xref: /titanic_52/usr/src/uts/common/os/policy.c (revision 3f7d54a6b84904c8f4d8daa4c7b577bede7df8b9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 #include <sys/types.h>
26 #include <sys/sysmacros.h>
27 #include <sys/param.h>
28 #include <sys/systm.h>
29 #include <sys/cred_impl.h>
30 #include <sys/vnode.h>
31 #include <sys/vfs.h>
32 #include <sys/stat.h>
33 #include <sys/errno.h>
34 #include <sys/kmem.h>
35 #include <sys/user.h>
36 #include <sys/proc.h>
37 #include <sys/acct.h>
38 #include <sys/ipc_impl.h>
39 #include <sys/cmn_err.h>
40 #include <sys/debug.h>
41 #include <sys/policy.h>
42 #include <sys/kobj.h>
43 #include <sys/msg.h>
44 #include <sys/devpolicy.h>
45 #include <c2/audit.h>
46 #include <sys/varargs.h>
47 #include <sys/klpd.h>
48 #include <sys/modctl.h>
49 #include <sys/disp.h>
50 #include <sys/zone.h>
51 #include <inet/optcom.h>
52 #include <sys/sdt.h>
53 #include <sys/vfs.h>
54 #include <sys/mntent.h>
55 #include <sys/contract_impl.h>
56 #include <sys/dld_ioc.h>
57 
58 /*
59  * There are two possible layers of privilege routines and two possible
60  * levels of secpolicy.  Plus one other we may not be interested in, so
61  * we may need as many as 6 but no more.
62  */
63 #define	MAXPRIVSTACK		6
64 
65 int priv_debug = 0;
66 int priv_basic_test = -1;
67 
68 /*
69  * This file contains the majority of the policy routines.
70  * Since the policy routines are defined by function and not
71  * by privilege, there is quite a bit of duplication of
72  * functions.
73  *
74  * The secpolicy functions must not make assumptions about
75  * locks held or not held as any lock can be held while they're
76  * being called.
77  *
78  * Credentials are read-only so no special precautions need to
79  * be taken while locking them.
80  *
81  * When a new policy check needs to be added to the system the
82  * following procedure should be followed:
83  *
84  *		Pick an appropriate secpolicy_*() function
85  *			-> done if one exists.
86  *		Create a new secpolicy function, preferably with
87  *		a descriptive name using the standard template.
88  *		Pick an appropriate privilege for the policy.
89  *		If no appropraite privilege exists, define new one
90  *		(this should be done with extreme care; in most cases
91  *		little is gained by adding another privilege)
92  *
93  * WHY ROOT IS STILL SPECIAL.
94  *
95  * In a number of the policy functions, there are still explicit
96  * checks for uid 0.  The rationale behind these is that many root
97  * owned files/objects hold configuration information which can give full
98  * privileges to the user once written to.  To prevent escalation
99  * of privilege by allowing just a single privilege to modify root owned
100  * objects, we've added these root specific checks where we considered
101  * them necessary: modifying root owned files, changing uids to 0, etc.
102  *
103  * PRIVILEGE ESCALATION AND ZONES.
104  *
105  * A number of operations potentially allow the caller to achieve
106  * privileges beyond the ones normally required to perform the operation.
107  * For example, if allowed to create a setuid 0 executable, a process can
108  * gain privileges beyond PRIV_FILE_SETID.  Zones, however, place
109  * restrictions on the ability to gain privileges beyond those available
110  * within the zone through file and process manipulation.  Hence, such
111  * operations require that the caller have an effective set that includes
112  * all privileges available within the current zone, or all privileges
113  * if executing in the global zone.
114  *
115  * This is indicated in the priv_policy* policy checking functions
116  * through a combination of parameters.  The "priv" parameter indicates
117  * the privilege that is required, and the "allzone" parameter indicates
118  * whether or not all privileges in the zone are required.  In addition,
119  * priv can be set to PRIV_ALL to indicate that all privileges are
120  * required (regardless of zone).  There are three scenarios of interest:
121  * (1) operation requires a specific privilege
122  * (2) operation requires a specific privilege, and requires all
123  *     privileges available within the zone (or all privileges if in
124  *     the global zone)
125  * (3) operation requires all privileges, regardless of zone
126  *
127  * For (1), priv should be set to the specific privilege, and allzone
128  * should be set to B_FALSE.
129  * For (2), priv should be set to the specific privilege, and allzone
130  * should be set to B_TRUE.
131  * For (3), priv should be set to PRIV_ALL, and allzone should be set
132  * to B_FALSE.
133  *
134  */
135 
136 /*
137  * The privileges are checked against the Effective set for
138  * ordinary processes and checked against the Limit set
139  * for euid 0 processes that haven't manipulated their privilege
140  * sets.
141  */
142 #define	HAS_ALLPRIVS(cr)	priv_isfullset(&CR_OEPRIV(cr))
143 #define	ZONEPRIVS(cr)		((cr)->cr_zone->zone_privset)
144 #define	HAS_ALLZONEPRIVS(cr)	priv_issubset(ZONEPRIVS(cr), &CR_OEPRIV(cr))
145 #define	HAS_PRIVILEGE(cr, pr)	((pr) == PRIV_ALL ? \
146 					HAS_ALLPRIVS(cr) : \
147 					PRIV_ISASSERT(&CR_OEPRIV(cr), pr))
148 
149 #define	FAST_BASIC_CHECK(cr, priv)	\
150 	if (PRIV_ISASSERT(&CR_OEPRIV(cr), priv)) { \
151 		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, B_FALSE); \
152 		return (0); \
153 	}
154 
155 /*
156  * Policy checking functions.
157  *
158  * All of the system's policy should be implemented here.
159  */
160 
161 /*
162  * Private functions which take an additional va_list argument to
163  * implement an object specific policy override.
164  */
165 static int priv_policy_ap(const cred_t *, int, boolean_t, int,
166     const char *, va_list);
167 static int priv_policy_va(const cred_t *, int, boolean_t, int,
168     const char *, ...);
169 
170 /*
171  * Generic policy calls
172  *
173  * The "bottom" functions of policy control
174  */
175 static char *
176 mprintf(const char *fmt, ...)
177 {
178 	va_list args;
179 	char *buf;
180 	size_t len;
181 
182 	va_start(args, fmt);
183 	len = vsnprintf(NULL, 0, fmt, args) + 1;
184 	va_end(args);
185 
186 	buf = kmem_alloc(len, KM_NOSLEEP);
187 
188 	if (buf == NULL)
189 		return (NULL);
190 
191 	va_start(args, fmt);
192 	(void) vsnprintf(buf, len, fmt, args);
193 	va_end(args);
194 
195 	return (buf);
196 }
197 
198 /*
199  * priv_policy_errmsg()
200  *
201  * Generate an error message if privilege debugging is enabled system wide
202  * or for this particular process.
