1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2006 nCircle Network Security, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert N. M. Watson for the TrustedBSD 8 * Project under contract to nCircle Network Security, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY, 23 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 24 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 25 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 27 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 28 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 29 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Privilege checking interface for BSD kernel. 34 */ 35 #ifndef _SYS_PRIV_H_ 36 #define _SYS_PRIV_H_ 37 38 /* 39 * Privilege list, sorted loosely by kernel subsystem. 40 * 41 * Think carefully before adding or reusing one of these privileges -- are 42 * there existing instances referring to the same privilege? Third party 43 * vendors may request the assignment of privileges to be used in loadable 44 * modules. Particular numeric privilege assignments are part of the 45 * loadable kernel module ABI, and should not be changed across minor 46 * releases. 47 * 48 * When adding a new privilege, remember to determine if it's appropriate 49 * for use in jail, and update the privilege switch in prison_priv_check() 50 * in kern_jail.c as necessary. 51 */ 52 53 /* 54 * Track beginning of privilege list. 55 */ 56 #define _PRIV_LOWEST 1 57 58 /* 59 * The remaining privileges typically correspond to one or a small 60 * number of specific privilege checks, and have (relatively) precise 61 * meanings. They are loosely sorted into a set of base system 62 * privileges, such as the ability to reboot, and then loosely by 63 * subsystem, indicated by a subsystem name. 64 */ 65 #define _PRIV_ROOT 1 /* Removed. */ 66 #define PRIV_ACCT 2 /* Manage process accounting. */ 67 #define PRIV_MAXFILES 3 /* Exceed system open files limit. */ 68 #define PRIV_MAXPROC 4 /* Exceed system processes limit. */ 69 #define PRIV_KTRACE 5 /* Set/clear KTRFAC_ROOT on ktrace. */ 70 #define PRIV_SETDUMPER 6 /* Configure dump device. */ 71 #define PRIV_REBOOT 8 /* Can reboot system. */ 72 #define PRIV_SWAPON 9 /* Can swapon(). */ 73 #define PRIV_SWAPOFF 10 /* Can swapoff(). */ 74 #define PRIV_MSGBUF 11 /* Can read kernel message buffer. */ 75 #define PRIV_IO 12 /* Can perform low-level I/O. */ 76 #define PRIV_KEYBOARD 13 /* Reprogram keyboard. */ 77 #define PRIV_DRIVER 14 /* Low-level driver privilege. */ 78 #define PRIV_ADJTIME 15 /* Set time adjustment. */ 79 #define PRIV_NTP_ADJTIME 16 /* Set NTP time adjustment. */ 80 #define PRIV_CLOCK_SETTIME 17 /* Can call clock_settime. */ 81 #define PRIV_SETTIMEOFDAY 18 /* Can call settimeofday. */ 82 #define _PRIV_SETHOSTID 19 /* Removed. */ 83 #define _PRIV_SETDOMAINNAME 20 /* Removed. */ 84 85 /* 86 * Audit subsystem privileges. 87 */ 88 #define PRIV_AUDIT_CONTROL 40 /* Can configure audit. */ 89 #define PRIV_AUDIT_FAILSTOP 41 /* Can run during audit fail stop. */ 90 #define PRIV_AUDIT_GETAUDIT 42 /* Can get proc audit properties. */ 91 #define PRIV_AUDIT_SETAUDIT 43 /* Can set proc audit properties. */ 92 #define PRIV_AUDIT_SUBMIT 44 /* Can submit an audit record. */ 93 94 /* 95 * Credential management privileges. 