xref: /illumos-gate/usr/src/uts/common/sys/priv.h (revision 0173c38a73f34277e0c97a19fedfd25d81ba8380)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_SYS_PRIV_H
27 #define	_SYS_PRIV_H
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"	/* from TSOL 8 */
30 
31 #include <sys/types.h>
32 #include <sys/cred.h>
33 #include <sys/priv_names.h>
34 
35 #ifdef	__cplusplus
36 extern "C" {
37 #endif
38 
39 typedef uint32_t priv_chunk_t;
40 typedef struct priv_set priv_set_t;
41 
42 #ifdef _KERNEL
43 
44 /*
45  * Kernel type definitions.
46  */
47 typedef int priv_ptype_t;
48 typedef int priv_t;
49 
50 #else /* _KERNEL */
51 
52 /*
53  * Userland type definitions.
54  */
55 
56 #ifdef __STDC__
57 typedef const char *priv_ptype_t;
58 typedef const char *priv_t;
59 #else
60 typedef char *priv_ptype_t;
61 typedef char *priv_t;
62 #endif
63 
64 #endif /* _KERNEL */
65 
66 /*
67  * priv_op_t indicates a privilege operation type
68  */
69 typedef enum priv_op {
70 	PRIV_ON,
71 	PRIV_OFF,
72 	PRIV_SET
73 } priv_op_t;
74 
75 /*
76  * Privilege system call subcodes.
77  */
78 
79 #define	PRIVSYS_SETPPRIV	0
80 #define	PRIVSYS_GETPPRIV	1
81 #define	PRIVSYS_GETIMPLINFO	2
82 #define	PRIVSYS_SETPFLAGS	3
83 #define	PRIVSYS_GETPFLAGS	4
84 
85 /*
86  * Maximum length of a user defined privilege name.
87  */
88 #define	PRIVNAME_MAX		32
89 
90 /*
91  * Privilege interface functions for those parts of the kernel that
92  * know nothing of the privilege internals.
93  *
94  * A privilege implementation can have a varying number of sets; sets
95  * consist of a number of priv_chunk_t's and the size is expressed as such.
96  * The privileges can be represented as
97  *
98  *		priv_chunk_t privs[info.priv_nsets][info.priv_setsize]
99  *		... priv_infosize of extra information ...
100  *
101  * Extra data contained in the privilege information consists of chunks
102  * of data with specified size and type all headed by a priv_info_t header
103  * which defines both the type of information as well as the size of the
104  * information.  ((char*)&info)+info->priv_info_size should be rounded up
105  * to point to the next piece of information.
106  */
107 
108 typedef struct priv_impl_info {
109 	uint32_t	priv_headersize;	/* sizeof (priv_impl_info) */
110 	uint32_t	priv_flags;		/* additional flags */
111 	uint32_t	priv_nsets;		/* number of priv sets */
112 	uint32_t	priv_setsize;		/* size in priv_chunk_t */
113 	uint32_t	priv_max;		/* highest actual valid priv */
114 	uint32_t	priv_infosize;		/* Per proc. additional info */
115 	uint32_t	priv_globalinfosize;	/* Per system info */
116 } priv_impl_info_t;
117 
118 #define	PRIV_IMPL_INFO_SIZE(p) \
119 			((p)->priv_headersize + (p)->priv_globalinfosize)
120 
121 #define	PRIV_PRPRIV_INFO_OFFSET(p) \
122 		(sizeof (*(p)) + \
123 		((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t))
124 
125 #define	PRIV_PRPRIV_SIZE(p) \
126 		(PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize)
127 
128 /*
129  * Per credential flags.
130  */
131 #define	PRIV_DEBUG			0x0001		/* User debugging */
132 #define	PRIV_AWARE			0x0002		/* Is privilege aware */
133 #define	PRIV_AWARE_INHERIT		0x0004		/* Inherit awareness */
134 #define	__PROC_PROTECT			0x0008		/* Private */
135 #define	NET_MAC_AWARE			0x0010		/* Is MAC aware */
136 #define	NET_MAC_AWARE_INHERIT		0x0020		/* Inherit MAC aware */
137 
138 /* user-settable flags: */
139 #define	PRIV_USER	(PRIV_DEBUG | NET_MAC_AWARE | NET_MAC_AWARE_INHERIT)
140 
141 /*
142  * Header of the privilege info data structure; multiple structures can
143  * follow the privilege sets and priv_impl_info structures.