203  */
204 
205 #define	FMTHDR	"%s[%d]: missing privilege \"%s\" (euid = %d, syscall = %d)"
206 #define	FMTMSG	" for \"%s\""
207 #define	FMTFUN	" needed at %s+0x%lx"
208 
209 /* The maximum size privilege format: the concatenation of the above */
210 #define	FMTMAX	FMTHDR FMTMSG FMTFUN "\n"
211 
212 static void
213 priv_policy_errmsg(const cred_t *cr, int priv, const char *msg)
214 {
215 	struct proc *me;
216 	pc_t stack[MAXPRIVSTACK];
217 	int depth;
218 	int i;
219 	char *sym;
220 	ulong_t off;
221 	const char *pname;
222 
223 	char *cmd;
224 	char fmt[sizeof (FMTMAX)];
225 
226 	if ((me = curproc) == &p0)
227 		return;
228 
229 	/* Privileges must be defined  */
230 	ASSERT(priv == PRIV_ALL || priv == PRIV_MULTIPLE ||
231 	    priv == PRIV_ALLZONE || priv == PRIV_GLOBAL ||
232 	    priv_getbynum(priv) != NULL);
233 
234 	if (priv == PRIV_ALLZONE && INGLOBALZONE(me))
235 		priv = PRIV_ALL;
236 
237 	if (curthread->t_pre_sys)
238 		ttolwp(curthread)->lwp_badpriv = (short)priv;
239 
240 	if (priv_debug == 0 && (CR_FLAGS(cr) & PRIV_DEBUG) == 0)
241 		return;
242 
243 	(void) strcpy(fmt, FMTHDR);
244 
245 	if (me->p_user.u_comm[0])
246 		cmd = &me->p_user.u_comm[0];
247 	else
248 		cmd = "priv_policy";
249 
250 	if (msg != NULL && *msg != '\0') {
251 		(void) strcat(fmt, FMTMSG);
252 	} else {
253 		(void) strcat(fmt, "%s");
254 		msg = "";
255 	}
256 
257 	sym = NULL;
258 
259 	depth = getpcstack(stack, MAXPRIVSTACK);
260 
261 	/*
262 	 * Try to find the first interesting function on the stack.
263 	 * priv_policy* that's us, so completely uninteresting.
264 	 * suser(), drv_priv(), secpolicy_* are also called from
265 	 * too many locations to convey useful information.
266 	 */
267 	for (i = 0; i < depth; i++) {
268 		sym = kobj_getsymname((uintptr_t)stack[i], &off);
269 		if (sym != NULL &&
270 		    strstr(sym, "hasprocperm") == 0 &&
271 		    strcmp("suser", sym) != 0 &&
272 		    strcmp("ipcaccess", sym) != 0 &&
273 		    strcmp("drv_priv", sym) != 0 &&
274 		    strncmp("secpolicy_", sym, 10) != 0 &&
275 		    strncmp("priv_policy", sym, 11) != 0)
276 			break;
277 	}
278 
279 	if (sym != NULL)
280 		(void) strcat(fmt, FMTFUN);
281 
282 	(void) strcat(fmt, "\n");
283 
284 	switch (priv) {
285 	case PRIV_ALL:
286 		pname = "ALL";
287 		break;
288 	case PRIV_MULTIPLE:
289 		pname = "MULTIPLE";
290 		break;
291 	case PRIV_ALLZONE:
292 		pname = "ZONE";
293 		break;
294 	case PRIV_GLOBAL:
295 		pname = "GLOBAL";
296 		break;
297 	default:
298 		pname = priv_getbynum(priv);
299 		break;
300 	}
301 
302 	if (CR_FLAGS(cr) & PRIV_DEBUG) {
303 		/* Remember last message, just like lwp_badpriv. */
304 		if (curthread->t_pdmsg != NULL) {
305 			kmem_free(curthread->t_pdmsg,
306 			    strlen(curthread->t_pdmsg) + 1);
307 		}
308 
309 		curthread->t_pdmsg = mprintf(fmt, cmd, me->p_pid, pname,
310 		    cr->cr_uid, curthread->t_sysnum, msg, sym, off);
311 
312 		curthread->t_post_sys = 1;
313 	}
314 	if (priv_debug) {
315 		cmn_err(CE_NOTE, fmt, cmd, me->p_pid, pname, cr->cr_uid,
316 		    curthread->t_sysnum, msg, sym, off);
317 	}
318 }
319 
320 /*
321  * Override the policy, if appropriate.  Return 0 if the external
322  * policy engine approves.
323  */
324 static int
325 priv_policy_override(const cred_t *cr, int priv, boolean_t allzone, va_list ap)
326 {
327 	priv_set_t set;
328 	int ret;
329 
330 	if (!(CR_FLAGS(cr) & PRIV_XPOLICY))
331 		return (-1);
332 
333 	if (priv == PRIV_ALL) {
334 		priv_fillset(&set);
335 	} else if (allzone) {
336 		set = *ZONEPRIVS(cr);
337 	} else {
338 		priv_emptyset(&set);
339 		priv_addset(&set, priv);
340 	}
341 	ret = klpd_call(cr, &set, ap);
342 	return (ret);
343 }
344 
345 static int
346 priv_policy_override_set(const cred_t *cr, const priv_set_t *req, va_list ap)
347 {
348 	if (CR_FLAGS(cr) & PRIV_PFEXEC)
349 		return (check_user_privs(cr, req));
350 	if (CR_FLAGS(cr) & PRIV_XPOLICY) {
351 		return (klpd_call(cr, req, ap));
352 	}
353 	return (-1);
354 }
355 
356 static int
357 priv_policy_override_set_va(const cred_t *cr, const priv_set_t *req, ...)
358 {
359 	va_list ap;
360 	int ret;
361 
362 	va_start(ap, req);
363 	ret = priv_policy_override_set(cr, req, ap);
364 	va_end(ap);
365 	return (ret);
366 }
367 
368 /*
369  * Audit failure, log error message.
370  */
371 static void
372 priv_policy_err(const cred_t *cr, int priv, boolean_t allzone, const char *msg)
373 {
374 
375 	if (AU_AUDITING())
376 		audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 0);
377 	DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone);
378 
379 	if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) ||
380 	    curthread->t_pre_sys) {
381 		if (allzone && !HAS_ALLZONEPRIVS(cr)) {
382 			priv_policy_errmsg(cr, PRIV_ALLZONE, msg);
383 		} else {
384 			ASSERT(!HAS_PRIVILEGE(cr, priv));
385 			priv_policy_errmsg(cr, priv, msg);
386 		}
387 	}
388 }
389 
390 /*
391  * priv_policy_ap()
392  * return 0 or error.
393  * See block comment above for a description of "priv" and "allzone" usage.
394  */
395 static int
396 priv_policy_ap(const cred_t *cr, int priv, boolean_t allzone, int err,
397     const char *msg, va_list ap)
398 {
399 	if ((HAS_PRIVILEGE(cr, priv) && (!allzone || HAS_ALLZONEPRIVS(cr))) ||
400 	    (!servicing_interrupt() &&
401 	    priv_policy_override(cr, priv, allzone, ap) == 0)) {
402 		if ((allzone || priv == PRIV_ALL ||
403 		    !PRIV_ISASSERT(priv_basic, priv)) &&
404 		    !servicing_interrupt()) {
405 			PTOU(curproc)->u_acflag |= ASU; /* Needed for SVVS */
406 			if (AU_AUDITING())
407 				audit_priv(priv,
408 				    allzone ? ZONEPRIVS(cr) : NULL, 1);
409 		}
410 		err = 0;
411 		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone);
412 	} else if (!servicing_interrupt()) {
413 		/* Failure audited in this procedure */
414 		priv_policy_err(cr, priv, allzone, msg);
415 	}
416 	return (err);
417 }
418 
419 int
420 priv_policy_va(const cred_t *cr, int priv, boolean_t allzone, int err,
421     const char *msg, ...)
422 {
423 	int ret;
424 	va_list ap;
425 
426 	va_start(ap, msg);
427 	ret = priv_policy_ap(cr, priv, allzone, err, msg, ap);
428 	va_end(ap);
429 
430 	return (ret);
431 }
432 
433 int
434 priv_policy(const cred_t *cr, int priv, boolean_t allzone, int err,
435     const char *msg)
436 {
437 	return (priv_policy_va(cr, priv, allzone, err, msg, KLPDARG_NONE));
438 }
439 
440 /*
441  * Return B_TRUE for sufficient privileges, B_FALSE for insufficient privileges.
442  */
443 boolean_t
444 priv_policy_choice(const cred_t *cr, int priv, boolean_t allzone)
445 {
446 	boolean_t res = HAS_PRIVILEGE(cr, priv) &&
447 	    (!allzone || HAS_ALLZONEPRIVS(cr));
448 
449 	/* Audit success only */
450 	if (res && AU_AUDITING() &&
451 	    (allzone || priv == PRIV_ALL || !PRIV_ISASSERT(priv_basic, priv)) &&
452 	    !servicing_interrupt()) {
453 		audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 1);
454 	}
455 	if (res) {
456 		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone);
457 	} else {
458 		DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone);
459 	}
460 	return (res);
461 }
462 
463 /*
464  * Non-auditing variant of priv_policy_choice().