96 */ 97 #define PRIV_CRED_SETUID 50 /* setuid. */ 98 #define PRIV_CRED_SETEUID 51 /* seteuid to !ruid and !svuid. */ 99 #define PRIV_CRED_SETGID 52 /* setgid. */ 100 #define PRIV_CRED_SETEGID 53 /* setgid to !rgid and !svgid. */ 101 #define PRIV_CRED_SETGROUPS 54 /* Set process additional groups. */ 102 #define PRIV_CRED_SETREUID 55 /* setreuid. */ 103 #define PRIV_CRED_SETREGID 56 /* setregid. */ 104 #define PRIV_CRED_SETRESUID 57 /* setresuid. */ 105 #define PRIV_CRED_SETRESGID 58 /* setresgid. */ 106 #define PRIV_SEEOTHERGIDS 59 /* Exempt bsd.seeothergids. */ 107 #define PRIV_SEEOTHERUIDS 60 /* Exempt bsd.seeotheruids. */ 108 #define PRIV_SEEJAILPROC 61 /* Exempt from bsd.see_jail_proc. */ 109 #define PRIV_CRED_SETCRED 62 /* setcred. */ 110 111 /* 112 * Debugging privileges. 113 */ 114 #define PRIV_DEBUG_DIFFCRED 80 /* Exempt debugging other users. */ 115 #define PRIV_DEBUG_SUGID 81 /* Exempt debugging setuid proc. */ 116 #define PRIV_DEBUG_UNPRIV 82 /* Exempt unprivileged debug limit. */ 117 #define PRIV_DEBUG_DENIED 83 /* Exempt P2_NOTRACE. */ 118 #define PRIV_DEBUG_DIFFJAIL 84 /* Exempt debugging other jails. */ 119 120 /* 121 * Dtrace privileges. 122 */ 123 #define PRIV_DTRACE_KERNEL 90 /* Allow use of DTrace on the kernel. */ 124 #define PRIV_DTRACE_PROC 91 /* Allow attaching DTrace to process. */ 125 #define PRIV_DTRACE_USER 92 /* Process may submit DTrace events. */ 126 127 /* 128 * Firmware privilegs. 129 */ 130 #define PRIV_FIRMWARE_LOAD 100 /* Can load firmware. */ 131 132 /* 133 * Jail privileges. 134 */ 135 #define PRIV_JAIL_ATTACH 110 /* Attach to a jail. */ 136 #define PRIV_JAIL_SET 111 /* Set jail parameters. */ 137 #define PRIV_JAIL_REMOVE 112 /* Remove a jail. */ 138 139 /* 140 * Kernel environment privileges. 141 */ 142 #define PRIV_KENV_SET 120 /* Set kernel env. variables. */ 143 #define PRIV_KENV_UNSET 121 /* Unset kernel env. variables. */ 144 145 /* 146 * Loadable kernel module privileges. 147 */ 148 #define PRIV_KLD_LOAD 130 /* Load a kernel module. */ 149 #define PRIV_KLD_UNLOAD 131 /* Unload a kernel module. */ 150 151 /* 152 * Privileges associated with the MAC Framework and specific MAC policy 153 * modules. 154 */ 155 #define PRIV_MAC_PARTITION 140 /* Privilege in mac_partition policy. */ 156 #define PRIV_MAC_PRIVS 141 /* Privilege in the mac_privs policy. */ 157 158 /* 159 * Process-related privileges. 160 */ 161 #define PRIV_PROC_LIMIT 160 /* Exceed user process limit. */ 162 #define PRIV_PROC_SETLOGIN 161 /* Can call setlogin. */ 163 #define PRIV_PROC_SETRLIMIT 162 /* Can raise resources limits. */ 164 #define PRIV_PROC_SETLOGINCLASS 163 /* Can call setloginclass(2). */ 165 166 /* 167 * System V IPC privileges. 168 */ 169 #define PRIV_IPC_READ 170 /* Can override IPC read perm. */ 170 #define PRIV_IPC_WRITE 171 /* Can override IPC write perm. */ 171 #define PRIV_IPC_ADMIN 172 /* Can override IPC owner-only perm. */ 172 #define PRIV_IPC_MSGSIZE 173 /* Exempt IPC message queue limit. */ 173 174 /* 175 * POSIX message queue privileges. 