 #define	CAP_FTRUNCATE		CAPRIGHT(0, 0x0000000000000200ULL)
119 
120 /* Lookups - used to constrain *at() calls. */
121 #define	CAP_LOOKUP		CAPRIGHT(0, 0x0000000000000400ULL)
122 
123 /* VFS methods. */
124 /* Allows for fchdir(2). */
125 #define	CAP_FCHDIR		CAPRIGHT(0, 0x0000000000000800ULL)
126 /* Allows for fchflags(2). */
127 #define	CAP_FCHFLAGS		CAPRIGHT(0, 0x0000000000001000ULL)
128 /* Allows for fchflags(2) and chflagsat(2). */
129 #define	CAP_CHFLAGSAT		(CAP_FCHFLAGS | CAP_LOOKUP)
130 /* Allows for fchmod(2). */
131 #define	CAP_FCHMOD		CAPRIGHT(0, 0x0000000000002000ULL)
132 /* Allows for fchmod(2) and fchmodat(2). */
133 #define	CAP_FCHMODAT		(CAP_FCHMOD | CAP_LOOKUP)
134 /* Allows for fchown(2). */
135 #define	CAP_FCHOWN		CAPRIGHT(0, 0x0000000000004000ULL)
136 /* Allows for fchown(2) and fchownat(2). */
137 #define	CAP_FCHOWNAT		(CAP_FCHOWN | CAP_LOOKUP)
138 /* Allows for fcntl(2). */
139 #define	CAP_FCNTL		CAPRIGHT(0, 0x0000000000008000ULL)
140 /*
141  * Allows for flock(2), openat(O_SHLOCK), openat(O_EXLOCK),
142  * fcntl(F_SETLK_REMOTE), fcntl(F_SETLKW), fcntl(F_SETLK), fcntl(F_GETLK).
143  */
144 #define	CAP_FLOCK		CAPRIGHT(0, 0x0000000000010000ULL)
145 /* Allows for fpathconf(2). */
146 #define	CAP_FPATHCONF		CAPRIGHT(0, 0x0000000000020000ULL)
147 /* Allows for UFS background-fsck operations. */
148 #define	CAP_FSCK		CAPRIGHT(0, 0x0000000000040000ULL)
149 /* Allows for fstat(2). */
150 #define	CAP_FSTAT		CAPRIGHT(0, 0x0000000000080000ULL)
151 /* Allows for fstat(2), fstatat(2) and faccessat(2). */
152 #define	CAP_FSTATAT		(CAP_FSTAT | CAP_LOOKUP)
153 /* Allows for fstatfs(2). */
154 #define	CAP_FSTATFS		CAPRIGHT(0, 0x0000000000100000ULL)
155 /* Allows for futimens(2) and futimes(2). */
156 #define	CAP_FUTIMES		CAPRIGHT(0, 0x0000000000200000ULL)
157 /* Allows for futimens(2), futimes(2), futimesat(2) and utimensat(2). */
158 #define	CAP_FUTIMESAT		(CAP_FUTIMES | CAP_LOOKUP)
159 /* Allows for linkat(2) (target directory descriptor). */
160 #define	CAP_LINKAT_TARGET	(CAP_LOOKUP | 0x0000000000400000ULL)
161 /* Allows for mkdirat(2). */
162 #define	CAP_MKDIRAT		(CAP_LOOKUP | 0x0000000000800000ULL)
163 /* Allows for mkfifoat(2). */
164 #define	CAP_MKFIFOAT		(CAP_LOOKUP | 0x0000000001000000ULL)
165 /* Allows for mknodat(2). */
166 #define	CAP_MKNODAT		(CAP_LOOKUP | 0x0000000002000000ULL)
167 /* Allows for renameat(2) (source directory descriptor). */
168 #define	CAP_RENAMEAT_SOURCE	(CAP_LOOKUP | 0x0000000004000000ULL)
169 /* Allows for symlinkat(2). */
170 #define	CAP_SYMLINKAT		(CAP_LOOKUP | 0x0000000008000000ULL)
171 /*
172  * Allows for unlinkat(2) and renameat(2) if destination object exists and
173  * will be removed.
