1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 * 26 * This is a private header file. The interfaces in this header are 27 * subject to change or removal without notice. 28 * The Sun classification is "Project Private". 29 */ 30 31 #ifndef _PRIV_UTILS_H 32 #define _PRIV_UTILS_H 33 34 #include <priv.h> 35 36 37 #ifdef __cplusplus 38 extern "C" { 39 #endif 40 41 #define PU_RESETGROUPS 0x0001 /* Remove supplemental groups */ 42 #define PU_LIMITPRIVS 0x0002 /* L=P */ 43 #define PU_INHERITPRIVS 0x0004 /* I=P */ 44 #define PU_CLEARLIMITSET 0x0008 /* L=0 */ 45 46 /* 47 * Should be run at the start of a set-uid root program; 48 * if the effective uid == 0 and the real uid != 0, 49 * the specified privileges X are assigned as follows: 50 * 51 * P = I + X + B (B added insofar allowable from L) 52 * E = I 53 * (i.e., the requested privileges are dormant, not active) 54 * Then resets all uids to the invoking uid; no-op if euid == uid == 0. 55 * 56 * flags: PU_LIMITPRIVS, PU_CLEARLIMITSET, PU_CLEARINHERITABLE 57 * 58 * Caches the required privileges for use by __priv_bracket(). 59 * 60 */ 61 extern int __init_suid_priv(int, ...); 62 63 /* 64 * After calling __init_suid_priv we can __priv_bracket(PRIV_ON) and 65 * __priv_bracket(PRIV_OFF) and __priv_relinquish to get rid of the 66 * privileges forever. 67 */ 68 extern int __priv_bracket(priv_op_t); 69 extern void __priv_relinquish(void); 70 71 /* 72 * Runs at the start of a daemon, assuming euid=uid=0. 73 * 74 * P = E = B + X 75 * 76 * Then resets uids. 77 * 78 * Flags: all 79 * 80 */ 81 extern int __init_daemon_priv(int, uid_t, gid_t, ...); 82 83 /* 84 * Runs after the daemon is initialized, and gives up the privileges 85 * passed in as argument because they are no longer needed. 86 * Reenables core dumps. 87 */ 88 extern void __fini_daemon_priv(const char *, ...); 89 90 #ifdef __cplusplus 91 } 92 #endif 93 94 #endif /* _PRIV_UTILS_H */ 95