144  */
145 typedef struct priv_info {
146 	uint32_t	priv_info_type;
147 	uint32_t	priv_info_size;
148 } priv_info_t;
149 
150 typedef struct priv_info_uint {
151 	priv_info_t	info;
152 	uint_t		val;
153 } priv_info_uint_t;
154 
155 /*
156  * Global privilege set information item; the actual size of the array is
157  * {priv_setsize}.
158  */
159 typedef struct priv_info_set {
160 	priv_info_t	info;
161 	priv_chunk_t	set[1];
162 } priv_info_set_t;
163 
164 /*
165  * names[1] is a place holder which can contain multiple NUL terminated,
166  * non-empty strings.
167  */
168 
169 typedef struct priv_info_names {
170 	priv_info_t	info;
171 	int		cnt;		/* number of strings */
172 	char		names[1];	/* "string1\0string2\0 ..stringN\0" */
173 } priv_info_names_t;
174 
175 /*
176  * Privilege information types.
177  */
178 #define	PRIV_INFO_SETNAMES		0x0001
179 #define	PRIV_INFO_PRIVNAMES		0x0002
180 #define	PRIV_INFO_BASICPRIVS		0x0003
181 #define	PRIV_INFO_FLAGS			0x0004
182 
183 /*
184  * Special "privileges" used to indicate special conditions in privilege
185  * debugging/tracing code.
186  */
187 #define	PRIV_ALL			(-1)	/* All privileges required */
188 #define	PRIV_MULTIPLE			(-2)	/* More than one */
189 #define	PRIV_NONE			(-3)	/* No value */
190 #define	PRIV_ALLZONE			(-4)	/* All privileges in zone */
191 #define	PRIV_GLOBAL			(-5)	/* Must be in global zone */
192 
193 #ifdef _KERNEL
194 
195 #define	PRIV_ALLOC			0x1
196 
197 struct proc;
198 struct prpriv;
199 struct cred;
200 
201 extern int priv_prgetprivsize(struct prpriv *);
202 extern void cred2prpriv(const struct cred *, struct prpriv *);
203 extern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *);
204 
205 extern priv_impl_info_t *priv_hold_implinfo(void);
206 extern void priv_release_implinfo(void);
207 extern size_t priv_get_implinfo_size(void);
208 extern const priv_set_t *priv_getset(const struct cred *, int);
209 extern void priv_getinfo(const struct cred *, void *);
210 extern int priv_getbyname(const char *, uint_t);
211 extern int priv_getsetbyname(const char *, int);
212 extern const char *priv_getbynum(int);
213 extern const char *priv_getsetbynum(int);
214 
215 extern void priv_emptyset(priv_set_t *);
216 extern void priv_fillset(priv_set_t *);
217 extern void priv_addset(priv_set_t *, int);
218 extern void priv_delset(priv_set_t *, int);
219 extern boolean_t priv_ismember(const priv_set_t *, int);
220 extern boolean_t priv_isemptyset(const priv_set_t *);
221 extern boolean_t priv_isfullset(const priv_set_t *);
222 extern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *);
223 extern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *);
224 extern int priv_proc_cred_perm(const struct cred *, struct proc *,
225 	struct cred **, int);
226 extern void priv_intersect(const priv_set_t *, priv_set_t *);
227 extern void priv_union(const priv_set_t *, priv_set_t *);
228 extern void priv_inverse(priv_set_t *);
229 
230 extern void priv_set_PA(cred_t *);
231 extern void priv_adjust_PA(cred_t *);
232 extern boolean_t priv_can_clear_PA(const cred_t *);
233 
234 extern int setpflags(uint_t, uint_t, cred_t *);
235 extern uint_t getpflags(uint_t, const cred_t *);
236 
237 #endif /* _KERNEL */
238 
239 #ifdef	__cplusplus
240 }
241 #endif
242 
243 #endif	/* _SYS_PRIV_H */
244