xref: /illumos-gate/usr/src/uts/intel/os/device_policy (revision 7c478bd95313f5f23a4c958a745db2134aa03244)

#
# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#ident	"%Z%%M%	%I%	%E% SMI"
#
# Device policy configuration file.   When devices are opened the
# additional access controls in this file are enforced.
#
# The format of this file is subject to change without notice.
#
# Default open privileges, must be first entry in the file.
#

*		read_priv_set=none		write_priv_set=none

#
# Kernel memory devices.
#
mm:allkmem	read_priv_set=all		write_priv_set=all
mm:kmem		read_priv_set=none		write_priv_set=all
mm:mem		read_priv_set=none		write_priv_set=all

sad:admin	read_priv_set=sys_config	write_priv_set=sys_config

#
# Socket interface access permissions.
#
icmp		read_priv_set=net_icmpaccess	write_priv_set=net_icmpaccess
icmp6		read_priv_set=net_icmpaccess	write_priv_set=net_icmpaccess
ip		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
ip6		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
keysock		read_priv_set=sys_net_config	write_priv_set=sys_net_config
ipsecah		read_priv_set=sys_net_config	write_priv_set=sys_net_config
ipsecesp	read_priv_set=sys_net_config	write_priv_set=sys_net_config
spdsock		read_priv_set=sys_net_config	write_priv_set=sys_net_config
#
# Raw network interface access permissions
#
dnet		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
elxl		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
ibd		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
iprb		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
pcelx		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
e1000g	read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
spwr		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
dld		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
#
# Virtual network interface access permission
#
vni		read_priv_set=net_rawaccess	write_priv_set=net_rawaccess
#
# Disk devices.
#
md:admin					write_priv_set=sys_config
fssnap:ctl	read_priv_set=sys_config	write_priv_set=sys_config
#
# Other devices that require a privilege to open.
#
random						write_priv_set=sys_devices
openeepr					write_priv_set=all
dld:ctl		read_priv_set=sys_net_config	write_priv_set=sys_net_config
aggr:ctl	read_priv_set=sys_net_config	write_priv_set=sys_net_config
#
# IP Filter
#
ipf             read_priv_set=sys_net_config    write_priv_set=sys_net_config
pfil            read_priv_set=net_rawaccess     write_priv_set=net_rawaccess