465  */
466 boolean_t
467 priv_policy_only(const cred_t *cr, int priv, boolean_t allzone)
468 {
469 	boolean_t res = HAS_PRIVILEGE(cr, priv) &&
470 	    (!allzone || HAS_ALLZONEPRIVS(cr));
471 
472 	if (res) {
473 		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone);
474 	} else {
475 		DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone);
476 	}
477 	return (res);
478 }
479 
480 /*
481  * Check whether all privileges in the required set are present.
482  */
483 static int
484 secpolicy_require_set(const cred_t *cr, const priv_set_t *req,
485     const char *msg, ...)
486 {
487 	int priv;
488 	int pfound = -1;
489 	priv_set_t pset;
490 	va_list ap;
491 	int ret;
492 
493 	if (req == PRIV_FULLSET ? HAS_ALLPRIVS(cr) : priv_issubset(req,
494 	    &CR_OEPRIV(cr))) {
495 		return (0);
496 	}
497 
498 	va_start(ap, msg);
499 	ret = priv_policy_override_set(cr, req, ap);
500 	va_end(ap);
501 	if (ret == 0)
502 		return (0);
503 
504 	if (req == PRIV_FULLSET || priv_isfullset(req)) {
505 		priv_policy_err(cr, PRIV_ALL, B_FALSE, msg);
506 		return (EACCES);
507 	}
508 
509 	pset = CR_OEPRIV(cr);		/* present privileges */
510 	priv_inverse(&pset);		/* all non present privileges */
511 	priv_intersect(req, &pset);	/* the actual missing privs */
512 
513 	if (AU_AUDITING())
514 		audit_priv(PRIV_NONE, &pset, 0);
515 	/*
516 	 * Privilege debugging; special case "one privilege in set".
517 	 */
518 	if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || curthread->t_pre_sys) {
519 		for (priv = 0; priv < nprivs; priv++) {
520 			if (priv_ismember(&pset, priv)) {
521 				if (pfound != -1) {
522 					/* Multiple missing privs */
523 					priv_policy_errmsg(cr, PRIV_MULTIPLE,
524 					    msg);
525 					return (EACCES);
526 				}
527 				pfound = priv;
528 			}
529 		}
530 		ASSERT(pfound != -1);
531 		/* Just the one missing privilege */
532 		priv_policy_errmsg(cr, pfound, msg);
533 	}
534 
535 	return (EACCES);
536 }
537 
538 /*
539  * Called when an operation requires that the caller be in the
540  * global zone, regardless of privilege.
541  */
542 static int
543 priv_policy_global(const cred_t *cr)
544 {
545 	if (crgetzoneid(cr) == GLOBAL_ZONEID)
546 		return (0);	/* success */
547 
548 	if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) ||
549 	    curthread->t_pre_sys) {
550 		priv_policy_errmsg(cr, PRIV_GLOBAL, NULL);
551 	}
552 	return (EPERM);
553 }
554 
555 /*
556  * Changing process priority
557  */
558 int
559 secpolicy_setpriority(const cred_t *cr)
560 {
561 	return (PRIV_POLICY(cr, PRIV_PROC_PRIOCNTL, B_FALSE, EPERM, NULL));
562 }
563 
564 /*
565  * Binding to a privileged port, port must be specified in host byte
566  * order.
567  * When adding a new privilege which allows binding to currently privileged
568  * ports, then you MUST also allow processes with PRIV_NET_PRIVADDR bind
569  * to these ports because of backward compatibility.
570  */
571 int
572 secpolicy_net_privaddr(const cred_t *cr, in_port_t port, int proto)
573 {
574 	char *reason;
575 	int priv;
576 
577 	switch (port) {
578 	case 137:
579 	case 138:
580 	case 139:
581 	case 445:
582 		/*
583 		 * NBT and SMB ports, these are normal privileged ports,
584 		 * allow bind only if the SYS_SMB or NET_PRIVADDR privilege
585 		 * is present.
586 		 * Try both, if neither is present return an error for
587 		 * priv SYS_SMB.
588 		 */
589 		if (PRIV_POLICY_ONLY(cr, PRIV_NET_PRIVADDR, B_FALSE))
590 			priv = PRIV_NET_PRIVADDR;
591 		else
592 			priv = PRIV_SYS_SMB;
593 		reason = "NBT or SMB port";
594 		break;
595 
596 	case 2049:
597 	case 4045:
598 		/*
599 		 * NFS ports, these are extra privileged ports, allow bind
600 		 * only if the SYS_NFS privilege is present.
601 		 */
602 		priv = PRIV_SYS_NFS;
603 		reason = "NFS port";
604 		break;
605 
606 	default:
607 		priv = PRIV_NET_PRIVADDR;
608 		reason = NULL;
609 		break;
610 
611 	}
612 
613 	return (priv_policy_va(cr, priv, B_FALSE, EACCES, reason,
614 	    KLPDARG_PORT, (int)proto, (int)port, KLPDARG_NOMORE));
615 }
616 
617 /*
618  * Binding to a multilevel port on a trusted (labeled) system.
619  */
620 int
621 secpolicy_net_bindmlp(const cred_t *cr)
622 {
623 	return (PRIV_POLICY(cr, PRIV_NET_BINDMLP, B_FALSE, EACCES, NULL));
624 }
625 
626 /*
627  * Allow a communication between a zone and an unlabeled host when their
628  * labels don't match.
629  */
630 int
631 secpolicy_net_mac_aware(const cred_t *cr)
632 {
633 	return (PRIV_POLICY(cr, PRIV_NET_MAC_AWARE, B_FALSE, EACCES, NULL));
634 }
635 
636 /*
637  * Allow a privileged process to transmit traffic without explicit labels
638  */
639 int
640 secpolicy_net_mac_implicit(const cred_t *cr)
641 {
642 	return (PRIV_POLICY(cr, PRIV_NET_MAC_IMPLICIT, B_FALSE, EACCES, NULL));
643 }
644 
645 /*
646  * Common routine which determines whether a given credential can
647  * act on a given mount.
648  * When called through mount, the parameter needoptcheck is a pointer
649  * to a boolean variable which will be set to either true or false,
650  * depending on whether the mount policy should change the mount options.
651  * In all other cases, needoptcheck should be a NULL pointer.
652  */
653 static int
654 secpolicy_fs_common(cred_t *cr, vnode_t *mvp, const vfs_t *vfsp,
655     boolean_t *needoptcheck)
656 {
657 	boolean_t allzone = B_FALSE;
658 	boolean_t mounting = needoptcheck != NULL;
659 
660 	/*
661 	 * Short circuit the following cases:
662 	 *	vfsp == NULL or mvp == NULL (pure privilege check)
663 	 *	have all privileges - no further checks required
664 	 *	and no mount options need to be set.
665 	 */
666 	if (vfsp == NULL || mvp == NULL || HAS_ALLPRIVS(cr)) {
667 		if (mounting)
668 			*needoptcheck = B_FALSE;
669 
670 		return (priv_policy_va(cr, PRIV_SYS_MOUNT, allzone, EPERM,
671 		    NULL, KLPDARG_VNODE, mvp, (char *)NULL, KLPDARG_NOMORE));
672 	}
673 
674 	/*
675 	 * When operating on an existing mount (either we're not mounting
676 	 * or we're doing a remount and VFS_REMOUNT will be set), zones
677 	 * can operate only on mounts established by the zone itself.
