1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22/* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 * 26INSERT COMMENT 27 */ 28 29#pragma ident "%Z%%M% %I% %E% SMI" 30 31# 32# Privileges can be added to this file at any location, not 33# necessarily at the end. For patches, it is probably best to 34# add the new privilege at the end; for ordinary releases privileges 35# should be ordered alphabetically. 36# 37 38privilege PRIV_CONTRACT_EVENT 39 40 Allows a process to request critical events without limitation. 41 Allows a process to request reliable delivery of all events on 42 any event queue. 43 44privilege PRIV_CONTRACT_OBSERVER 45 46 Allows a process to observe contract events generated by 47 contracts created and owned by users other than the process's 48 effective user ID. 49 Allows a process to open contract event endpoints belonging to 50 contracts created and owned by users other than the process's 51 effective user ID. 52 53privilege PRIV_CPC_CPU 54 55 Allow a process to access per-CPU hardware performance counters. 56 57privilege PRIV_DTRACE_KERNEL 58 59 Allows DTrace kernel-level tracing. 60 61privilege PRIV_DTRACE_PROC 62 63 Allows DTrace process-level tracing. 64 Allows process-level tracing probes to be placed and enabled in 65 processes to which the user has permissions. 66 67privilege PRIV_DTRACE_USER 68 69 Allows DTrace user-level tracing. 70 Allows use of the syscall and profile DTrace providers to 71 examine processes to which the user has permissions. 72 73privilege PRIV_FILE_CHOWN 74 75 Allows a process to change a file's owner user ID. 76 Allows a process to change a file's group ID to one other than 77 the process' effective group ID or one of the process' 78 supplemental group IDs. 79 80privilege PRIV_FILE_CHOWN_SELF 81 82 Allows a process to give away its files; a process with this 83 privilege will run as if {_POSIX_CHOWN_RESTRICTED} is not 84 in effect. 85 86privilege PRIV_FILE_DAC_EXECUTE 87 88 Allows a process to execute an executable file whose permission 89 bits or ACL do not allow the process execute permission. 90 91privilege PRIV_FILE_DAC_READ 92 93 Allows a process to read a file or directory whose permission 94 bits or ACL do not allow the process read permission. 95 96privilege PRIV_FILE_DAC_SEARCH 97 98 Allows a process to search a directory whose permission bits or 99 ACL do not allow the process search permission. 100 101privilege PRIV_FILE_DAC_WRITE 102 103 Allows a process to write a file or directory whose permission 104 bits or ACL do not allow the process write permission. 105 In order to write files owned by uid 0 in the absence of an 106 effective uid of 0 ALL privileges are required. 107 108basic privilege PRIV_FILE_LINK_ANY 109 110 Allows a process to create hardlinks to files owned by a uid 111 different from the process' effective uid. 112 113privilege PRIV_FILE_OWNER 114 115 Allows a process which is not the owner of a file or directory 116 to perform the following operations that are normally permitted 117 only for the file owner: modify that file's access and 118 modification times; remove or rename a file or directory whose 119 parent directory has the ``save text image after execution'' 120 (sticky) bit set; mount a ``namefs'' upon a file; modify 121 permission bits or ACL except for the set-uid and set-gid 122 bits. 123 124privilege PRIV_FILE_SETID 125 126 Allows a process to change the ownership of a file or write to 127 a file without the set-user-ID and set-group-ID bits being 128 cleared. 129 Allows a process to set the set-group-ID bit on a file or 130 directory whose group is not the process' effective group or 131 one of the process' supplemental groups. 132 Allows a process to set the set-user-ID bit on a file with 133 different ownership in the presence of PRIV_FILE_OWNER. 134 Additional restrictions apply when creating or modifying a 135 set-uid 0 file. 136 137privilege PRIV_GART_ACCESS 138 139 Allows a process to make ioctls to agpgart device except 140 that AGPIOC_INFO ioctl needs no privilege. Typically only 141 xserver process needs to have this privilege. And a process 142 with this privilege is also allowed to map aperture ranges 143 through agpgart driver. 144 145privilege PRIV_GART_MAP 146 147 Allows a process to map aperture ranges through agpgart 148 driver. This privilege won't allow the process to do agpgart 149 ioctls other than AGPIOC_INFO. 150 151privilege PRIV_IPC_DAC_READ 152 153 Allows a process to read a System V IPC 154 Message Queue, Semaphore Set, or Shared Memory Segment whose 155 permission bits do not allow the process read permission. 