176 */ 177 #define PRIV_MQ_ADMIN 180 /* Can override msgq owner-only perm. */ 178 179 /* 180 * Performance monitoring counter privileges. 181 */ 182 #define PRIV_PMC_MANAGE 190 /* Can administer PMC. */ 183 #define PRIV_PMC_SYSTEM 191 /* Can allocate a system-wide PMC. */ 184 185 /* 186 * Scheduling privileges. 187 */ 188 #define PRIV_SCHED_DIFFCRED 200 /* Exempt scheduling other users. */ 189 #define PRIV_SCHED_SETPRIORITY 201 /* Can set lower nice value for proc. */ 190 #define PRIV_SCHED_RTPRIO 202 /* Can set real time scheduling. */ 191 #define PRIV_SCHED_SETPOLICY 203 /* Can set scheduler policy. */ 192 #define PRIV_SCHED_SET 204 /* Can set thread scheduler. */ 193 #define PRIV_SCHED_SETPARAM 205 /* Can set thread scheduler params. */ 194 #define PRIV_SCHED_CPUSET 206 /* Can manipulate cpusets. */ 195 #define PRIV_SCHED_CPUSET_INTR 207 /* Can adjust IRQ to CPU binding. */ 196 #define PRIV_SCHED_IDPRIO 208 /* Can set idle time scheduling. */ 197 #define PRIV_SCHED_DIFFJAIL 209 /* Exempt scheduling other jails. */ 198 199 /* 200 * POSIX semaphore privileges. 201 */ 202 #define PRIV_SEM_WRITE 220 /* Can override sem write perm. */ 203 204 /* 205 * Signal privileges. 206 */ 207 #define PRIV_SIGNAL_DIFFCRED 230 /* Exempt signalling other users. */ 208 #define PRIV_SIGNAL_SUGID 231 /* Non-conserv signal setuid proc. */ 209 #define PRIV_SIGNAL_DIFFJAIL 232 /* Exempt signalling other jails. */ 210 211 /* 212 * Sysctl privileges. 213 */ 214 #define PRIV_SYSCTL_DEBUG 240 /* Can invoke sysctl.debug. */ 215 #define PRIV_SYSCTL_WRITE 241 /* Can write sysctls. */ 216 #define PRIV_SYSCTL_WRITEJAIL 242 /* Can write sysctls, jail permitted. */ 217 #define PRIV_SYSCTL_MEMLOCK 243 /* Large requests are not serialized. */ 218 219 /* 220 * TTY privileges. 221 */ 222 #define PRIV_TTY_CONSOLE 250 /* Set console to tty. */ 223 #define PRIV_TTY_DRAINWAIT 251 /* Set tty drain wait time. */ 224 #define PRIV_TTY_DTRWAIT 252 /* Set DTR wait on tty. */ 225 #define PRIV_TTY_EXCLUSIVE 253 /* Override tty exclusive flag. */ 226 #define _PRIV_TTY_PRISON 254 /* Removed. */ 227 #define PRIV_TTY_STI 255 /* Simulate input on another tty. */ 228 #define PRIV_TTY_SETA 256 /* Set tty termios structure. */ 229 230 /* 231 * UFS-specific privileges. 232 */ 233 #define PRIV_UFS_EXTATTRCTL 270 /* Can configure EAs on UFS1. */ 234 #define PRIV_UFS_QUOTAOFF 271 /* quotaoff(). */ 235 #define PRIV_UFS_QUOTAON 272 /* quotaon(). */ 236 #define PRIV_UFS_SETUSE 273 /* setuse(). */ 237 238 /* 239 * ZFS-specific privileges. 240 */ 241 #define PRIV_ZFS_POOL_CONFIG 280 /* Can configure ZFS pools. */ 242 #define PRIV_ZFS_INJECT 281 /* Can inject faults in the ZFS fault 243 injection framework. */ 244 #define PRIV_ZFS_JAIL 282 /* Can attach/detach ZFS file systems 245 to/from jails. */ 246 247 /* 248 * NFS-specific privileges. 249 */ 250 #define PRIV_NFS_DAEMON 290 /* Can become the NFS daemon. */ 251 #define PRIV_NFS_LOCKD 291 /* Can become NFS lock daemon. */ 252 253 /* 254 * VFS privileges. 