678 	 */
679 	if (!mounting || (vfsp->vfs_flag & VFS_REMOUNT) != 0) {
680 		zoneid_t zoneid = crgetzoneid(cr);
681 
682 		if (zoneid != GLOBAL_ZONEID &&
683 		    vfsp->vfs_zone->zone_id != zoneid) {
684 			return (EPERM);
685 		}
686 	}
687 
688 	if (mounting)
689 		*needoptcheck = B_TRUE;
690 
691 	/*
692 	 * Overlay mounts may hide important stuff; if you can't write to a
693 	 * mount point but would be able to mount on top of it, you can
694 	 * escalate your privileges.
695 	 * So we go about asking the same questions namefs does when it
696 	 * decides whether you can mount over a file or not but with the
697 	 * added restriction that you can only mount on top of a regular
698 	 * file or directory.
699 	 * If we have all the zone's privileges, we skip all other checks,
700 	 * or else we may actually get in trouble inside the automounter.
701 	 */
702 	if ((mvp->v_flag & VROOT) != 0 ||
703 	    (mvp->v_type != VDIR && mvp->v_type != VREG) ||
704 	    HAS_ALLZONEPRIVS(cr)) {
705 		allzone = B_TRUE;
706 	} else {
707 		vattr_t va;
708 		int err;
709 
710 		va.va_mask = AT_UID|AT_MODE;
711 		err = VOP_GETATTR(mvp, &va, 0, cr, NULL);
712 		if (err != 0)
713 			return (err);
714 
715 		if ((err = secpolicy_vnode_owner(cr, va.va_uid)) != 0)
716 			return (err);
717 
718 		if (secpolicy_vnode_access2(cr, mvp, va.va_uid, va.va_mode,
719 		    VWRITE) != 0) {
720 			return (EACCES);
721 		}
722 	}
723 	return (priv_policy_va(cr, PRIV_SYS_MOUNT, allzone, EPERM,
724 	    NULL, KLPDARG_VNODE, mvp, (char *)NULL, KLPDARG_NOMORE));
725 }
726 
727 void
728 secpolicy_fs_mount_clearopts(cred_t *cr, struct vfs *vfsp)
729 {
730 	boolean_t amsuper = HAS_ALLZONEPRIVS(cr);
731 
732 	/*
733 	 * check; if we don't have either "nosuid" or
734 	 * both "nosetuid" and "nodevices", then we add
735 	 * "nosuid"; this depends on how the current
736 	 * implementation works (it first checks nosuid).  In a
737 	 * zone, a user with all zone privileges can mount with
738 	 * "setuid" but never with "devices".
739 	 */
740 	if (!vfs_optionisset(vfsp, MNTOPT_NOSUID, NULL) &&
741 	    (!vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL) ||
742 	    !vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL))) {
743 		if (crgetzoneid(cr) == GLOBAL_ZONEID || !amsuper)
744 			vfs_setmntopt(vfsp, MNTOPT_NOSUID, NULL, 0);
745 		else
746 			vfs_setmntopt(vfsp, MNTOPT_NODEVICES, NULL, 0);
747 	}
748 	/*
749 	 * If we're not the local super user, we set the "restrict"
750 	 * option to indicate to automountd that this mount should
751 	 * be handled with care.
752 	 */
753 	if (!amsuper)
754 		vfs_setmntopt(vfsp, MNTOPT_RESTRICT, NULL, 0);
755 
756 }
757 
758 extern vnode_t *rootvp;
759 extern vfs_t *rootvfs;
760 
761 int
762 secpolicy_fs_mount(cred_t *cr, vnode_t *mvp, struct vfs *vfsp)
763 {
764 	boolean_t needoptchk;
765 	int error;
766 
767 	/*
768 	 * If it's a remount, get the underlying mount point,
769 	 * except for the root where we use the rootvp.
770 	 */
771 	if ((vfsp->vfs_flag & VFS_REMOUNT) != 0) {
772 		if (vfsp == rootvfs)
773 			mvp = rootvp;
774 		else
775 			mvp = vfsp->vfs_vnodecovered;
776 	}
777 
778 	error = secpolicy_fs_common(cr, mvp, vfsp, &needoptchk);
779 
780 	if (error == 0 && needoptchk) {
781 		secpolicy_fs_mount_clearopts(cr, vfsp);
782 	}
783 
784 	return (error);
785 }
786 
787 /*
788  * Does the policy computations for "ownership" of a mount;
789  * here ownership is defined as the ability to "mount"
790  * the filesystem originally.  The rootvfs doesn't cover any
791  * vnodes; we attribute its ownership to the rootvp.
792  */
793 static int
794 secpolicy_fs_owner(cred_t *cr, const struct vfs *vfsp)
795 {
796 	vnode_t *mvp;
797 
798 	if (vfsp == NULL)
799 		mvp = NULL;
800 	else if (vfsp == rootvfs)
801 		mvp = rootvp;
802 	else
803 		mvp = vfsp->vfs_vnodecovered;
804 
805 	return (secpolicy_fs_common(cr, mvp, vfsp, NULL));
806 }
807 
808 int
809 secpolicy_fs_unmount(cred_t *cr, struct vfs *vfsp)
810 {
811 	return (secpolicy_fs_owner(cr, vfsp));
812 }
813 
814 /*
815  * Quotas are a resource, but if one has the ability to mount a filesystem, he
816  * should be able to modify quotas on it.
817  */
818 int
819 secpolicy_fs_quota(const cred_t *cr, const vfs_t *vfsp)
820 {
821 	return (secpolicy_fs_owner((cred_t *)cr, vfsp));
822 }
823 
824 /*
825  * Exceeding minfree: also a per-mount resource constraint.
826  */
827 int
828 secpolicy_fs_minfree(const cred_t *cr, const vfs_t *vfsp)
829 {
830 	return (secpolicy_fs_owner((cred_t *)cr, vfsp));
831 }
832 
833 int
834 secpolicy_fs_config(const cred_t *cr, const vfs_t *vfsp)
835 {
836 	return (secpolicy_fs_owner((cred_t *)cr, vfsp));
837 }
838 
839 /* ARGSUSED */
840 int
841 secpolicy_fs_linkdir(const cred_t *cr, const vfs_t *vfsp)
842 {
843 	return (PRIV_POLICY(cr, PRIV_SYS_LINKDIR, B_FALSE, EPERM, NULL));
844 }
845 
846 /*
847  * Name:        secpolicy_vnode_access()
848  *
849  * Parameters:  Process credential
850  *		vnode
851  *		uid of owner of vnode
852  *		permission bits not granted to the caller when examining
853  *		file mode bits (i.e., when a process wants to open a
854  *		mode 444 file for VREAD|VWRITE, this function should be
855  *		called only with a VWRITE argument).
856  *
857  * Normal:      Verifies that cred has the appropriate privileges to
858  *              override the mode bits that were denied.
859  *
860  * Override:    file_dac_execute - if VEXEC bit was denied and vnode is
861  *                      not a directory.
862  *              file_dac_read - if VREAD bit was denied.
863  *              file_dac_search - if VEXEC bit was denied and vnode is
864  *                      a directory.
865  *              file_dac_write - if VWRITE bit was denied.
866  *
867  *		Root owned files are special cased to protect system
868  *		configuration files and such.
869  *
870  * Output:      EACCES - if privilege check fails.
871  */
872 
873 int
874 secpolicy_vnode_access(const cred_t *cr, vnode_t *vp, uid_t owner, mode_t mode)
875 {
876 	if ((mode & VREAD) && priv_policy_va(cr, PRIV_FILE_DAC_READ, B_FALSE,
877 	    EACCES, NULL, KLPDARG_VNODE, vp, (char *)NULL,
878 	    KLPDARG_NOMORE) != 0) {
879 		return (EACCES);
880 	}
881 
882 	if (mode & VWRITE) {
883 		boolean_t allzone;
884 
885 		if (owner == 0 && cr->cr_uid != 0)
886 			allzone = B_TRUE;
887 		else
888 			allzone = B_FALSE;
889 		if (priv_policy_va(cr, PRIV_FILE_DAC_WRITE, allzone, EACCES,
890 		    NULL, KLPDARG_VNODE, vp, (char *)NULL,
891 		    KLPDARG_NOMORE) != 0) {
892 			return (EACCES);
893 		}
894 	}
895 
896 	if (mode & VEXEC) {
897 		/*
898 		 * Directories use file_dac_search to override the execute bit.
