17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ee519a1fSgjelinek * Common Development and Distribution License (the "License"). 6ee519a1fSgjelinek * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*b59b3655SGarrett D'Amore * Copyright 2014 Garrett D'Amore <garrett@damore.org> 23*b59b3655SGarrett D'Amore * 2460030f27SMark Shellenbaum * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 257c478bd9Sstevel@tonic-gate * Use is subject to license terms. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate #ifndef _SYS_ACL_H 297c478bd9Sstevel@tonic-gate #define _SYS_ACL_H 307c478bd9Sstevel@tonic-gate 317c478bd9Sstevel@tonic-gate #include <sys/types.h> 32da6c28aaSamw #include <sys/acl_impl.h> 337c478bd9Sstevel@tonic-gate 347c478bd9Sstevel@tonic-gate #ifdef __cplusplus 357c478bd9Sstevel@tonic-gate extern "C" { 367c478bd9Sstevel@tonic-gate #endif 377c478bd9Sstevel@tonic-gate 387c478bd9Sstevel@tonic-gate #define MAX_ACL_ENTRIES (1024) /* max entries of each type */ 397c478bd9Sstevel@tonic-gate typedef struct acl { 407c478bd9Sstevel@tonic-gate int a_type; /* the type of ACL entry */ 417c478bd9Sstevel@tonic-gate uid_t a_id; /* the entry in -uid or gid */ 427c478bd9Sstevel@tonic-gate o_mode_t a_perm; /* the permission field */ 437c478bd9Sstevel@tonic-gate } aclent_t; 447c478bd9Sstevel@tonic-gate 457c478bd9Sstevel@tonic-gate typedef struct ace { 467c478bd9Sstevel@tonic-gate uid_t a_who; /* uid or gid */ 47fa9e4066Sahrens uint32_t a_access_mask; /* read,write,... */ 487c478bd9Sstevel@tonic-gate uint16_t a_flags; /* see below */ 497c478bd9Sstevel@tonic-gate uint16_t a_type; /* allow or deny */ 507c478bd9Sstevel@tonic-gate } ace_t; 517c478bd9Sstevel@tonic-gate 52fa9e4066Sahrens typedef struct acl_info acl_t; 53fa9e4066Sahrens 547c478bd9Sstevel@tonic-gate /* 557c478bd9Sstevel@tonic-gate * The following are Defined types for an aclent_t. 567c478bd9Sstevel@tonic-gate */ 577c478bd9Sstevel@tonic-gate #define USER_OBJ (0x01) /* object owner */ 587c478bd9Sstevel@tonic-gate #define USER (0x02) /* additional users */ 597c478bd9Sstevel@tonic-gate #define GROUP_OBJ (0x04) /* owning group of the object */ 607c478bd9Sstevel@tonic-gate #define GROUP (0x08) /* additional groups */ 617c478bd9Sstevel@tonic-gate #define CLASS_OBJ (0x10) /* file group class and mask entry */ 627c478bd9Sstevel@tonic-gate #define OTHER_OBJ (0x20) /* other entry for the object */ 637c478bd9Sstevel@tonic-gate #define ACL_DEFAULT (0x1000) /* default flag */ 647c478bd9Sstevel@tonic-gate /* default object owner */ 657c478bd9Sstevel@tonic-gate #define DEF_USER_OBJ (ACL_DEFAULT | USER_OBJ) 66da6c28aaSamw /* default additional users */ 677c478bd9Sstevel@tonic-gate #define DEF_USER (ACL_DEFAULT | USER) 687c478bd9Sstevel@tonic-gate /* default owning group */ 697c478bd9Sstevel@tonic-gate #define DEF_GROUP_OBJ (ACL_DEFAULT | GROUP_OBJ) 707c478bd9Sstevel@tonic-gate /* default additional groups */ 717c478bd9Sstevel@tonic-gate #define DEF_GROUP (ACL_DEFAULT | GROUP) 727c478bd9Sstevel@tonic-gate /* default mask entry */ 737c478bd9Sstevel@tonic-gate #define DEF_CLASS_OBJ (ACL_DEFAULT | CLASS_OBJ) 747c478bd9Sstevel@tonic-gate /* default other entry */ 757c478bd9Sstevel@tonic-gate #define DEF_OTHER_OBJ (ACL_DEFAULT | OTHER_OBJ) 767c478bd9Sstevel@tonic-gate 777c478bd9Sstevel@tonic-gate /* 787c478bd9Sstevel@tonic-gate * The following are defined for ace_t. 797c478bd9Sstevel@tonic-gate */ 80fa9e4066Sahrens #define ACE_READ_DATA 0x00000001 81fa9e4066Sahrens #define ACE_LIST_DIRECTORY 0x00000001 82fa9e4066Sahrens #define ACE_WRITE_DATA 0x00000002 83fa9e4066Sahrens #define ACE_ADD_FILE 0x00000002 84fa9e4066Sahrens #define ACE_APPEND_DATA 0x00000004 85fa9e4066Sahrens #define ACE_ADD_SUBDIRECTORY 0x00000004 86fa9e4066Sahrens #define ACE_READ_NAMED_ATTRS 0x00000008 87fa9e4066Sahrens #define ACE_WRITE_NAMED_ATTRS 0x00000010 88fa9e4066Sahrens #define ACE_EXECUTE 0x00000020 89fa9e4066Sahrens #define ACE_DELETE_CHILD 0x00000040 90fa9e4066Sahrens #define ACE_READ_ATTRIBUTES 0x00000080 91fa9e4066Sahrens #define ACE_WRITE_ATTRIBUTES 0x00000100 92fa9e4066Sahrens #define ACE_DELETE 0x00010000 93fa9e4066Sahrens #define ACE_READ_ACL 0x00020000 94fa9e4066Sahrens #define ACE_WRITE_ACL 0x00040000 95fa9e4066Sahrens #define ACE_WRITE_OWNER 0x00080000 96fa9e4066Sahrens #define ACE_SYNCHRONIZE 0x00100000 97fa9e4066Sahrens 987c478bd9Sstevel@tonic-gate #define ACE_FILE_INHERIT_ACE 0x0001 997c478bd9Sstevel@tonic-gate #define ACE_DIRECTORY_INHERIT_ACE 0x0002 100fa9e4066Sahrens #define ACE_NO_PROPAGATE_INHERIT_ACE 0x0004 1017c478bd9Sstevel@tonic-gate #define ACE_INHERIT_ONLY_ACE 0x0008 102fa9e4066Sahrens #define ACE_SUCCESSFUL_ACCESS_ACE_FLAG 0x0010 103fa9e4066Sahrens #define ACE_FAILED_ACCESS_ACE_FLAG 0x0020 104fa9e4066Sahrens #define ACE_IDENTIFIER_GROUP 0x0040 105da6c28aaSamw #define ACE_INHERITED_ACE 0x0080 106fa9e4066Sahrens #define ACE_OWNER 0x1000 107fa9e4066Sahrens #define ACE_GROUP 0x2000 108fa9e4066Sahrens #define ACE_EVERYONE 0x4000 109fa9e4066Sahrens 110fa9e4066Sahrens #define ACE_ACCESS_ALLOWED_ACE_TYPE 0x0000 111fa9e4066Sahrens #define ACE_ACCESS_DENIED_ACE_TYPE 0x0001 112fa9e4066Sahrens #define ACE_SYSTEM_AUDIT_ACE_TYPE 0x0002 113fa9e4066Sahrens #define ACE_SYSTEM_ALARM_ACE_TYPE 0x0003 114fa9e4066Sahrens 115da6c28aaSamw #define ACL_AUTO_INHERIT 0x0001 116da6c28aaSamw #define ACL_PROTECTED 0x0002 117da6c28aaSamw #define ACL_DEFAULTED 0x0004 118da6c28aaSamw #define ACL_FLAGS_ALL (ACL_AUTO_INHERIT|ACL_PROTECTED| \ 119da6c28aaSamw ACL_DEFAULTED) 120da6c28aaSamw 121da6c28aaSamw #ifdef _KERNEL 122da6c28aaSamw 123da6c28aaSamw /* 124da6c28aaSamw * These are only applicable in a CIFS context. 125da6c28aaSamw */ 126da6c28aaSamw #define ACE_ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x04 127da6c28aaSamw #define ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x05 128da6c28aaSamw #define ACE_ACCESS_DENIED_OBJECT_ACE_TYPE 0x06 129da6c28aaSamw #define ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x07 130da6c28aaSamw #define ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE 0x08 131da6c28aaSamw #define ACE_ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x09 132da6c28aaSamw #define ACE_ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A 