255 */ 256 #define PRIV_VFS_READ 310 /* Override vnode DAC read perm. */ 257 #define PRIV_VFS_WRITE 311 /* Override vnode DAC write perm. */ 258 #define PRIV_VFS_ADMIN 312 /* Override vnode DAC admin perm. */ 259 #define PRIV_VFS_EXEC 313 /* Override vnode DAC exec perm. */ 260 #define PRIV_VFS_LOOKUP 314 /* Override vnode DAC lookup perm. */ 261 #define PRIV_VFS_BLOCKRESERVE 315 /* Can use free block reserve. */ 262 #define PRIV_VFS_CHFLAGS_DEV 316 /* Can chflags() a device node. */ 263 #define PRIV_VFS_CHOWN 317 /* Can set user; group to non-member. */ 264 #define PRIV_VFS_CHROOT 318 /* chroot(). */ 265 #define PRIV_VFS_RETAINSUGID 319 /* Can retain sugid bits on change. */ 266 #define PRIV_VFS_EXCEEDQUOTA 320 /* Exempt from quota restrictions. */ 267 #define PRIV_VFS_EXTATTR_SYSTEM 321 /* Operate on system EA namespace. */ 268 #define PRIV_VFS_FCHROOT 322 /* fchroot(). */ 269 #define PRIV_VFS_FHOPEN 323 /* Can fhopen(). */ 270 #define PRIV_VFS_FHSTAT 324 /* Can fhstat(). */ 271 #define PRIV_VFS_FHSTATFS 325 /* Can fhstatfs(). */ 272 #define PRIV_VFS_GENERATION 326 /* stat() returns generation number. */ 273 #define PRIV_VFS_GETFH 327 /* Can retrieve file handles. */ 274 #define PRIV_VFS_GETQUOTA 328 /* getquota(). */ 275 #define PRIV_VFS_LINK 329 /* bsd.hardlink_check_uid */ 276 #define PRIV_VFS_MKNOD_BAD 330 /* Was: mknod() can mark bad inodes. */ 277 #define PRIV_VFS_MKNOD_DEV 331 /* Can mknod() to create dev nodes. */ 278 #define PRIV_VFS_MKNOD_WHT 332 /* Can mknod() to create whiteout. */ 279 #define PRIV_VFS_MOUNT 333 /* Can mount(). */ 280 #define PRIV_VFS_MOUNT_OWNER 334 /* Can manage other users' file systems. */ 281 #define PRIV_VFS_MOUNT_EXPORTED 335 /* Can set MNT_EXPORTED on mount. */ 282 #define PRIV_VFS_MOUNT_PERM 336 /* Override dev node perms at mount. */ 283 #define PRIV_VFS_MOUNT_SUIDDIR 337 /* Can set MNT_SUIDDIR on mount. */ 284 #define PRIV_VFS_MOUNT_NONUSER 338 /* Can perform a non-user mount. */ 285 #define PRIV_VFS_SETGID 339 /* Can setgid if not in group. */ 286 #define PRIV_VFS_SETQUOTA 340 /* setquota(). */ 287 #define PRIV_VFS_STICKYFILE 341 /* Can set sticky bit on file. */ 288 #define PRIV_VFS_SYSFLAGS 342 /* Can modify system flags. */ 289 #define PRIV_VFS_UNMOUNT 343 /* Can unmount(). */ 290 #define PRIV_VFS_STAT 344 /* Override vnode MAC stat perm. */ 291 #define PRIV_VFS_READ_DIR 345 /* Can read(2) a dirfd, needs sysctl. */ 292 293 /* 294 * Virtual memory privileges. 295 */ 296 #define PRIV_VM_MADV_PROTECT 360 /* Can set MADV_PROTECT. */ 297 #define PRIV_VM_MLOCK 361 /* Can mlock(), mlockall(). */ 298 #define PRIV_VM_MUNLOCK 362 /* Can munlock(), munlockall(). */ 299 #define PRIV_VM_SWAP_NOQUOTA 363 /* 300 * Can override the global 301 * swap reservation limits. 302 */ 303 #define PRIV_VM_SWAP_NORLIMIT 364 /* 304 * Can override the per-uid 305 * swap reservation limits. 306 */ 307 308 /* 309 * Device file system privileges. 310 */ 311 #define PRIV_DEVFS_RULE 370 /* Can manage devfs rules. */ 312 #define PRIV_DEVFS_SYMLINK 371 /* Can create symlinks in devfs. */ 313 314 /* 315 * Random number generator privileges. 316 */ 317 #define PRIV_RANDOM_RESEED 380 /* Closing /dev/random reseeds. */ 318 319 /* 320 * Network stack privileges. 