899 		 */
900 		int p = vp->v_type == VDIR ? PRIV_FILE_DAC_SEARCH :
901 		    PRIV_FILE_DAC_EXECUTE;
902 
903 		return (priv_policy_va(cr, p, B_FALSE, EACCES, NULL,
904 		    KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE));
905 	}
906 	return (0);
907 }
908 
909 /*
910  * Like secpolicy_vnode_access() but we get the actual wanted mode and the
911  * current mode of the file, not the missing bits.
912  */
913 int
914 secpolicy_vnode_access2(const cred_t *cr, vnode_t *vp, uid_t owner,
915     mode_t curmode, mode_t wantmode)
916 {
917 	mode_t mode;
918 
919 	/* Inline the basic privileges tests. */
920 	if ((wantmode & VREAD) &&
921 	    !PRIV_ISASSERT(&CR_OEPRIV(cr), PRIV_FILE_READ) &&
922 	    priv_policy_va(cr, PRIV_FILE_READ, B_FALSE, EACCES, NULL,
923 	    KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE) != 0) {
924 		return (EACCES);
925 	}
926 
927 	if ((wantmode & VWRITE) &&
928 	    !PRIV_ISASSERT(&CR_OEPRIV(cr), PRIV_FILE_WRITE) &&
929 	    priv_policy_va(cr, PRIV_FILE_WRITE, B_FALSE, EACCES, NULL,
930 	    KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE) != 0) {
931 		return (EACCES);
932 	}
933 
934 	mode = ~curmode & wantmode;
935 
936 	if (mode == 0)
937 		return (0);
938 
939 	if ((mode & VREAD) && priv_policy_va(cr, PRIV_FILE_DAC_READ, B_FALSE,
940 	    EACCES, NULL, KLPDARG_VNODE, vp, (char *)NULL,
941 	    KLPDARG_NOMORE) != 0) {
942 		return (EACCES);
943 	}
944 
945 	if (mode & VWRITE) {
946 		boolean_t allzone;
947 
948 		if (owner == 0 && cr->cr_uid != 0)
949 			allzone = B_TRUE;
950 		else
951 			allzone = B_FALSE;
952 		if (priv_policy_va(cr, PRIV_FILE_DAC_WRITE, allzone, EACCES,
953 		    NULL, KLPDARG_VNODE, vp, (char *)NULL,
954 		    KLPDARG_NOMORE) != 0) {
955 			return (EACCES);
956 		}
957 	}
958 
959 	if (mode & VEXEC) {
960 		/*
961 		 * Directories use file_dac_search to override the execute bit.
962 		 */
963 		int p = vp->v_type == VDIR ? PRIV_FILE_DAC_SEARCH :
964 		    PRIV_FILE_DAC_EXECUTE;
965 
966 		return (priv_policy_va(cr, p, B_FALSE, EACCES, NULL,
967 		    KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE));
968 	}
969 	return (0);
970 }
971 
972 /*
973  * This is a special routine for ZFS; it is used to determine whether
974  * any of the privileges in effect allow any form of access to the
975  * file.  There's no reason to audit this or any reason to record
976  * this.  More work is needed to do the "KPLD" stuff.
977  */
978 int
979 secpolicy_vnode_any_access(const cred_t *cr, vnode_t *vp, uid_t owner)
980 {
981 	static int privs[] = {
982 	    PRIV_FILE_OWNER,
983 	    PRIV_FILE_DAC_READ,
984 	    PRIV_FILE_DAC_WRITE,
985 	    PRIV_FILE_DAC_EXECUTE,
986 	    PRIV_FILE_DAC_SEARCH,
987 	};
988 	int i;
989 
990 	/* Same as secpolicy_vnode_setdac */
991 	if (owner == cr->cr_uid)
992 		return (0);
993 
994 	for (i = 0; i < sizeof (privs)/sizeof (int); i++) {
995 		boolean_t allzone = B_FALSE;
996 		int priv;
997 
998 		switch (priv = privs[i]) {
999 		case PRIV_FILE_DAC_EXECUTE:
1000 			if (vp->v_type == VDIR)
1001 				continue;
1002 			break;
1003 		case PRIV_FILE_DAC_SEARCH:
1004 			if (vp->v_type != VDIR)
1005 				continue;
1006 			break;
1007 		case PRIV_FILE_DAC_WRITE:
1008 		case PRIV_FILE_OWNER:
1009 			/* We know here that if owner == 0, that cr_uid != 0 */
1010 			allzone = owner == 0;
1011 			break;
1012 		}
1013 		if (PRIV_POLICY_CHOICE(cr, priv, allzone))
1014 			return (0);
1015 	}
1016 	return (EPERM);
1017 }
1018 
1019 /*
1020  * Name:	secpolicy_vnode_setid_modify()
1021  *
1022  * Normal:	verify that subject can set the file setid flags.
1023  *
1024  * Output:	EPERM - if not privileged.
1025  */
1026 
1027 static int
1028 secpolicy_vnode_setid_modify(const cred_t *cr, uid_t owner)
1029 {
1030 	/* If changing to suid root, must have all zone privs */
1031 	boolean_t allzone = B_TRUE;
1032 
1033 	if (owner != 0) {
1034 		if (owner == cr->cr_uid)
1035 			return (0);
1036 		allzone = B_FALSE;
1037 	}
1038 	return (PRIV_POLICY(cr, PRIV_FILE_SETID, allzone, EPERM, NULL));
1039 }
1040 
1041 /*
1042  * Are we allowed to retain the set-uid/set-gid bits when
1043  * changing ownership or when writing to a file?
1044  * "issuid" should be true when set-uid; only in that case
1045  * root ownership is checked (setgid is assumed).
1046  */
1047 int
1048 secpolicy_vnode_setid_retain(const cred_t *cred, boolean_t issuidroot)
1049 {
1050 	if (issuidroot && !HAS_ALLZONEPRIVS(cred))
1051 		return (EPERM);
1052 
1053 	return (!PRIV_POLICY_CHOICE(cred, PRIV_FILE_SETID, B_FALSE));
1054 }
1055 
1056 /*
1057  * Name:	secpolicy_vnode_setids_setgids()
1058  *
1059  * Normal:	verify that subject can set the file setgid flag.
1060  *
1061  * Output:	EPERM - if not privileged
1062  */
1063 
1064 int
1065 secpolicy_vnode_setids_setgids(const cred_t *cred, gid_t gid)
1066 {
1067 	if (!groupmember(gid, cred))
1068 		return (PRIV_POLICY(cred, PRIV_FILE_SETID, B_FALSE, EPERM,
1069 		    NULL));
1070 	return (0);
1071 }
1072 
1073 /*
1074  * Name:	secpolicy_vnode_chown
1075  *
1076  * Normal:	Determine if subject can chown owner of a file.
1077  *
1078  * Output:	EPERM - if access denied
1079  */
1080 
1081 int
1082 secpolicy_vnode_chown(const cred_t *cred, uid_t owner)
1083 {
1084 	boolean_t is_owner = (owner == crgetuid(cred));
1085 	boolean_t allzone = B_FALSE;
1086 	int priv;
1087 
1088 	if (!is_owner) {
1089 		allzone = (owner == 0);
1090 		priv = PRIV_FILE_CHOWN;
1091 	} else {
1092 		priv = HAS_PRIVILEGE(cred, PRIV_FILE_CHOWN) ?
1093 		    PRIV_FILE_CHOWN : PRIV_FILE_CHOWN_SELF;
1094 	}
1095 
1096 	return (PRIV_POLICY(cred, priv, allzone, EPERM, NULL));
1097 }
1098 
1099 /*
1100  * Name:	secpolicy_vnode_create_gid
1101  *
1102  * Normal:	Determine if subject can change group ownership of a file.
