1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _SYS_PRIV_H 28 #define _SYS_PRIV_H 29 30 #pragma ident "%Z%%M% %I% %E% SMI" /* from TSOL 8 */ 31 32 #include <sys/types.h> 33 #include <sys/cred.h> 34 #include <sys/priv_names.h> 35 36 #ifdef __cplusplus 37 extern "C" { 38 #endif 39 40 typedef uint32_t priv_chunk_t; 41 typedef struct priv_set priv_set_t; 42 43 #ifdef _KERNEL 44 45 /* 46 * Kernel type definitions. 47 */ 48 typedef int priv_ptype_t; 49 typedef int priv_t; 50 51 #else /* _KERNEL */ 52 53 /* 54 * Userland type definitions. 55 */ 56 57 #ifdef __STDC__ 58 typedef const char *priv_ptype_t; 59 typedef const char *priv_t; 60 #else 61 typedef char *priv_ptype_t; 62 typedef char *priv_t; 63 #endif 64 65 #endif /* _KERNEL */ 66 67 /* 68 * priv_op_t indicates a privilege operation type 69 */ 70 typedef enum priv_op { 71 PRIV_ON, 72 PRIV_OFF, 73 PRIV_SET 74 } priv_op_t; 75 76 /* 77 * Privilege system call subcodes. 78 */ 79 80 #define PRIVSYS_SETPPRIV 0 81 #define PRIVSYS_GETPPRIV 1 82 #define PRIVSYS_GETIMPLINFO 2 83 #define PRIVSYS_SETPFLAGS 3 84 #define PRIVSYS_GETPFLAGS 4 85 86 /* 87 * Maximum length of a user defined privilege name. 88 */ 89 #define PRIVNAME_MAX 32 90 91 /* 92 * Privilege interface functions for those parts of the kernel that 93 * know nothing of the privilege internals. 94 * 95 * A privilege implementation can have a varying number of sets; sets 96 * consist of a number of priv_chunk_t's and the size is expressed as such. 97 * The privileges can be represented as 98 * 99 * priv_chunk_t privs[info.priv_nsets][info.priv_setsize] 100 * ... priv_infosize of extra information ... 101 * 102 * Extra data contained in the privilege information consists of chunks 103 * of data with specified size and type all headed by a priv_info_t header 104 * which defines both the type of information as well as the size of the 105 * information. ((char*)&info)+info->priv_info_size should be rounded up 106 * to point to the next piece of information. 107 */ 108 109 typedef struct priv_impl_info { 110 uint32_t priv_headersize; /* sizeof (priv_impl_info) */ 111 uint32_t priv_flags; /* additional flags */ 112 uint32_t priv_nsets; /* number of priv sets */ 113 uint32_t priv_setsize; /* size in priv_chunk_t */ 114 uint32_t priv_max; /* highest actual valid priv */ 115 uint32_t priv_infosize; /* Per proc. additional info */ 116 uint32_t priv_globalinfosize; /* Per system info */ 117 } priv_impl_info_t; 118 119 #define PRIV_IMPL_INFO_SIZE(p) \ 120 ((p)->priv_headersize + (p)->priv_globalinfosize) 121 122 #define PRIV_PRPRIV_INFO_OFFSET(p) \ 123 (sizeof (*(p)) + \ 124 ((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t)) 125 126 #define PRIV_PRPRIV_SIZE(p) \ 127 (PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize) 128 129 /* 130 * Per credential flags. 131 */ 132 #define PRIV_DEBUG 0x0001 /* User debugging */ 133 #define PRIV_AWARE 0x0002 /* Is privilege aware */ 134 #define PRIV_AWARE_INHERIT 0x0004 /* Inherit awareness */ 135 #define __PROC_PROTECT 0x0008 /* Private */ 136 #define PRIV_USER (PRIV_DEBUG) /* User settable */ 137 138 /* 139 * Header of the privilege info data structure; multiple structures can 140 * follow the privilege sets and priv_impl_info structures. 141 */ 142 typedef struct priv_info { 143 uint32_t priv_info_type; 144 uint32_t priv_info_size; 145 } priv_info_t; 146 147 typedef struct priv_info_uint { 148 priv_info_t info; 149 uint_t val; 150 } priv_info_uint_t; 151 152 /* 153 * Global privilege set information item; the actual size of the array is 154 * {priv_setsize}. 155 */ 156 typedef struct priv_info_set { 157 priv_info_t info; 158 priv_chunk_t set[1]; 159 } priv_info_set_t; 160 161 /* 162 * names[1] is a place holder which can contain multiple NUL terminated, 163 * non-empty strings. 164 */ 165 166 typedef struct priv_info_names { 167 priv_info_t info; 168 int cnt; /* number of strings */ 169 char names[1]; /* "string1\0string2\0 ..stringN\0" */ 170 } priv_info_names_t; 171 172 /* 173 * Privilege information types. 174 */ 175 #define PRIV_INFO_SETNAMES 0x0001 176 #define PRIV_INFO_PRIVNAMES 0x0002 177 #define PRIV_INFO_BASICPRIVS 0x0003 178 #define PRIV_INFO_FLAGS 0x0004 179 180 /* 181 * Special "privileges" used to indicate special conditions in privilege 182 * debugging/tracing code. 183 */ 184 #define PRIV_ALL (-1) /* All privileges required */ 185 #define PRIV_MULTIPLE (-2) /* More than one */ 186 #define PRIV_NONE (-3) /* No value */ 187 #define PRIV_ALLZONE (-4) /* All privileges in zone */ 188 #define PRIV_GLOBAL (-5) /* Must be in global zone */ 189 190 #ifdef _KERNEL 191 192 #define PRIV_ALLOC 0x1 193 194 struct proc; 195 struct prpriv; 196 struct cred; 197 198 extern int priv_prgetprivsize(struct prpriv *); 199 extern void cred2prpriv(const struct cred *, struct prpriv *); 200 extern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *); 201 202 extern priv_impl_info_t *priv_hold_implinfo(void); 203 extern void priv_release_implinfo(void); 204 extern size_t priv_get_implinfo_size(void); 205 extern const priv_set_t *priv_getset(const struct cred *, int); 206 extern void priv_getinfo(const struct cred *, void *); 207 extern int priv_getbyname(const char *, uint_t); 208 extern int priv_getsetbyname(const char *, int); 209 extern const char *priv_getbynum(int); 210 extern const char *priv_getsetbynum(int); 211 212 extern void priv_emptyset(priv_set_t *); 213 extern void priv_fillset(priv_set_t *); 214 extern void priv_addset(priv_set_t *, int); 215 extern void priv_delset(priv_set_t *, int); 216 extern boolean_t priv_ismember(const priv_set_t *, int); 217 extern boolean_t priv_isemptyset(const priv_set_t *); 218 extern boolean_t priv_isfullset(const priv_set_t *); 219 extern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *); 220 extern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *); 221 extern int priv_proc_cred_perm(const struct cred *, struct proc *, 222 struct cred **, int); 223 extern void priv_intersect(const priv_set_t *, priv_set_t *); 224 extern void priv_union(const priv_set_t *, priv_set_t *); 225 extern void priv_inverse(priv_set_t *); 226 227 extern void priv_set_PA(cred_t *); 228 extern void priv_adjust_PA(cred_t *); 229 extern boolean_t priv_can_clear_PA(const cred_t *); 230 231 #endif /* _KERNEL */ 232 233 #ifdef __cplusplus 234 } 235 #endif 236 237 #endif /* _SYS_PRIV_H */ 238