174  */
175 #define	CAP_UNLINKAT		(CAP_LOOKUP | 0x0000000010000000ULL)
176 
177 /* Socket operations. */
178 /* Allows for accept(2) and accept4(2). */
179 #define	CAP_ACCEPT		CAPRIGHT(0, 0x0000000020000000ULL)
180 /* Allows for bind(2). */
181 #define	CAP_BIND		CAPRIGHT(0, 0x0000000040000000ULL)
182 /* Allows for connect(2). */
183 #define	CAP_CONNECT		CAPRIGHT(0, 0x0000000080000000ULL)
184 /* Allows for getpeername(2). */
185 #define	CAP_GETPEERNAME		CAPRIGHT(0, 0x0000000100000000ULL)
186 /* Allows for getsockname(2). */
187 #define	CAP_GETSOCKNAME		CAPRIGHT(0, 0x0000000200000000ULL)
188 /* Allows for getsockopt(2). */
189 #define	CAP_GETSOCKOPT		CAPRIGHT(0, 0x0000000400000000ULL)
190 /* Allows for listen(2). */
191 #define	CAP_LISTEN		CAPRIGHT(0, 0x0000000800000000ULL)
192 /* Allows for sctp_peeloff(2). */
193 #define	CAP_PEELOFF		CAPRIGHT(0, 0x0000001000000000ULL)
194 #define	CAP_RECV		CAP_READ
195 #define	CAP_SEND		CAP_WRITE
196 /* Allows for setsockopt(2). */
197 #define	CAP_SETSOCKOPT		CAPRIGHT(0, 0x0000002000000000ULL)
198 /* Allows for shutdown(2). */
199 #define	CAP_SHUTDOWN		CAPRIGHT(0, 0x0000004000000000ULL)
200 
201 /* Allows for bindat(2) on a directory descriptor. */
202 #define	CAP_BINDAT		(CAP_LOOKUP | 0x0000008000000000ULL)
203 /* Allows for connectat(2) on a directory descriptor. */
204 #define	CAP_CONNECTAT		(CAP_LOOKUP | 0x0000010000000000ULL)
205 
206 /* Allows for linkat(2) (source directory descriptor). */
207 #define	CAP_LINKAT_SOURCE	(CAP_LOOKUP | 0x0000020000000000ULL)
208 /* Allows for renameat(2) (target directory descriptor). */
209 #define	CAP_RENAMEAT_TARGET	(CAP_LOOKUP | 0x0000040000000000ULL)
210 
211 /* Allows for fchroot(2). */
212 #define	CAP_FCHROOT		CAPRIGHT(0, 0x0000080000000000ULL)
213 
214 #define	CAP_SOCK_CLIENT \
215 	(CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \
216 	 CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN)
217 #define	CAP_SOCK_SERVER \
218 	(CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \
219 	 CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \
220 	 CAP_SETSOCKOPT | CAP_SHUTDOWN)
221 
222 #define	CAP_UNUSED0_45		CAPRIGHT(0, 0x0000100000000000ULL)
223 #define	CAP_UNUSED0_46		CAPRIGHT(0, 0x0000200000000000ULL)
224 #define	CAP_UNUSED0_47		CAPRIGHT(0, 0x0000400000000000ULL)
225 #define	CAP_UNUSED0_48		CAPRIGHT(0, 0x0000800000000000ULL)
226 #define	CAP_UNUSED0_49		CAPRIGHT(0, 0x0001000000000000ULL)
227 #define	CAP_UNUSED0_50		CAPRIGHT(0, 0x0002000000000000ULL)
228 #define	CAP_UNUSED0_51		CAPRIGHT(0, 0x0004000000000000ULL)