321 */ 322 #define PRIV_NET_BRIDGE 390 /* Administer bridge. */ 323 #define PRIV_NET_GRE 391 /* Administer GRE. */ 324 #define _PRIV_NET_PPP 392 /* Removed. */ 325 #define _PRIV_NET_SLIP 393 /* Removed. */ 326 #define PRIV_NET_BPF 394 /* Monitor BPF. */ 327 #define PRIV_NET_RAW 395 /* Open raw socket. */ 328 #define PRIV_NET_ROUTE 396 /* Administer routing. */ 329 #define PRIV_NET_TAP 397 /* Can open tap device. */ 330 #define PRIV_NET_SETIFMTU 398 /* Set interface MTU. */ 331 #define PRIV_NET_SETIFFLAGS 399 /* Set interface flags. */ 332 #define PRIV_NET_SETIFCAP 400 /* Set interface capabilities. */ 333 #define PRIV_NET_SETIFNAME 401 /* Set interface name. */ 334 #define PRIV_NET_SETIFMETRIC 402 /* Set interface metrics. */ 335 #define PRIV_NET_SETIFPHYS 403 /* Set interface physical layer prop. */ 336 #define PRIV_NET_SETIFMAC 404 /* Set interface MAC label. */ 337 #define PRIV_NET_ADDMULTI 405 /* Add multicast addr. to ifnet. */ 338 #define PRIV_NET_DELMULTI 406 /* Delete multicast addr. from ifnet. */ 339 #define PRIV_NET_HWIOCTL 407 /* Issue hardware ioctl on ifnet. */ 340 #define PRIV_NET_SETLLADDR 408 /* Set interface link-level address. */ 341 #define PRIV_NET_ADDIFGROUP 409 /* Add new interface group. */ 342 #define PRIV_NET_DELIFGROUP 410 /* Delete interface group. */ 343 #define PRIV_NET_IFCREATE 411 /* Create cloned interface. */ 344 #define PRIV_NET_IFDESTROY 412 /* Destroy cloned interface. */ 345 #define PRIV_NET_ADDIFADDR 413 /* Add protocol addr to interface. */ 346 #define PRIV_NET_DELIFADDR 414 /* Delete protocol addr on interface. */ 347 #define PRIV_NET_LAGG 415 /* Administer lagg interface. */ 348 #define PRIV_NET_GIF 416 /* Administer gif interface. */ 349 #define PRIV_NET_SETIFVNET 417 /* Move interface to vnet. */ 350 #define PRIV_NET_SETIFDESCR 418 /* Set interface description. */ 351 #define PRIV_NET_SETIFFIB 419 /* Set interface fib. */ 352 #define PRIV_NET_VXLAN 420 /* Administer vxlan. */ 353 #define PRIV_NET_SETLANPCP 421 /* Set LAN priority. */ 354 #define PRIV_NET_SETVLANPCP PRIV_NET_SETLANPCP /* Alias Set VLAN priority */ 355 #define PRIV_NET_OVPN 422 /* Administer OpenVPN DCO. */ 356 #define PRIV_NET_ME 423 /* Administer ME interface. */ 357 #define PRIV_NET_WG 424 /* Administer WireGuard interface. */ 358 359 /* 360 * 802.11-related privileges. 361 */ 362 #define PRIV_NET80211_VAP_GETKEY 440 /* Query VAP 802.11 keys. */ 363 #define PRIV_NET80211_VAP_MANAGE 441 /* Administer 802.11 VAP */ 364 #define PRIV_NET80211_VAP_SETMAC 442 /* Set VAP MAC address */ 365 #define PRIV_NET80211_CREATE_VAP 443 /* Create a new VAP */ 366 367 /* 368 * Placeholder for AppleTalk privileges, not supported anymore. 369 */ 370 #define _PRIV_NETATALK_RESERVEDPORT 450 /* Bind low port number. */ 371 372 /* 373 * ATM privileges. 374 */ 375 #define PRIV_NETATM_CFG 460 376 #define PRIV_NETATM_ADD 461 377 #define PRIV_NETATM_DEL 462 378 #define PRIV_NETATM_SET 463 379 380 /* 381 * Bluetooth privileges. 382 */ 383 #define PRIV_NETBLUETOOTH_RAW 470 /* Open raw bluetooth socket. */ 384 385 /* 386 * Netgraph and netgraph module privileges. 387 */ 388 #define PRIV_NETGRAPH_CONTROL 480 /* Open netgraph control socket. */ 389 #define PRIV_NETGRAPH_TTY 481 /* Configure tty for netgraph. */ 390 391 /* 392 * IPv4 and IPv6 privileges. 