1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _SYS_PRIV_H 27 #define _SYS_PRIV_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" /* from TSOL 8 */ 30 31 #include <sys/types.h> 32 #include <sys/cred.h> 33 #include <sys/priv_names.h> 34 35 #ifdef __cplusplus 36 extern "C" { 37 #endif 38 39 typedef uint32_t priv_chunk_t; 40 typedef struct priv_set priv_set_t; 41 42 #ifdef _KERNEL 43 44 /* 45 * Kernel type definitions. 46 */ 47 typedef int priv_ptype_t; 48 typedef int priv_t; 49 50 #else /* _KERNEL */ 51 52 /* 53 * Userland type definitions. 54 */ 55 56 #ifdef __STDC__ 57 typedef const char *priv_ptype_t; 58 typedef const char *priv_t; 59 #else 60 typedef char *priv_ptype_t; 61 typedef char *priv_t; 62 #endif 63 64 #endif /* _KERNEL */ 65 66 /* 67 * priv_op_t indicates a privilege operation type 68 */ 69 typedef enum priv_op { 70 PRIV_ON, 71 PRIV_OFF, 72 PRIV_SET 73 } priv_op_t; 74 75 /* 76 * Privilege system call subcodes. 77 */ 78 79 #define PRIVSYS_SETPPRIV 0 80 #define PRIVSYS_GETPPRIV 1 81 #define PRIVSYS_GETIMPLINFO 2 82 #define PRIVSYS_SETPFLAGS 3 83 #define PRIVSYS_GETPFLAGS 4 84 #define PRIVSYS_ISSETUGID 5 85 #define PRIVSYS_KLPD_REG 6 86 #define PRIVSYS_KLPD_UNREG 7 87 88 /* 89 * Maximum length of a user defined privilege name. 90 */ 91 #define PRIVNAME_MAX 32 92 93 /* 94 * Privilege interface functions for those parts of the kernel that 95 * know nothing of the privilege internals. 96 * 97 * A privilege implementation can have a varying number of sets; sets 98 * consist of a number of priv_chunk_t's and the size is expressed as such. 99 * The privileges can be represented as 100 * 101 * priv_chunk_t privs[info.priv_nsets][info.priv_setsize] 102 * ... priv_infosize of extra information ... 103 * 104 * Extra data contained in the privilege information consists of chunks 105 * of data with specified size and type all headed by a priv_info_t header 106 * which defines both the type of information as well as the size of the 107 * information. ((char*)&info)+info->priv_info_size should be rounded up 108 * to point to the next piece of information. 109 */ 110 111 typedef struct priv_impl_info { 112 uint32_t priv_headersize; /* sizeof (priv_impl_info) */ 113 uint32_t priv_flags; /* additional flags */ 114 uint32_t priv_nsets; /* number of priv sets */ 115 uint32_t priv_setsize; /* size in priv_chunk_t */ 116 uint32_t priv_max; /* highest actual valid priv */ 117 uint32_t priv_infosize; /* Per proc. additional info */ 118 uint32_t priv_globalinfosize; /* Per system info */ 119 } priv_impl_info_t; 120 121 #define PRIV_IMPL_INFO_SIZE(p) \ 122 ((p)->priv_headersize + (p)->priv_globalinfosize) 123 124 #define PRIV_PRPRIV_INFO_OFFSET(p) \ 125 (sizeof (*(p)) + \ 126 ((p)->pr_nsets * (p)->pr_setsize - 1) * sizeof (priv_chunk_t)) 127 128 #define PRIV_PRPRIV_SIZE(p) \ 129 (PRIV_PRPRIV_INFO_OFFSET(p) + (p)->pr_infosize) 130 131 /* 132 * Per credential flags. 133 */ 134 #define PRIV_DEBUG 0x0001 /* User debugging */ 135 #define PRIV_AWARE 0x0002 /* Is privilege aware */ 136 #define PRIV_AWARE_INHERIT 0x0004 /* Inherit awareness */ 137 #define __PROC_PROTECT 0x0008 /* Private */ 138 #define NET_MAC_AWARE 0x0010 /* Is MAC aware */ 139 #define NET_MAC_AWARE_INHERIT 0x0020 /* Inherit MAC aware */ 140 #define PRIV_XPOLICY 0x0080 /* Extended policy */ 141 142 /* user-settable flags: */ 143 #define PRIV_USER (PRIV_DEBUG | NET_MAC_AWARE | NET_MAC_AWARE_INHERIT |\ 144 PRIV_XPOLICY) 145 146 /* 147 * Header of the privilege info data structure; multiple structures can 148 * follow the privilege sets and priv_impl_info structures. 