229 #define	CAP_UNUSED0_52		CAPRIGHT(0, 0x0008000000000000ULL)
230 #define	CAP_UNUSED0_53		CAPRIGHT(0, 0x0010000000000000ULL)
231 #define	CAP_UNUSED0_54		CAPRIGHT(0, 0x0020000000000000ULL)
232 #define	CAP_UNUSED0_55		CAPRIGHT(0, 0x0040000000000000ULL)
233 #define	CAP_UNUSED0_56		CAPRIGHT(0, 0x0080000000000000ULL)
234 #define	CAP_UNUSED0_57		CAPRIGHT(0, 0x0100000000000000ULL)
235 
236 /* All used bits for index 0. */
237 #define	CAP_ALL0		CAPRIGHT(0, 0x00000FFFFFFFFFFFULL)
238 
239 /* INDEX 1 */
240 
241 /* Mandatory Access Control. */
242 /* Allows for mac_get_fd(3). */
243 #define	CAP_MAC_GET		CAPRIGHT(1, 0x0000000000000001ULL)
244 /* Allows for mac_set_fd(3). */
245 #define	CAP_MAC_SET		CAPRIGHT(1, 0x0000000000000002ULL)
246 
247 /* Methods on semaphores. */
248 #define	CAP_SEM_GETVALUE	CAPRIGHT(1, 0x0000000000000004ULL)
249 #define	CAP_SEM_POST		CAPRIGHT(1, 0x0000000000000008ULL)
250 #define	CAP_SEM_WAIT		CAPRIGHT(1, 0x0000000000000010ULL)
251 
252 /* Allows select(2) and poll(2) on descriptor. */
253 #define	CAP_EVENT		CAPRIGHT(1, 0x0000000000000020ULL)
254 /* Allows for kevent(2) on kqueue descriptor with eventlist != NULL. */
255 #define	CAP_KQUEUE_EVENT	CAPRIGHT(1, 0x0000000000000040ULL)
256 
257 /* Strange and powerful rights that should not be given lightly. */
258 /* Allows for ioctl(2). */
259 #define	CAP_IOCTL		CAPRIGHT(1, 0x0000000000000080ULL)
260 #define	CAP_TTYHOOK		CAPRIGHT(1, 0x0000000000000100ULL)
261 
262 /* Process management via process descriptors. */
263 /* Allows for pdgetpid(2). */
264 #define	CAP_PDGETPID		CAPRIGHT(1, 0x0000000000000200ULL)
265 /* Allows for pdwait(2). */
266 #define	CAP_PDWAIT		CAPRIGHT(1, 0x0000000000000400ULL)
267 /* Allows for pdkill(2). */
268 #define	CAP_PDKILL		CAPRIGHT(1, 0x0000000000000800ULL)
269 
270 /* Extended attributes. */
271 /* Allows for extattr_delete_fd(2). */
272 #define	CAP_EXTATTR_DELETE	CAPRIGHT(1, 0x0000000000001000ULL)
273 /* Allows for extattr_get_fd(2). */
274 #define	CAP_EXTATTR_GET		CAPRIGHT(1, 0x0000000000002000ULL)
275 /* Allows for extattr_list_fd(2). */
276 #define	CAP_EXTATTR_LIST	CAPRIGHT(1, 0x0000000000004000ULL)
277 /* Allows for extattr_set_fd(2). */
278 #define	CAP_EXTATTR_SET		CAPRIGHT(1, 0x0000000000008000ULL)
279 
280 /* Access Control Lists. */
281 /* Allows for acl_valid_fd_np(3). */
282 #define	CAP_ACL_CHECK		CAPRIGHT(1, 0x0000000000010000ULL)
283 /* Allows for acl_delete_fd_np(3). */
284 #define	CAP_ACL_DELETE		CAPRIGHT(1, 0x0000000000020000ULL)