1103  *
1104  * Output:	EPERM - if access denied
1105  */
1106 int
1107 secpolicy_vnode_create_gid(const cred_t *cred)
1108 {
1109 	if (HAS_PRIVILEGE(cred, PRIV_FILE_CHOWN))
1110 		return (PRIV_POLICY(cred, PRIV_FILE_CHOWN, B_FALSE, EPERM,
1111 		    NULL));
1112 	else
1113 		return (PRIV_POLICY(cred, PRIV_FILE_CHOWN_SELF, B_FALSE, EPERM,
1114 		    NULL));
1115 }
1116 
1117 /*
1118  * Name:	secpolicy_vnode_utime_modify()
1119  *
1120  * Normal:	verify that subject can modify the utime on a file.
1121  *
1122  * Output:	EPERM - if access denied.
1123  */
1124 
1125 static int
1126 secpolicy_vnode_utime_modify(const cred_t *cred)
1127 {
1128 	return (PRIV_POLICY(cred, PRIV_FILE_OWNER, B_FALSE, EPERM,
1129 	    "modify file times"));
1130 }
1131 
1132 
1133 /*
1134  * Name:	secpolicy_vnode_setdac()
1135  *
1136  * Normal:	verify that subject can modify the mode of a file.
1137  *		allzone privilege needed when modifying root owned object.
1138  *
1139  * Output:	EPERM - if access denied.
1140  */
1141 
1142 int
1143 secpolicy_vnode_setdac(const cred_t *cred, uid_t owner)
1144 {
1145 	if (owner == cred->cr_uid)
1146 		return (0);
1147 
1148 	return (PRIV_POLICY(cred, PRIV_FILE_OWNER, owner == 0, EPERM, NULL));
1149 }
1150 /*
1151  * Name:	secpolicy_vnode_stky_modify()
1152  *
1153  * Normal:	verify that subject can make a file a "sticky".
1154  *
1155  * Output:	EPERM - if access denied.
1156  */
1157 
1158 int
1159 secpolicy_vnode_stky_modify(const cred_t *cred)
1160 {
1161 	return (PRIV_POLICY(cred, PRIV_SYS_CONFIG, B_FALSE, EPERM,
1162 	    "set file sticky"));
1163 }
1164 
1165 /*
1166  * Policy determines whether we can remove an entry from a directory,
1167  * regardless of permission bits.
1168  */
1169 int
1170 secpolicy_vnode_remove(const cred_t *cr)
1171 {
1172 	return (PRIV_POLICY(cr, PRIV_FILE_OWNER, B_FALSE, EACCES,
1173 	    "sticky directory"));
1174 }
1175 
1176 int
1177 secpolicy_vnode_owner(const cred_t *cr, uid_t owner)
1178 {
1179 	boolean_t allzone = (owner == 0);
1180 
1181 	if (owner == cr->cr_uid)
1182 		return (0);
1183 
1184 	return (PRIV_POLICY(cr, PRIV_FILE_OWNER, allzone, EPERM, NULL));
1185 }
1186 
1187 void
1188 secpolicy_setid_clear(vattr_t *vap, cred_t *cr)
1189 {
1190 	if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0 &&
1191 	    secpolicy_vnode_setid_retain(cr,
1192 	    (vap->va_mode & S_ISUID) != 0 &&
1193 	    (vap->va_mask & AT_UID) != 0 && vap->va_uid == 0) != 0) {
1194 		vap->va_mask |= AT_MODE;
1195 		vap->va_mode &= ~(S_ISUID|S_ISGID);
1196 	}
1197 }
1198 
1199 int
1200 secpolicy_setid_setsticky_clear(vnode_t *vp, vattr_t *vap, const vattr_t *ovap,
1201     cred_t *cr)
1202 {
1203 	int error;
1204 
1205 	if ((vap->va_mode & S_ISUID) != 0 &&
1206 	    (error = secpolicy_vnode_setid_modify(cr,
1207 	    ovap->va_uid)) != 0) {
1208 		return (error);
1209 	}
1210 
1211 	/*
1212 	 * Check privilege if attempting to set the
1213 	 * sticky bit on a non-directory.
1214 	 */
1215 	if (vp->v_type != VDIR && (vap->va_mode & S_ISVTX) != 0 &&
1216 	    secpolicy_vnode_stky_modify(cr) != 0) {
1217 		vap->va_mode &= ~S_ISVTX;
1218 	}
1219 
1220 	/*
1221 	 * Check for privilege if attempting to set the
1222 	 * group-id bit.
1223 	 */
1224 	if ((vap->va_mode & S_ISGID) != 0 &&
1225 	    secpolicy_vnode_setids_setgids(cr, ovap->va_gid) != 0) {
1226 		vap->va_mode &= ~S_ISGID;
1227 	}
1228 
1229 	return (0);
1230 }
1231 
1232 #define	ATTR_FLAG_PRIV(attr, value, cr)	\
1233 	PRIV_POLICY(cr, value ? PRIV_FILE_FLAG_SET : PRIV_ALL, \
1234 	B_FALSE, EPERM, NULL)
1235 
1236 /*
1237  * Check privileges for setting xvattr attributes
1238  */
1239 int
1240 secpolicy_xvattr(xvattr_t *xvap, uid_t owner, cred_t *cr, vtype_t vtype)
1241 {
1242 	xoptattr_t *xoap;
1243 	int error = 0;
1244 
1245 	if ((xoap = xva_getxoptattr(xvap)) == NULL)
1246 		return (EINVAL);
1247 
1248 	/*
1249 	 * First process the DOS bits
1250 	 */
1251 	if (XVA_ISSET_REQ(xvap, XAT_ARCHIVE) ||
1252 	    XVA_ISSET_REQ(xvap, XAT_HIDDEN) ||
1253 	    XVA_ISSET_REQ(xvap, XAT_READONLY) ||
1254 	    XVA_ISSET_REQ(xvap, XAT_SYSTEM) ||
1255 	    XVA_ISSET_REQ(xvap, XAT_CREATETIME)) {
1256 		if ((error = secpolicy_vnode_owner(cr, owner)) != 0)
1257 			return (error);
1258 	}
1259 
1260 	/*
1261 	 * Now handle special attributes
1262 	 */
1263 
1264 	if (XVA_ISSET_REQ(xvap, XAT_IMMUTABLE))
1265 		error = ATTR_FLAG_PRIV(XAT_IMMUTABLE,
1266 		    xoap->xoa_immutable, cr);
1267 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_NOUNLINK))
1268 		error = ATTR_FLAG_PRIV(XAT_NOUNLINK,
1269 		    xoap->xoa_nounlink, cr);
1270 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_APPENDONLY))
1271 		error = ATTR_FLAG_PRIV(XAT_APPENDONLY,
1272 		    xoap->xoa_appendonly, cr);
1273 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_NODUMP))
1274 		error = ATTR_FLAG_PRIV(XAT_NODUMP,
1275 		    xoap->xoa_nodump, cr);
1276 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_OPAQUE))
1277 		error = EPERM;
1278 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_QUARANTINED)) {
1279 		error = ATTR_FLAG_PRIV(XAT_AV_QUARANTINED,
1280 		    xoap->xoa_av_quarantined, cr);
1281 		if (error == 0 && vtype != VREG && xoap->xoa_av_quarantined)
1282 			error = EINVAL;
1283 	}
1284 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_MODIFIED))
1285 		error = ATTR_FLAG_PRIV(XAT_AV_MODIFIED,
1286 		    xoap->xoa_av_modified, cr);
1287 	if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP)) {
1288 		error = ATTR_FLAG_PRIV(XAT_AV_SCANSTAMP,
1289 		    xoap->xoa_av_scanstamp, cr);
1290 		if (error == 0 && vtype != VREG)
1291 			error = EINVAL;
1292 	}
1293 	return (error);
1294 }
1295 
1296 /*
1297  * This function checks the policy decisions surrounding the
1298  * vop setattr call.