156 Allows a process to read remote shared memory whose 157 permission bits do not allow the process read permission. 158 159privilege PRIV_IPC_DAC_WRITE 160 161 Allows a process to write a System V IPC 162 Message Queue, Semaphore Set, or Shared Memory Segment whose 163 permission bits do not allow the process write permission. 164 Allows a process to read remote shared memory whose 165 permission bits do not allow the process write permission. 166 Additional restrictions apply if the owner of the object has uid 0 167 and the effective uid of the current process is not 0. 168 169privilege PRIV_IPC_OWNER 170 171 Allows a process which is not the owner of a System 172 V IPC Message Queue, Semaphore Set, or Shared Memory Segment to 173 remove, change ownership of, or change permission bits of the 174 Message Queue, Semaphore Set, or Shared Memory Segment. 175 Additional restrictions apply if the owner of the object has uid 0 176 and the effective uid of the current process is not 0. 177 178privilege PRIV_NET_ICMPACCESS 179 180 Allows a process to send and receive ICMP packets. 181 182privilege PRIV_NET_PRIVADDR 183 184 Allows a process to bind to a privileged port 185 number. The privilege port numbers are 1-1023 (the traditional 186 UNIX privileged ports) as well as those ports marked as 187 "udp/tcp_extra_priv_ports" with the exception of the ports 188 reserved for use by NFS. 189 190privilege PRIV_NET_RAWACCESS 191 192 Allows a process to have direct access to the network layer. 193 194unsafe privilege PRIV_PROC_AUDIT 195 196 Allows a process to generate audit records. 197 Allows a process to get its own audit pre-selection information. 198 199privilege PRIV_PROC_CHROOT 200 201 Allows a process to change its root directory. 202 203privilege PRIV_PROC_CLOCK_HIGHRES 204 205 Allows a process to use high resolution timers. 206 207basic privilege PRIV_PROC_EXEC 208 209 Allows a process to call execve(). 210 211basic privilege PRIV_PROC_FORK 212 213 Allows a process to call fork1()/forkall()/vfork() 214 215basic privilege PRIV_PROC_INFO 216 217 Allows a process to examine the status of processes other 218 than those it can send signals to. Processes which cannot 219 be examined cannot be seen in /proc and appear not to exist. 220 221privilege PRIV_PROC_LOCK_MEMORY 222 223 Allows a process to lock pages in physical memory. 224 225privilege PRIV_PROC_OWNER 226 227 Allows a process to send signals to other processes, inspect 228 and modify process state to other processes regardless of 229 ownership. When modifying another process, additional 230 restrictions apply: the effective privilege set of the 231 attaching process must be a superset of the target process' 232 effective, permitted and inheritable sets; the limit set must 233 be a superset of the target's limit set; if the target process 234 has any uid set to 0 all privilege must be asserted unless the 235 effective uid is 0. 236 Allows a process to bind arbitrary processes to CPUs. 237 238privilege PRIV_PROC_PRIOCNTL 239 240 Allows a process to elevate its priority above its current level. 241 Allows a process to change its scheduling class to any scheduling class, 242 including the RT class. 243 244basic privilege PRIV_PROC_SESSION 245 246 Allows a process to send signals or trace processes outside its 247 session. 248 249unsafe privilege PRIV_PROC_SETID 250 251 Allows a process to set its uids at will. 252 Assuming uid 0 requires all privileges to be asserted. 253 254privilege PRIV_PROC_TASKID 255 256 Allows a process to assign a new task ID to the calling process. 257 258privilege PRIV_PROC_ZONE 259 260 Allows a process to trace or send signals to processes in 261 other zones. 262 263privilege PRIV_SYS_ACCT 264 265 Allows a process to enable and disable and manage accounting through 266 acct(2), getacct(2), putacct(2) and wracct(2). 267 268privilege PRIV_SYS_ADMIN 269 270 Allows a process to perform system administration tasks such 271 as setting node and domain name and specifying nscd and coreadm 272 settings. 273 274privilege PRIV_SYS_AUDIT 275 276 Allows a process to start the (kernel) audit daemon. 277 Allows a process to view and set audit state (audit user ID, 278 audit terminal ID, audit sessions ID, audit pre-selection mask). 