393 */ 394 #define PRIV_NETINET_RESERVEDPORT 490 /* Bind low port number. */ 395 #define PRIV_NETINET_IPFW 491 /* Administer IPFW firewall. */ 396 #define PRIV_NETINET_DIVERT 492 /* Open IP divert socket. */ 397 #define PRIV_NETINET_PF 493 /* Administer pf firewall. */ 398 #define PRIV_NETINET_DUMMYNET 494 /* Administer DUMMYNET. */ 399 #define PRIV_NETINET_CARP 495 /* Administer CARP. */ 400 #define PRIV_NETINET_MROUTE 496 /* Administer multicast routing. */ 401 #define PRIV_NETINET_RAW 497 /* Open netinet raw socket. */ 402 #define PRIV_NETINET_GETCRED 498 /* Query netinet pcb credentials. */ 403 #define PRIV_NETINET_ADDRCTRL6 499 /* Administer IPv6 address scopes. */ 404 #define PRIV_NETINET_ND6 500 /* Administer IPv6 neighbor disc. */ 405 #define PRIV_NETINET_SCOPE6 501 /* Administer IPv6 address scopes. */ 406 #define PRIV_NETINET_ALIFETIME6 502 /* Administer IPv6 address lifetimes. */ 407 #define PRIV_NETINET_IPSEC 503 /* Administer IPSEC. */ 408 #define PRIV_NETINET_REUSEPORT 504 /* Allow [rapid] port/address reuse. */ 409 #define PRIV_NETINET_SETHDROPTS 505 /* Set certain IPv4/6 header options. */ 410 #define PRIV_NETINET_BINDANY 506 /* Allow bind to any address. */ 411 #define PRIV_NETINET_HASHKEY 507 /* Get and set hash keys for IPv4/6. */ 412 #define PRIV_NETINET_KTLSKEYS 508 /* Read ktls session keys. */ 413 414 /* 415 * Placeholders for IPX/SPX privileges, not supported any more. 416 */ 417 #define _PRIV_NETIPX_RESERVEDPORT 520 /* Bind low port number. */ 418 #define _PRIV_NETIPX_RAW 521 /* Open netipx raw socket. */ 419 420 /* 421 * NCP privileges. 422 */ 423 #define PRIV_NETNCP 530 /* Use another user's connection. */ 424 425 /* 426 * SMB privileges. 427 */ 428 #define PRIV_NETSMB 540 /* Use another user's connection. */ 429 430 /* 431 * VM86 privileges. 432 */ 433 #define PRIV_VM86_INTCALL 550 /* Allow invoking vm86 int handlers. */ 434 435 #define PRIV_PIPEBUF 560 /* Allow to allocate reserved pipebuf 436 space */ 437 438 /* 439 * Set of reserved privilege values, which will be allocated to code as 440 * needed, in order to avoid renumbering later privileges due to insertion. 441 */ 442 #define _PRIV_RESERVED1 561 443 #define _PRIV_RESERVED2 562 444 #define _PRIV_RESERVED3 563 445 #define _PRIV_RESERVED4 564 446 #define _PRIV_RESERVED5 565 447 #define _PRIV_RESERVED6 566 448 #define _PRIV_RESERVED7 567 449 #define _PRIV_RESERVED8 568 450 #define _PRIV_RESERVED9 569 451 #define _PRIV_RESERVED10 570 452 #define _PRIV_RESERVED11 571 453 #define _PRIV_RESERVED12 572 454 #define _PRIV_RESERVED13 573 455 #define _PRIV_RESERVED14 574 456 #define _PRIV_RESERVED15 575 457 458 /* 459 * Define a set of valid privilege numbers that can be used by loadable 460 * modules that don't yet have privilege reservations. Ideally, these should 461 * not be used, since their meaning is opaque to any policies that are aware 462 * of specific privileges, such as jail, and as such may be arbitrarily 463 * denied. 