149 */ 150 typedef struct priv_info { 151 uint32_t priv_info_type; 152 uint32_t priv_info_size; 153 } priv_info_t; 154 155 typedef struct priv_info_uint { 156 priv_info_t info; 157 uint_t val; 158 } priv_info_uint_t; 159 160 /* 161 * Global privilege set information item; the actual size of the array is 162 * {priv_setsize}. 163 */ 164 typedef struct priv_info_set { 165 priv_info_t info; 166 priv_chunk_t set[1]; 167 } priv_info_set_t; 168 169 /* 170 * names[1] is a place holder which can contain multiple NUL terminated, 171 * non-empty strings. 172 */ 173 174 typedef struct priv_info_names { 175 priv_info_t info; 176 int cnt; /* number of strings */ 177 char names[1]; /* "string1\0string2\0 ..stringN\0" */ 178 } priv_info_names_t; 179 180 /* 181 * Privilege information types. 182 */ 183 #define PRIV_INFO_SETNAMES 0x0001 184 #define PRIV_INFO_PRIVNAMES 0x0002 185 #define PRIV_INFO_BASICPRIVS 0x0003 186 #define PRIV_INFO_FLAGS 0x0004 187 188 /* 189 * Special "privileges" used to indicate special conditions in privilege 190 * debugging/tracing code. 191 */ 192 #define PRIV_ALL (-1) /* All privileges required */ 193 #define PRIV_MULTIPLE (-2) /* More than one */ 194 #define PRIV_NONE (-3) /* No value */ 195 #define PRIV_ALLZONE (-4) /* All privileges in zone */ 196 #define PRIV_GLOBAL (-5) /* Must be in global zone */ 197 198 #ifdef _KERNEL 199 200 #define PRIV_ALLOC 0x1 201 202 struct proc; 203 struct prpriv; 204 struct cred; 205 206 extern int priv_prgetprivsize(struct prpriv *); 207 extern void cred2prpriv(const struct cred *, struct prpriv *); 208 extern int priv_pr_spriv(struct proc *, struct prpriv *, const struct cred *); 209 210 extern priv_impl_info_t *priv_hold_implinfo(void); 211 extern void priv_release_implinfo(void); 212 extern size_t priv_get_implinfo_size(void); 213 extern const priv_set_t *priv_getset(const struct cred *, int); 214 extern void priv_getinfo(const struct cred *, void *); 215 extern int priv_getbyname(const char *, uint_t); 216 extern int priv_getsetbyname(const char *, int); 217 extern const char *priv_getbynum(int); 218 extern const char *priv_getsetbynum(int); 219 220 extern void priv_emptyset(priv_set_t *); 221 extern void priv_fillset(priv_set_t *); 222 extern void priv_addset(priv_set_t *, int); 223 extern void priv_delset(priv_set_t *, int); 224 extern boolean_t priv_ismember(const priv_set_t *, int); 225 extern boolean_t priv_isemptyset(const priv_set_t *); 226 extern boolean_t priv_isfullset(const priv_set_t *); 227 extern boolean_t priv_isequalset(const priv_set_t *, const priv_set_t *); 228 extern boolean_t priv_issubset(const priv_set_t *, const priv_set_t *); 229 extern int priv_proc_cred_perm(const struct cred *, struct proc *, 230 struct cred **, int); 231 extern void priv_intersect(const priv_set_t *, priv_set_t *); 232 extern void priv_union(const priv_set_t *, priv_set_t *); 233 extern void priv_inverse(priv_set_t *); 234 235 extern void priv_set_PA(cred_t *); 236 extern void priv_adjust_PA(cred_t *); 237 extern boolean_t priv_can_clear_PA(const cred_t *); 238 239 extern int setpflags(uint_t, uint_t, cred_t *); 240 extern uint_t getpflags(uint_t, const cred_t *); 241 242 #endif /* _KERNEL */ 243 244 #ifdef __cplusplus 245 } 246 #endif 247 248 #endif /* _SYS_PRIV_H */ 249