279 Allows a process to turn off and on auditing. 280 Allows a process to configure the audit parameters (cache and 281 queue sizes, event to class mappings, policy options). 282 283privilege PRIV_SYS_CONFIG 284 285 Allows a process to perform various system configuration tasks. 286 Allows a process to add and remove swap devices; when adding a swap 287 device, a process must also have sufficient privileges to read from 288 and write to the swap device. 289 290privilege PRIV_SYS_DEVICES 291 292 Allows a process to successfully call a kernel module that 293 calls the kernel drv_priv(9F) function to check for allowed 294 access. 295 Allows a process to open the real console device directly. 296 Allows a process to open devices that have been exclusively opened. 297 298privilege PRIV_SYS_IPC_CONFIG 299 300 Allows a process to increase the size of a System V IPC Message 301 Queue buffer. 302 303privilege PRIV_SYS_LINKDIR 304 305 Allows a process to unlink and link directories. 306 307privilege PRIV_SYS_MOUNT 308 309 Allows filesystem specific administrative procedures, such as 310 filesystem configuration ioctls, quota calls and creation/deletion 311 of snapshots. 312 Allows a process to mount and unmount filesystems which would 313 otherwise be restricted (i.e., most filesystems except 314 namefs). 315 A process performing a mount operation needs to have 316 appropriate access to the device being mounted (read-write for 317 "rw" mounts, read for "ro" mounts). 318 A process performing any of the aforementioned 319 filesystem operations needs to have read/write/owner 320 access to the mount point. 321 Only regular files and directories can serve as mount points 322 for processes which do not have all zone privileges asserted. 323 Unless a process has all zone privileges, the mount(2) 324 system call will force the "nosuid" and "restrict" options, the 325 latter only for autofs mountpoints. 326 Regardless of privileges, a process running in a non-global zone may 327 only control mounts performed from within said zone. 328 Outside the global zone, the "nodevices" option is always forced. 329 330privilege PRIV_SYS_NET_CONFIG 331 332 Allows a process to configure a system's network interfaces and routes. 333 Allows a process to configure network parameters using ndd. 334 Allows a process access to otherwise restricted information using ndd. 335 Allows a process to push the rpcmod STREAMs module. 336 Allows a process to pop anchored STREAMs modules. 337 Allows a process to INSERT/REMOVE STREAMs modules on locations other 338 than the top of the module stack. 339 Allows a process to configure IPsec. 340 341privilege PRIV_SYS_NFS 342 343 Allows a process to perform Sun private NFS specific system calls. 344 Allows a process to bind to ports reserved by NFS: ports 2049 (nfs) 345 and port 4045 (lockd). 346 347privilege PRIV_SYS_RES_CONFIG 348 349 Allows a process to create and delete processor sets, assign 350 CPUs to processor sets and override the PSET_NOESCAPE property. 351 Allows a process to change the operational status of CPUs in 352 the system using p_online(2). 353 Allows a process to configure resource pools and to bind 354 processes to pools 355 356unsafe privilege PRIV_SYS_RESOURCE 357 358 Allows a process to modify the resource limits specified 359 by setrlimit(2) and setrctl(2) without restriction. 360 Allows a process to exceed the per-user maximum number of 361 processes. 362 Allows a process to extend or create files on a filesystem that 363 has less than minfree space in reserve. 364 365privilege PRIV_SYS_SUSER_COMPAT 366 367 Allows a process to successfully call a third party loadable module 368 that calls the kernel suser() function to check for allowed access. 369 This privilege exists only for third party loadable module 370 compatibility and is not used by Solaris proper. 371 372privilege PRIV_SYS_TIME 373 374 Allows a process to manipulate system time using any of the 375 appropriate system calls: stime, adjtime, ntp_adjtime and 376 the IA specific RTC calls. 377set PRIV_EFFECTIVE 378 379 Set of privileges currently in effect. 380 381set PRIV_INHERITABLE 382 383 Set of privileges that comes into effect on exec. 384 385set PRIV_PERMITTED 386 387 Set of privileges that can be put into the effective set without 388 restriction. 389 390set PRIV_LIMIT 391 392 Set of privileges that determines the absolute upper bound of 393 privileges this process and its off-spring can obtain. 394