1299  *
1300  * It should be called after sufficient locks have been established
1301  * on the underlying data structures.  No concurrent modifications
1302  * should be allowed.
1303  *
1304  * The caller must pass in unlocked version of its vaccess function
1305  * this is required because vop_access function should lock the
1306  * node for reading.  A three argument function should be defined
1307  * which accepts the following argument:
1308  * 	A pointer to the internal "node" type (inode *)
1309  *	vnode access bits (VREAD|VWRITE|VEXEC)
1310  *	a pointer to the credential
1311  *
1312  * This function makes the following policy decisions:
1313  *
1314  *		- change permissions
1315  *			- permission to change file mode if not owner
1316  *			- permission to add sticky bit to non-directory
1317  *			- permission to add set-gid bit
1318  *
1319  * The ovap argument should include AT_MODE|AT_UID|AT_GID.
1320  *
1321  * If the vap argument does not include AT_MODE, the mode will be copied from
1322  * ovap.  In certain situations set-uid/set-gid bits need to be removed;
1323  * this is done by marking vap->va_mask to include AT_MODE and va_mode
1324  * is updated to the newly computed mode.
1325  */
1326 
1327 int
1328 secpolicy_vnode_setattr(cred_t *cr, struct vnode *vp, struct vattr *vap,
1329 	const struct vattr *ovap, int flags,
1330 	int unlocked_access(void *, int, cred_t *),
1331 	void *node)
1332 {
1333 	int mask = vap->va_mask;
1334 	int error = 0;
1335 	boolean_t skipaclchk = (flags & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE;
1336 
1337 	if (mask & AT_SIZE) {
1338 		if (vp->v_type == VDIR) {
1339 			error = EISDIR;
1340 			goto out;
1341 		}
1342 
1343 		/*
1344 		 * If ATTR_NOACLCHECK is set in the flags, then we don't
1345 		 * perform the secondary unlocked_access() call since the
1346 		 * ACL (if any) is being checked there.
1347 		 */
1348 		if (skipaclchk == B_FALSE) {
1349 			error = unlocked_access(node, VWRITE, cr);
1350 			if (error)
1351 				goto out;
1352 		}
1353 	}
1354 	if (mask & AT_MODE) {
1355 		/*
1356 		 * If not the owner of the file then check privilege
1357 		 * for two things: the privilege to set the mode at all
1358 		 * and, if we're setting setuid, we also need permissions
1359 		 * to add the set-uid bit, if we're not the owner.
1360 		 * In the specific case of creating a set-uid root
1361 		 * file, we need even more permissions.
1362 		 */
1363 		if ((error = secpolicy_vnode_setdac(cr, ovap->va_uid)) != 0)
1364 			goto out;
1365 
1366 		if ((error = secpolicy_setid_setsticky_clear(vp, vap,
1367 		    ovap, cr)) != 0)
1368 			goto out;
1369 	} else
1370 		vap->va_mode = ovap->va_mode;
1371 
1372 	if (mask & (AT_UID|AT_GID)) {
1373 		boolean_t checkpriv = B_FALSE;
1374 
1375 		/*
1376 		 * Chowning files.
1377 		 *
1378 		 * If you are the file owner:
1379 		 *	chown to other uid		FILE_CHOWN_SELF
1380 		 *	chown to gid (non-member) 	FILE_CHOWN_SELF
1381 		 *	chown to gid (member) 		<none>
1382 		 *
1383 		 * Instead of PRIV_FILE_CHOWN_SELF, FILE_CHOWN is also
1384 		 * acceptable but the first one is reported when debugging.
1385 		 *
1386 		 * If you are not the file owner:
1387 		 *	chown from root			PRIV_FILE_CHOWN + zone
1388 		 *	chown from other to any		PRIV_FILE_CHOWN
1389 		 *
1390 		 */
1391 		if (cr->cr_uid != ovap->va_uid) {
1392 			checkpriv = B_TRUE;
1393 		} else {
1394 			if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) ||
1395 			    ((mask & AT_GID) && vap->va_gid != ovap->va_gid &&
1396 			    !groupmember(vap->va_gid, cr))) {
1397 				checkpriv = B_TRUE;
1398 			}
1399 		}
1400 		/*
1401 		 * If necessary, check privilege to see if update can be done.
1402 		 */
1403 		if (checkpriv &&
1404 		    (error = secpolicy_vnode_chown(cr, ovap->va_uid)) != 0) {
1405 			goto out;
1406 		}
1407 
1408 		/*
1409 		 * If the file has either the set UID or set GID bits
1410 		 * set and the caller can set the bits, then leave them.
1411 		 */
1412 		secpolicy_setid_clear(vap, cr);
1413 	}
1414 	if (mask & (AT_ATIME|AT_MTIME)) {
1415 		/*
1416 		 * If not the file owner and not otherwise privileged,
1417 		 * always return an error when setting the
1418 		 * time other than the current (ATTR_UTIME flag set).
1419 		 * If setting the current time (ATTR_UTIME not set) then
1420 		 * unlocked_access will check permissions according to policy.
1421 		 */
1422 		if (cr->cr_uid != ovap->va_uid) {
1423 			if (flags & ATTR_UTIME)
1424 				error = secpolicy_vnode_utime_modify(cr);
1425 			else if (skipaclchk == B_FALSE) {
1426 				error = unlocked_access(node, VWRITE, cr);
1427 				if (error == EACCES &&
1428 				    secpolicy_vnode_utime_modify(cr) == 0)
1429 					error = 0;
1430 			}
1431 			if (error)
1432 				goto out;
1433 		}
1434 	}
1435 
1436 	/*
1437 	 * Check for optional attributes here by checking the following:
1438 	 */
1439 	if (mask & AT_XVATTR)
1440 		error = secpolicy_xvattr((xvattr_t *)vap, ovap->va_uid, cr,
1441 		    vp->v_type);
1442 out:
1443 	return (error);
1444 }
1445 
1446 /*
1447  * Name:	secpolicy_pcfs_modify_bootpartition()
1448  *
1449  * Normal:	verify that subject can modify a pcfs boot partition.
1450  *
1451  * Output:	EACCES - if privilege check failed.
1452  */
1453 /*ARGSUSED*/
1454 int
1455 secpolicy_pcfs_modify_bootpartition(const cred_t *cred)
1456 {
1457 	return (PRIV_POLICY(cred, PRIV_ALL, B_FALSE, EACCES,
1458 	    "modify pcfs boot partition"));
1459 }
1460 
1461 /*
1462  * System V IPC routines
1463  */
1464 int
1465 secpolicy_ipc_owner(const cred_t *cr, const struct kipc_perm *ip)
1466 {
1467 	if (crgetzoneid(cr) != ip->ipc_zoneid ||
1468 	    (cr->cr_uid != ip->ipc_uid && cr->cr_uid != ip->ipc_cuid)) {
1469 		boolean_t allzone = B_FALSE;
1470 		if (ip->ipc_uid == 0 || ip->ipc_cuid == 0)
1471 			allzone = B_TRUE;
1472 		return (PRIV_POLICY(cr, PRIV_IPC_OWNER, allzone, EPERM, NULL));
1473 	}
1474 	return (0);
1475 }
1476 
1477 int
1478 secpolicy_ipc_config(const cred_t *cr)
1479 {
1480 	return (PRIV_POLICY(cr, PRIV_SYS_IPC_CONFIG, B_FALSE, EPERM, NULL));
1481 }
1482 
1483 int
1484 secpolicy_ipc_access(const cred_t *cr, const struct kipc_perm *ip, mode_t mode)
1485 {
1486 
1487 	boolean_t allzone = B_FALSE;
1488 
1489 	ASSERT((mode & (MSG_R|MSG_W)) != 0);
1490 
1491 	if ((mode & MSG_R) &&
1492 	    PRIV_POLICY(cr, PRIV_IPC_DAC_READ, allzone, EACCES, NULL) != 0)
1493 		return (EACCES);
1494 
1495 	if (mode & MSG_W) {
1496 		if (cr->cr_uid != 0 && (ip->ipc_uid == 0 || ip->ipc_cuid == 0))
1497 			allzone = B_TRUE;
1498 
1499 		return (PRIV_POLICY(cr, PRIV_IPC_DAC_WRITE, allzone, EACCES,
1500 		    NULL));
1501 	}
1502 	return (0);
1503 }
1504 
1505 int
1506 secpolicy_rsm_access(const cred_t *cr, uid_t owner, mode_t mode)
1507 {
1508 	boolean_t allzone = B_FALSE;
1509 
1510 	ASSERT((mode & (MSG_R|MSG_W)) != 0);
1511 
1512 	if ((mode & MSG_R) &&
1513 	    PRIV_POLICY(cr, PRIV_IPC_DAC_READ, allzone, EACCES, NULL) != 0)
1514 		return (EACCES);
1515 
1516 	if (mode & MSG_W) {
1517 		if (cr->cr_uid != 0 && owner == 0)
1518 			allzone = B_TRUE;
1519 
1520 		return (PRIV_POLICY(cr, PRIV_IPC_DAC_WRITE, allzone, EACCES,
1521 		    NULL));
1522 	}
1523 	return (0);
1524 }
1525 
1526 /*
1527  * Audit configuration.