133da6c28aaSamw #define ACE_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B 134da6c28aaSamw #define ACE_ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE 0x0C 135da6c28aaSamw #define ACE_SYSTEM_AUDIT_CALLBACK_ACE_TYPE 0x0D 136da6c28aaSamw #define ACE_SYSTEM_ALARM_CALLBACK_ACE_TYPE 0x0E 137da6c28aaSamw #define ACE_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE 0x0F 138da6c28aaSamw #define ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 0x10 139da6c28aaSamw 140da6c28aaSamw #define ACE_ALL_TYPES 0x001F 141da6c28aaSamw 142da6c28aaSamw typedef struct ace_object { 143da6c28aaSamw uid_t a_who; /* uid or gid */ 144da6c28aaSamw uint32_t a_access_mask; /* read,write,... */ 145da6c28aaSamw uint16_t a_flags; /* see below */ 146da6c28aaSamw uint16_t a_type; /* allow or deny */ 147da6c28aaSamw uint8_t a_obj_type[16]; /* obj type */ 148da6c28aaSamw uint8_t a_inherit_obj_type[16]; /* inherit obj */ 149da6c28aaSamw } ace_object_t; 150da6c28aaSamw 151da6c28aaSamw #endif 152da6c28aaSamw 153fa9e4066Sahrens #define ACE_ALL_PERMS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 154fa9e4066Sahrens ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_READ_NAMED_ATTRS| \ 155fa9e4066Sahrens ACE_WRITE_NAMED_ATTRS|ACE_EXECUTE|ACE_DELETE_CHILD|ACE_READ_ATTRIBUTES| \ 156fa9e4066Sahrens ACE_WRITE_ATTRIBUTES|ACE_DELETE|ACE_READ_ACL|ACE_WRITE_ACL| \ 157fa9e4066Sahrens ACE_WRITE_OWNER|ACE_SYNCHRONIZE) 158fa9e4066Sahrens 15960030f27SMark Shellenbaum #define ACE_ALL_WRITE_PERMS (ACE_WRITE_DATA|ACE_APPEND_DATA| \ 16060030f27SMark Shellenbaum ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS|ACE_WRITE_ACL| \ 16160030f27SMark Shellenbaum ACE_WRITE_OWNER|ACE_DELETE|ACE_DELETE_CHILD) 16260030f27SMark Shellenbaum 163b249c65cSmarks #define ACE_READ_PERMS (ACE_READ_DATA|ACE_READ_ACL|ACE_READ_ATTRIBUTES| \ 164b249c65cSmarks ACE_READ_NAMED_ATTRS) 165b249c65cSmarks 166b249c65cSmarks #define ACE_WRITE_PERMS (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES| \ 167b249c65cSmarks ACE_WRITE_NAMED_ATTRS) 168b249c65cSmarks 169b249c65cSmarks #define ACE_MODIFY_PERMS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 170b249c65cSmarks ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_READ_NAMED_ATTRS| \ 171b249c65cSmarks ACE_WRITE_NAMED_ATTRS|ACE_EXECUTE|ACE_DELETE_CHILD|ACE_READ_ATTRIBUTES| \ 172b249c65cSmarks ACE_WRITE_ATTRIBUTES|ACE_DELETE|ACE_READ_ACL|ACE_SYNCHRONIZE) 1737c478bd9Sstevel@tonic-gate /* 1747c478bd9Sstevel@tonic-gate * The following flags are supported by both NFSv4 ACLs and ace_t. 1757c478bd9Sstevel@tonic-gate */ 1767c478bd9Sstevel@tonic-gate #define ACE_NFSV4_SUP_FLAGS (ACE_FILE_INHERIT_ACE | \ 1777c478bd9Sstevel@tonic-gate ACE_DIRECTORY_INHERIT_ACE | \ 178fa9e4066Sahrens ACE_NO_PROPAGATE_INHERIT_ACE | \ 179fa9e4066Sahrens ACE_INHERIT_ONLY_ACE | \ 180fa9e4066Sahrens ACE_IDENTIFIER_GROUP) 1817c478bd9Sstevel@tonic-gate 182da6c28aaSamw #define ACE_TYPE_FLAGS (ACE_OWNER|ACE_GROUP|ACE_EVERYONE| \ 183da6c28aaSamw ACE_IDENTIFIER_GROUP) 184da6c28aaSamw #define ACE_INHERIT_FLAGS (ACE_FILE_INHERIT_ACE| \ 185da6c28aaSamw