285 /* Allows for acl_get_fd(3) and acl_get_fd_np(3). */
286 #define	CAP_ACL_GET		CAPRIGHT(1, 0x0000000000040000ULL)
287 /* Allows for acl_set_fd(3) and acl_set_fd_np(3). */
288 #define	CAP_ACL_SET		CAPRIGHT(1, 0x0000000000080000ULL)
289 
290 /* Allows for kevent(2) on kqueue descriptor with changelist != NULL. */
291 #define	CAP_KQUEUE_CHANGE	CAPRIGHT(1, 0x0000000000100000ULL)
292 
293 #define	CAP_KQUEUE		(CAP_KQUEUE_EVENT | CAP_KQUEUE_CHANGE)
294 
295 /* Allows operations on inotify descriptors. */
296 #define	CAP_INOTIFY_ADD		CAPRIGHT(1, 0x0000000000200000ULL)
297 #define	CAP_INOTIFY_RM		CAPRIGHT(1, 0x0000000000400000ULL)
298 
299 /* Allows pddupfd(2). */
300 #define	CAP_PDDUPFD		CAPRIGHT(1, 0x0000000000800000ULL)
301 
302 /* Allows ptrace(PT_PROCDESC) */
303 #define	CAP_PTRACE		CAPRIGHT(1, 0x0000000001000000ULL)
304 
305 #define	CAP_UNUSED1_26		CAPRIGHT(1, 0x0000000002000000ULL)
306 #define	CAP_UNUSED1_27		CAPRIGHT(1, 0x0000000004000000ULL)
307 #define	CAP_UNUSED1_28		CAPRIGHT(1, 0x0000000008000000ULL)
308 #define	CAP_UNUSED1_29		CAPRIGHT(1, 0x0000000010000000ULL)
309 #define	CAP_UNUSED1_30		CAPRIGHT(1, 0x0000000020000000ULL)
310 #define	CAP_UNUSED1_31		CAPRIGHT(1, 0x0000000040000000ULL)
311 #define	CAP_UNUSED1_32		CAPRIGHT(1, 0x0000000080000000ULL)
312 #define	CAP_UNUSED1_33		CAPRIGHT(1, 0x0000000100000000ULL)
313 #define	CAP_UNUSED1_34		CAPRIGHT(1, 0x0000000200000000ULL)
314 #define	CAP_UNUSED1_35		CAPRIGHT(1, 0x0000000400000000ULL)
315 #define	CAP_UNUSED1_36		CAPRIGHT(1, 0x0000000800000000ULL)
316 #define	CAP_UNUSED1_37		CAPRIGHT(1, 0x0000001000000000ULL)
317 #define	CAP_UNUSED1_38		CAPRIGHT(1, 0x0000002000000000ULL)
318 #define	CAP_UNUSED1_39		CAPRIGHT(1, 0x0000004000000000ULL)
319 #define	CAP_UNUSED1_40		CAPRIGHT(1, 0x0000008000000000ULL)
320 #define	CAP_UNUSED1_41		CAPRIGHT(1, 0x0000010000000000ULL)
321 #define	CAP_UNUSED1_42		CAPRIGHT(1, 0x0000020000000000ULL)
322 #define	CAP_UNUSED1_43		CAPRIGHT(1, 0x0000040000000000ULL)
323 #define	CAP_UNUSED1_44		CAPRIGHT(1, 0x0000080000000000ULL)
324 #define	CAP_UNUSED1_45		CAPRIGHT(1, 0x0000100000000000ULL)
325 #define	CAP_UNUSED1_46		CAPRIGHT(1, 0x0000200000000000ULL)
326 #define	CAP_UNUSED1_47		CAPRIGHT(1, 0x0000400000000000ULL)
327 #define	CAP_UNUSED1_48		CAPRIGHT(1, 0x0000800000000000ULL)
328 #define	CAP_UNUSED1_49		CAPRIGHT(1, 0x0001000000000000ULL)
329 #define	CAP_UNUSED1_50		CAPRIGHT(1, 0x0002000000000000ULL)
330 #define	CAP_UNUSED1_51		CAPRIGHT(1, 0x0004000000000000ULL)
331 #define	CAP_UNUSED1_52		CAPRIGHT(1, 0x0008000000000000ULL)