464 */ 465 #define PRIV_MODULE0 600 466 #define PRIV_MODULE1 601 467 #define PRIV_MODULE2 602 468 #define PRIV_MODULE3 603 469 #define PRIV_MODULE4 604 470 #define PRIV_MODULE5 605 471 #define PRIV_MODULE6 606 472 #define PRIV_MODULE7 607 473 #define PRIV_MODULE8 608 474 #define PRIV_MODULE9 609 475 #define PRIV_MODULE10 610 476 #define PRIV_MODULE11 611 477 #define PRIV_MODULE12 612 478 #define PRIV_MODULE13 613 479 #define PRIV_MODULE14 614 480 #define PRIV_MODULE15 615 481 482 /* 483 * DDB(4) privileges. 484 */ 485 #define PRIV_DDB_CAPTURE 620 /* Allow reading of DDB capture log. */ 486 487 /* 488 * Arla/nnpfs privileges. 489 */ 490 #define PRIV_NNPFS_DEBUG 630 /* Perforn ARLA_VIOC_NNPFSDEBUG. */ 491 492 /* 493 * cpuctl(4) privileges. 494 */ 495 #define PRIV_CPUCTL_WRMSR 640 /* Write model-specific register. */ 496 #define PRIV_CPUCTL_UPDATE 641 /* Update cpu microcode. */ 497 498 /* 499 * Capi4BSD privileges. 500 */ 501 #define PRIV_C4B_RESET_CTLR 650 /* Load firmware, reset controller. */ 502 #define PRIV_C4B_TRACE 651 /* Unrestricted CAPI message tracing. */ 503 504 /* 505 * OpenAFS privileges. 506 */ 507 #define PRIV_AFS_ADMIN 660 /* Can change AFS client settings. */ 508 #define PRIV_AFS_DAEMON 661 /* Can become the AFS daemon. */ 509 510 /* 511 * Resource Limits privileges. 512 */ 513 #define PRIV_RCTL_GET_RACCT 670 514 #define PRIV_RCTL_GET_RULES 671 515 #define PRIV_RCTL_GET_LIMITS 672 516 #define PRIV_RCTL_ADD_RULE 673 517 #define PRIV_RCTL_REMOVE_RULE 674 518 519 /* 520 * mem(4) privileges. 521 */ 522 #define PRIV_KMEM_READ 680 /* Open mem/kmem for reading. */ 523 #define PRIV_KMEM_WRITE 681 /* Open mem/kmem for writing. */ 524 #define PRIV_PROC_MEM_WRITE 682 /* Writes via proc_rwmem */ 525 526 /* 527 * Kernel debugger privileges. 528 */ 529 #define PRIV_KDB_SET_BACKEND 690 /* Allow setting KDB backend. */ 530 531 /* 532 * veriexec override privileges - very rare! 533 */ 534 #define PRIV_VERIEXEC_DIRECT 700 /* Can override 'indirect' */ 535 #define PRIV_VERIEXEC_NOVERIFY 701 /* Can override O_VERIFY */ 536 #define PRIV_VERIEXEC_CONTROL 702 /* Can configure veriexec */ 537 538 /* 539 * Track end of privilege list. 540 */ 541 #define _PRIV_HIGHEST 703 542 543 /* 544 * Validate that a named privilege is known by the privilege system. Invalid 545 * privileges presented to the privilege system by a priv_check interface 546 * will result in a panic. This is only approximate due to sparse allocation 547 * of the privilege space. 548 */ 549 #define PRIV_VALID(x) ((x) > _PRIV_LOWEST && (x) < _PRIV_HIGHEST) 550 551 #ifdef _KERNEL 552 /* 553 * Privilege check interfaces, modeled after historic suser() interfaces, but 554 * with the addition of a specific privilege name. No flags are currently 555 * defined for the API. Historically, flags specified using the real uid 556 * instead of the effective uid, and whether or not the check should be 557 * allowed in jail. 558 */ 559 struct thread; 560 struct ucred; 561 int priv_check(struct thread *td, int priv); 562 int priv_check_cred(struct ucred *cred, int priv); 563 int priv_check_cred_vfs_lookup(struct ucred *cred); 564 int priv_check_cred_vfs_lookup_nomac(struct ucred *cred); 565 int priv_check_cred_vfs_generation(struct ucred *cred); 566 #endif 567 568 #endif /* !_SYS_PRIV_H_ */ 569