ACE_DIRECTORY_INHERIT_ACE|ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE) 1865a5eeccaSmarks 1877c478bd9Sstevel@tonic-gate /* cmd args to acl(2) for aclent_t */ 1887c478bd9Sstevel@tonic-gate #define GETACL 1 1897c478bd9Sstevel@tonic-gate #define SETACL 2 1907c478bd9Sstevel@tonic-gate #define GETACLCNT 3 1917c478bd9Sstevel@tonic-gate 192fa9e4066Sahrens /* cmd's to manipulate ace acls. */ 1937c478bd9Sstevel@tonic-gate #define ACE_GETACL 4 1947c478bd9Sstevel@tonic-gate #define ACE_SETACL 5 1957c478bd9Sstevel@tonic-gate #define ACE_GETACLCNT 6 1967c478bd9Sstevel@tonic-gate 1977c478bd9Sstevel@tonic-gate /* minimal acl entries from GETACLCNT */ 1987c478bd9Sstevel@tonic-gate #define MIN_ACL_ENTRIES 4 1997c478bd9Sstevel@tonic-gate 2007c478bd9Sstevel@tonic-gate #if !defined(_KERNEL) 2017c478bd9Sstevel@tonic-gate 2027c478bd9Sstevel@tonic-gate /* acl check errors */ 2037c478bd9Sstevel@tonic-gate #define GRP_ERROR 1 2047c478bd9Sstevel@tonic-gate #define USER_ERROR 2 2057c478bd9Sstevel@tonic-gate #define OTHER_ERROR 3 2067c478bd9Sstevel@tonic-gate #define CLASS_ERROR 4 2077c478bd9Sstevel@tonic-gate #define DUPLICATE_ERROR 5 2087c478bd9Sstevel@tonic-gate #define MISS_ERROR 6 2097c478bd9Sstevel@tonic-gate #define MEM_ERROR 7 2107c478bd9Sstevel@tonic-gate #define ENTRY_ERROR 8 2117c478bd9Sstevel@tonic-gate 212fa9e4066Sahrens 2137c478bd9Sstevel@tonic-gate /* 2147c478bd9Sstevel@tonic-gate * similar to ufs_acl.h: changed to char type for user commands (tar, cpio) 2157c478bd9Sstevel@tonic-gate * Attribute types 2167c478bd9Sstevel@tonic-gate */ 2177c478bd9Sstevel@tonic-gate #define UFSD_FREE ('0') /* Free entry */ 2187c478bd9Sstevel@tonic-gate #define UFSD_ACL ('1') /* Access Control Lists */ 2197c478bd9Sstevel@tonic-gate #define UFSD_DFACL ('2') /* reserved for future use */ 220fa9e4066Sahrens #define ACE_ACL ('3') /* ace_t style acls */ 221fa9e4066Sahrens 222fa9e4066Sahrens /* 223fa9e4066Sahrens * flag to [f]acl_get() 224fa9e4066Sahrens * controls whether a trivial acl should be returned. 225fa9e4066Sahrens */ 226fa9e4066Sahrens #define ACL_NO_TRIVIAL 0x2 227fa9e4066Sahrens 2285a5eeccaSmarks 2295a5eeccaSmarks /* 2305a5eeccaSmarks * Flags to control acl_totext() 2315a5eeccaSmarks */ 2325a5eeccaSmarks 2335a5eeccaSmarks #define ACL_APPEND_ID 0x1 /* append uid/gid to user/group entries */ 2345a5eeccaSmarks #define ACL_COMPACT_FMT 0x2 /* build ACL in ls -V format */ 235ee519a1fSgjelinek #define ACL_NORESOLVE 0x4 /* don't do name service lookups */ 236b249c65cSmarks #define ACL_SID_FMT 0x8 /* use usersid/groupsid when appropriate */ 2375a5eeccaSmarks 238fa9e4066Sahrens /* 239fa9e4066Sahrens * Legacy aclcheck errors for aclent_t ACLs 240fa9e4066Sahrens */ 241fa9e4066Sahrens #define EACL_GRP_ERROR GRP_ERROR 242fa9e4066Sahrens #define EACL_USER_ERROR USER_ERROR 243fa9e4066Sahrens #define EACL_OTHER_ERROR OTHER_ERROR 244fa9e4066Sahrens #define EACL_CLASS_ERROR CLASS_ERROR 245fa9e4066Sahrens #define EACL_DUPLICATE_ERROR DUPLICATE_ERROR 246fa9e4066Sahrens #define EACL_MISS_ERROR MISS_ERROR 247fa9e4066Sahrens #define EACL_MEM_ERROR MEM_ERROR 248fa9e4066Sahrens #define EACL_ENTRY_ERROR ENTRY_ERROR 249fa9e4066Sahrens 250fa9e4066Sahrens #define EACL_INHERIT_ERROR 9 /* invalid inherit flags */ 251fa9e4066Sahrens #define EACL_FLAGS_ERROR 10 /* unknown flag value */ 252fa9e4066Sahrens #define EACL_PERM_MASK_ERROR 11 /* unknown permission */ 253fa9e4066Sahrens #define EACL_COUNT_ERROR 12 /* invalid acl count */ 254fa9e4066Sahrens 255fa9e4066Sahrens #define EACL_INVALID_SLOT 13 /* invalid acl slot */ 256fa9e4066Sahrens #define EACL_NO_ACL_ENTRY 14 /* Entry doesn't exist */ 257fa9e4066Sahrens #define EACL_DIFF_TYPE 15 /* acls aren't same type */ 258fa9e4066Sahrens 259fa9e4066Sahrens #define EACL_INVALID_USER_GROUP 16 /* need user/group name */ 260fa9e4066Sahrens #define EACL_INVALID_STR 17 /* invalid acl string */ 261fa9e4066Sahrens #define EACL_FIELD_NOT_BLANK 18 /* can't have blank field */ 262fa9e4066Sahrens #define EACL_INVALID_ACCESS_TYPE 19 /* invalid access type */ 263fa9e4066Sahrens #define EACL_UNKNOWN_DATA 20 /* Unrecognized data in ACL */ 264fa9e4066Sahrens #define EACL_MISSING_FIELDS 21 /* missing fields in acl */ 265fa9e4066Sahrens 266fa9e4066Sahrens #define EACL_INHERIT_NOTDIR 22 /* Need dir for inheritance */ 2677c478bd9Sstevel@tonic-gate 2687c478bd9Sstevel@tonic-gate extern int aclcheck(aclent_t *, int, int *); 2697c478bd9Sstevel@tonic-gate extern int acltomode(aclent_t *, int, mode_t *); 2707c478bd9Sstevel@tonic-gate extern int aclfrommode(aclent_t *, int, mode_t *); 2717c478bd9Sstevel@tonic-gate extern int aclsort(int, int, aclent_t *); 2727c478bd9Sstevel@tonic-gate extern char *acltotext(aclent_t *, int); 2737c478bd9Sstevel@tonic-gate extern aclent_t *aclfromtext(char *, int *); 274fa9e4066Sahrens extern void acl_free(acl_t *); 275fa9e4066Sahrens extern int acl_get(const char *, int, acl_t **); 276fa9e4066Sahrens extern int facl_get(int, int, acl_t **); 277fa9e4066Sahrens extern int acl_set(const char *, acl_t *acl); 278fa9e4066Sahrens extern int facl_set(int, acl_t *acl); 279fa9e4066Sahrens extern int acl_strip(const char *, uid_t, gid_t, mode_t); 280fa9e4066Sahrens extern int acl_trivial(const char *); 2815a5eeccaSmarks extern char *acl_totext(acl_t *, int); 282fa9e4066Sahrens extern int acl_fromtext(const char *, acl_t **); 283fa9e4066Sahrens extern int acl_check(acl_t *, int); 2847c478bd9Sstevel@tonic-gate 2857c478bd9Sstevel@tonic-gate #else /* !defined(_KERNEL) */ 2867c478bd9Sstevel@tonic-gate 2877c478bd9Sstevel@tonic-gate extern void ksort(caddr_t, int, int, int (*)(void *, void *)); 2887c478bd9Sstevel@tonic-gate extern int cmp2acls(void *, void *); 2897c478bd9Sstevel@tonic-gate 2907c478bd9Sstevel@tonic-gate #endif /* !defined(_KERNEL) */ 2917c478bd9Sstevel@tonic-gate 2927c478bd9Sstevel@tonic-gate extern int acl(const char *path, int cmd, int cnt, void *buf); 2937c478bd9Sstevel@tonic-gate extern int facl(int fd, int cmd, int cnt, void *buf); 2947c478bd9Sstevel@tonic-gate 2957c478bd9Sstevel@tonic-gate #ifdef __cplusplus 2967c478bd9Sstevel@tonic-gate } 2977c478bd9Sstevel@tonic-gate #endif 2987c478bd9Sstevel@tonic-gate 2997c478bd9Sstevel@tonic-gate #endif /* _SYS_ACL_H */ 300