332 #define	CAP_UNUSED1_53		CAPRIGHT(1, 0x0010000000000000ULL)
333 #define	CAP_UNUSED1_54		CAPRIGHT(1, 0x0020000000000000ULL)
334 #define	CAP_UNUSED1_55		CAPRIGHT(1, 0x0040000000000000ULL)
335 #define	CAP_UNUSED1_56		CAPRIGHT(1, 0x0080000000000000ULL)
336 #define	CAP_UNUSED1_57		CAPRIGHT(1, 0x0100000000000000ULL)
337 
338 /* All default bits for index 1. */
339 #define	CAP_ALL1		CAPRIGHT(1, 0x0000000001FFFFFFULL)
340 
341 /* Backward compatibility. */
342 #define	CAP_POLL_EVENT		CAP_EVENT
343 
344 #define	CAP_ALL(rights)		do {					\
345 	(rights)->cr_rights[0] =					\
346 	    ((uint64_t)CAP_RIGHTS_VERSION << 62) | CAP_ALL0;		\
347 	(rights)->cr_rights[1] = CAP_ALL1;				\
348 } while (0)
349 
350 #define	CAP_NONE(rights)	do {					\
351 	(rights)->cr_rights[0] =					\
352 	    ((uint64_t)CAP_RIGHTS_VERSION << 62) | CAPRIGHT(0, 0ULL);	\
353 	(rights)->cr_rights[1] = CAPRIGHT(1, 0ULL);			\
354 } while (0)
355 
356 #define	CAPRVER(right)		((int)((right) >> 62))
357 #define	CAPVER(rights)		CAPRVER((rights)->cr_rights[0])
358 #define	CAPARSIZE(rights)	(CAPVER(rights) + 2)
359 #define	CAPIDXBIT(right)	((int)(((right) >> 57) & 0x1F))
360 
361 /*
362  * Allowed fcntl(2) commands.
363  */
364 #define	CAP_FCNTL_GETFL		(1 << F_GETFL)
365 #define	CAP_FCNTL_SETFL		(1 << F_SETFL)
366 #define	CAP_FCNTL_GETOWN	(1 << F_GETOWN)
367 #define	CAP_FCNTL_SETOWN	(1 << F_SETOWN)
368 #define	CAP_FCNTL_ALL		(CAP_FCNTL_GETFL | CAP_FCNTL_SETFL | \
369 				 CAP_FCNTL_GETOWN | CAP_FCNTL_SETOWN)
370 
371 #define	CAP_IOCTLS_ALL	SSIZE_MAX
372 
373 __BEGIN_DECLS
374 
375 #define	cap_rights_init(...)						\
376 	__cap_rights_init(CAP_RIGHTS_VERSION, __VA_ARGS__, 0ULL)
377 cap_rights_t *__cap_rights_init(int version, cap_rights_t *rights, ...);
378 
379 #define	cap_rights_set(...)						\
380 	__cap_rights_set(__VA_ARGS__, 0ULL)
381 cap_rights_t *__cap_rights_set(cap_rights_t *rights, ...);
382 
383 #define	cap_rights_clear(...)						\
384 	__cap_rights_clear(__VA_ARGS__, 0ULL)
385 cap_rights_t *__cap_rights_clear(cap_rights_t *rights, ...);
386 
387 #define	cap_rights_is_set(...)						\
388 	__cap_rights_is_set(__VA_ARGS__, 0ULL)
389 bool __cap_rights_is_set(const cap_rights_t *rights, ...);
390 
391 bool cap_rights_is_empty(const cap_rights_t *rights);
392 
393 bool cap_rights_is_valid(const cap_rights_t *rights);
394 cap_rights_t *cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
395 cap_rights_t *cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
396 
397 #ifdef _KERNEL
398 /*
399  * We only support one size to reduce branching.
