xref: /illumos-gate/usr/src/uts/common/sys/secflags.h (revision d2a70789f056fc6c9ce3ab047b52126d80b0e3da)
1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /* Copyright 2014, Richard Lowe */
13 
14 #ifndef _SYS_SECFLAGS_H
15 #define	_SYS_SECFLAGS_H
16 
17 #ifdef __cplusplus
18 extern "C" {
19 #endif
20 
21 #include <sys/types.h>
22 #include <sys/procset.h>
23 
24 struct proc;
25 typedef uint64_t secflagset_t;
26 
27 typedef struct psecflags {
28 	secflagset_t psf_effective;
29 	secflagset_t psf_inherit;
30 	secflagset_t psf_lower;
31 	secflagset_t psf_upper;
32 } psecflags_t;
33 
34 typedef struct secflagdelta {
35 	secflagset_t psd_add;		/* Flags to add */
36 	secflagset_t psd_rem;		/* Flags to remove */
37 	secflagset_t psd_assign;	/* Flags to assign */
38 	boolean_t psd_ass_active;	/* Need to assign */
39 } secflagdelta_t;
40 
41 typedef enum {
42 	PSF_EFFECTIVE = 0,
43 	PSF_INHERIT,
44 	PSF_LOWER,
45 	PSF_UPPER
46 } psecflagwhich_t;
47 
48 
49 /*
50  * p_secflags codes
51  *
52  * These flags indicate the extra security-related features enabled for a
53  * given process.
54  */
55 typedef enum {
56 	PROC_SEC_ASLR = 0,
57 	PROC_SEC_FORBIDNULLMAP,
58 	PROC_SEC_NOEXECSTACK
59 } secflag_t;
60 
61 extern secflagset_t secflag_to_bit(secflag_t);
62 extern boolean_t secflag_isset(secflagset_t, secflag_t);
63 extern void secflag_clear(secflagset_t *, secflag_t);
64 extern void secflag_set(secflagset_t *, secflag_t);
65 extern boolean_t secflags_isempty(secflagset_t);
66 extern void secflags_zero(secflagset_t *);
67 extern void secflags_fullset(secflagset_t *);
68 extern void secflags_copy(secflagset_t *, const secflagset_t *);
69 extern boolean_t secflags_issubset(secflagset_t, secflagset_t);
70 extern boolean_t secflags_issuperset(secflagset_t, secflagset_t);
71 extern boolean_t secflags_intersection(secflagset_t, secflagset_t);
72 extern void secflags_union(secflagset_t *, const secflagset_t *);
73 extern void secflags_difference(secflagset_t *, const secflagset_t *);
74 extern boolean_t psecflags_validate_delta(const psecflags_t *,
75     const secflagdelta_t *);
76 extern boolean_t psecflags_validate(const psecflags_t *);
77 extern void psecflags_default(psecflags_t *sf);
78 extern const char *secflag_to_str(secflag_t);
79 extern boolean_t secflag_by_name(const char *, secflag_t *);
80 extern void secflags_to_str(secflagset_t, char *, size_t);
81 
82 /* All valid bits */
83 #define	PROC_SEC_MASK	(secflag_to_bit(PROC_SEC_ASLR) |	\
84     secflag_to_bit(PROC_SEC_FORBIDNULLMAP) |			\
85     secflag_to_bit(PROC_SEC_NOEXECSTACK))
86 
87 #if !defined(_KERNEL)
88 extern int secflags_parse(const secflagset_t *, const char *, secflagdelta_t *);
89 extern int psecflags(idtype_t, id_t, psecflagwhich_t, secflagdelta_t *);
90 #endif
91 
92 #if defined(_KERNEL)
93 extern boolean_t secflag_enabled(struct proc *, secflag_t);
94 extern void secflags_promote(struct proc *);
95 extern void secflags_apply_delta(secflagset_t *, const secflagdelta_t *);
96 #endif
97 
98 #ifdef __cplusplus
99 }
100 #endif
101 
102 #endif /* _SYS_SECFLAGS_H */
103