400  */
401 _Static_assert(CAP_RIGHTS_VERSION == CAP_RIGHTS_VERSION_00,
402     "unsupported version of capsicum rights");
403 
404 #define cap_rights_init_zero(r) ({					\
405 	cap_rights_t *_r = (r);						\
406 	CAP_NONE(_r);							\
407 	_r;								\
408 })
409 
410 #define cap_rights_init_one(r, right) ({				\
411 	CTASSERT(CAPRVER(right) == CAP_RIGHTS_VERSION);			\
412 	cap_rights_t *_r = (r);						\
413 	CAP_NONE(_r);							\
414 	_r->cr_rights[CAPIDXBIT(right) - 1] |= right;			\
415 	_r;								\
416 })
417 
418 #define cap_rights_set_one(r, right) ({					\
419 	CTASSERT(CAPRVER(right) == CAP_RIGHTS_VERSION);			\
420 	cap_rights_t *_r = (r);						\
421 	_r->cr_rights[CAPIDXBIT(right) - 1] |= right;			\
422 	_r;								\
423 })
424 
425 #define	_CAP_RIGHTS_WORD_INITIALIZER(i, r)				\
426 	(CAPIDXBIT(r) == (i) + 1 ? (r) : 0ULL)
427 
428 /*
429  * Define a set of up to two rights at compile time.
430  */
431 #define	CAP_RIGHTS_INITIALIZER2(r1, r2) ((struct cap_rights){		\
432 	.cr_rights = {							\
433 		[0] = ((uint64_t)CAP_RIGHTS_VERSION << 62) |		\
434 		    _CAP_RIGHTS_WORD_INITIALIZER(0, r1) |		\
435 		    _CAP_RIGHTS_WORD_INITIALIZER(0, r2),		\
436 		[1] = _CAP_RIGHTS_WORD_INITIALIZER(1, r1) |		\
437 		    _CAP_RIGHTS_WORD_INITIALIZER(1, r2),		\
438 	},								\
439 })
440 #define	CAP_RIGHTS_INITIALIZER(r)					\
441 	CAP_RIGHTS_INITIALIZER2(r, 0ULL)
442 
443 /*
444  * Allow checking caps which are possibly getting modified at the same time.
445  * The caller is expected to determine whether the result is legitimate via
446  * other means, see fget_unlocked for an example.
447  */
448 
449 static inline bool
cap_rights_contains_transient(const cap_rights_t * big,const cap_rights_t * little)450 cap_rights_contains_transient(const cap_rights_t *big, const cap_rights_t *little)
451 {
452 
453         if (__predict_true(
454             (big->cr_rights[0] & little->cr_rights[0]) == little->cr_rights[0] &&
455             (big->cr_rights[1] & little->cr_rights[1]) == little->cr_rights[1]))
456                 return (true);
457         return (false);
458 }
459 
460 #define cap_rights_contains cap_rights_contains_transient
461 
462 int cap_check_failed_notcapable(const cap_rights_t *havep,
463     const cap_rights_t *needp);
464 
465 static inline int
cap_check_inline(const cap_rights_t * havep,const cap_rights_t * needp)466 cap_check_inline(const cap_rights_t *havep, const cap_rights_t *needp)
467 {
468 
469         if (__predict_false(!cap_rights_contains(havep, needp)))
470 		return (cap_check_failed_notcapable(havep, needp));
471         return (0);
472 }
473 
474 static inline int
cap_check_inline_transient(const cap_rights_t * havep,const cap_rights_t * needp)475 cap_check_inline_transient(const cap_rights_t *havep, const cap_rights_t *needp)
476 {
477 
478         if (__predict_false(!cap_rights_contains(havep, needp)))
479 		return (1);
480         return (0);
481 }
482 #else
483 bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);
484 #endif
485 
486 __END_DECLS
487 
488 #ifdef _KERNEL
489 
490 #include <sys/systm.h>
491 #include <sys/ktrace.h>
492 
493 #ifdef KTRACE
494 #define CAP_TRACING(td) KTRPOINT((td), KTR_CAPFAIL)
495 #else
496 #define CAP_TRACING(td) 0
497 #endif
498 
499 #define IN_CAPABILITY_MODE(td) (((td)->td_ucred->cr_flags & CRED_FLAG_CAPMODE) != 0)
500 
501 struct filedesc;
502 struct filedescent;
503 
504 /*
505  * Test whether a capability grants the requested rights.
506  */
507 int	cap_check(const cap_rights_t *havep, const cap_rights_t *needp);
508 /*
509  * Convert capability rights into VM access flags.
510  */
511 vm_prot_t	cap_rights_to_vmprot(const cap_rights_t *havep);
512 
513 /*
514  * For the purposes of procstat(1) and similar tools, allow kern_descrip.c to
515  * extract the rights from a capability.
516  *
517  * Dereferencing fdep requires filedesc.h, but including it would cause
518  * significant pollution. Instead add a macro for consumers which want it,
519  * most notably kern_descrip.c.
520  */
521 #define cap_rights_fde_inline(fdep)	(&(fdep)->fde_rights)
522 
523 const cap_rights_t	*cap_rights_fde(const struct filedescent *fde);
524 const cap_rights_t	*cap_rights(struct filedesc *fdp, int fd);
525 
526 int	cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd);
527 int	cap_fcntl_check_fde(struct filedescent *fde, int cmd);
528 int	cap_fcntl_check(struct filedesc *fdp, int fd, int cmd);
529 
530 extern bool trap_enotcap;
531 
532 #else /* !_KERNEL */
533 
534 __BEGIN_DECLS
535 /*
536  * cap_enter(): Cause the process to enter capability mode, which will
537  * prevent it from directly accessing global namespaces.  System calls will
538  * be limited to process-local, process-inherited, or file descriptor
539  * operations.  If already in capability mode, a no-op.
540  */
541 int	cap_enter(void);
542 
543 /*
544  * Are we sandboxed (in capability mode)?
545  * This is a libc wrapper around the cap_getmode(2) system call.
546  */
547 bool	cap_sandboxed(void);
548 
549 /*
550  * cap_getmode(): Are we in capability mode?
551  */
552 int	cap_getmode(u_int *modep);
553 
554 /*
555  * Limits capability rights for the given descriptor (CAP_*).
556  */
557 int cap_rights_limit(int fd, const cap_rights_t *rights);
558 /*
559  * Returns capability rights for the given descriptor.
560  */
561 #define	cap_rights_get(fd, rights)					\
562 	__cap_rights_get(CAP_RIGHTS_VERSION, (fd), (rights))
563 int __cap_rights_get(int version, int fd, cap_rights_t *rights);
564 /*
565  * Limits allowed ioctls for the given descriptor.
566  */
567 int cap_ioctls_limit(int fd, const cap_ioctl_t *cmds, size_t ncmds);
568 /*
569  * Returns array of allowed ioctls for the given descriptor.
570  * If all ioctls are allowed, the cmds array is not populated and
571  * the function returns CAP_IOCTLS_ALL.
572  */
573 ssize_t cap_ioctls_get(int fd, cap_ioctl_t *cmds, size_t maxcmds);
574 /*
575  * Limits allowed fcntls for the given descriptor (CAP_FCNTL_*).
576  */
577 int cap_fcntls_limit(int fd, uint32_t fcntlrights);
578 /*
579  * Returns bitmask of allowed fcntls for the given descriptor.
580  */
581 int cap_fcntls_get(int fd, uint32_t *fcntlrightsp);
582 
583 __END_DECLS
584 
585 #endif /* !_KERNEL */
586 
587 #endif /* !_SYS_CAPSICUM_H_ */
588