1528  */
1529 int
1530 secpolicy_audit_config(const cred_t *cr)
1531 {
1532 	return (PRIV_POLICY(cr, PRIV_SYS_AUDIT, B_FALSE, EPERM, NULL));
1533 }
1534 
1535 /*
1536  * Audit record generation.
1537  */
1538 int
1539 secpolicy_audit_modify(const cred_t *cr)
1540 {
1541 	return (PRIV_POLICY(cr, PRIV_PROC_AUDIT, B_FALSE, EPERM, NULL));
1542 }
1543 
1544 /*
1545  * Get audit attributes.
1546  * Either PRIV_SYS_AUDIT or PRIV_PROC_AUDIT required; report the
1547  * "Least" of the two privileges on error.
1548  */
1549 int
1550 secpolicy_audit_getattr(const cred_t *cr, boolean_t checkonly)
1551 {
1552 	int priv;
1553 
1554 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_AUDIT, B_FALSE))
1555 		priv = PRIV_SYS_AUDIT;
1556 	else
1557 		priv = PRIV_PROC_AUDIT;
1558 
1559 	if (checkonly)
1560 		return (!PRIV_POLICY_ONLY(cr, priv, B_FALSE));
1561 	else
1562 		return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL));
1563 }
1564 
1565 
1566 /*
1567  * Locking physical memory
1568  */
1569 int
1570 secpolicy_lock_memory(const cred_t *cr)
1571 {
1572 	return (PRIV_POLICY(cr, PRIV_PROC_LOCK_MEMORY, B_FALSE, EPERM, NULL));
1573 }
1574 
1575 /*
1576  * Accounting (both acct(2) and exacct).
1577  */
1578 int
1579 secpolicy_acct(const cred_t *cr)
1580 {
1581 	return (PRIV_POLICY(cr, PRIV_SYS_ACCT, B_FALSE, EPERM, NULL));
1582 }
1583 
1584 /*
1585  * Is this process privileged to change its uids at will?
1586  * Uid 0 is still considered "special" and having the SETID
1587  * privilege is not sufficient to get uid 0.
1588  * Files are owned by root, so the privilege would give
1589  * full access and euid 0 is still effective.
1590  *
1591  * If you have the privilege and euid 0 only then do you
1592  * get the powers of root wrt uid 0.
1593  *
1594  * For gid manipulations, this is should be called with an
1595  * uid of -1.
1596  *
1597  */
1598 int
1599 secpolicy_allow_setid(const cred_t *cr, uid_t newuid, boolean_t checkonly)
1600 {
1601 	boolean_t allzone = B_FALSE;
1602 
1603 	if (newuid == 0 && cr->cr_uid != 0 && cr->cr_suid != 0 &&
1604 	    cr->cr_ruid != 0) {
1605 		allzone = B_TRUE;
1606 	}
1607 
1608 	return (checkonly ? !PRIV_POLICY_ONLY(cr, PRIV_PROC_SETID, allzone) :
1609 	    PRIV_POLICY(cr, PRIV_PROC_SETID, allzone, EPERM, NULL));
1610 }
1611 
1612 
1613 /*
1614  * Acting on a different process: if the mode is for writing,
1615  * the restrictions are more severe.  This is called after
1616  * we've verified that the uids do not match.
1617  */
1618 int
1619 secpolicy_proc_owner(const cred_t *scr, const cred_t *tcr, int mode)
1620 {
1621 	boolean_t allzone = B_FALSE;
1622 
1623 	if ((mode & VWRITE) && scr->cr_uid != 0 &&
1624 	    (tcr->cr_uid == 0 || tcr->cr_ruid == 0 || tcr->cr_suid == 0))
1625 		allzone = B_TRUE;
1626 
1627 	return (PRIV_POLICY(scr, PRIV_PROC_OWNER, allzone, EPERM, NULL));
1628 }
1629 
1630 int
1631 secpolicy_proc_access(const cred_t *scr)
1632 {
1633 	return (PRIV_POLICY(scr, PRIV_PROC_OWNER, B_FALSE, EACCES, NULL));
1634 }
1635 
1636 int
1637 secpolicy_proc_excl_open(const cred_t *scr)
1638 {
1639 	return (PRIV_POLICY(scr, PRIV_PROC_OWNER, B_FALSE, EBUSY, NULL));
1640 }
1641 
1642 int
1643 secpolicy_proc_zone(const cred_t *scr)
1644 {
1645 	return (PRIV_POLICY(scr, PRIV_PROC_ZONE, B_FALSE, EPERM, NULL));
1646 }
1647 
1648 /*
1649  * Destroying the system
1650  */
1651 
1652 int
1653 secpolicy_kmdb(const cred_t *scr)
1654 {
1655 	return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL));
1656 }
1657 
1658 int
1659 secpolicy_error_inject(const cred_t *scr)
1660 {
1661 	return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL));
1662 }
1663 
1664 /*
1665  * Processor sets, cpu configuration, resource pools.
1666  */
1667 int
1668 secpolicy_pset(const cred_t *cr)
1669 {
1670 	return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL));
1671 }
1672 
1673 int
1674 secpolicy_ponline(const cred_t *cr)
1675 {
1676 	return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL));
1677 }
1678 
1679 int
1680 secpolicy_pool(const cred_t *cr)
1681 {
1682 	return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL));
1683 }
1684 
1685 int
1686 secpolicy_blacklist(const cred_t *cr)
1687 {
1688 	return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL));
1689 }
1690 
1691 /*
1692  * Catch all system configuration.
1693  */
1694 int
1695 secpolicy_sys_config(const cred_t *cr, boolean_t checkonly)
1696 {
1697 	if (checkonly) {
1698 		return (PRIV_POLICY_ONLY(cr, PRIV_SYS_CONFIG, B_FALSE) ? 0 :
1699 		    EPERM);
1700 	} else {
1701 		return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL));
1702 	}
1703 }
1704 
1705 /*
1706  * Zone administration (halt, reboot, etc.) from within zone.
1707  */
1708 int
1709 secpolicy_zone_admin(const cred_t *cr, boolean_t checkonly)
1710 {
1711 	if (checkonly) {
1712 		return (PRIV_POLICY_ONLY(cr, PRIV_SYS_ADMIN, B_FALSE) ? 0 :
1713 		    EPERM);
1714 	} else {
1715 		return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM,
1716 		    NULL));
1717 	}
1718 }
1719 
1720 /*
1721  * Zone configuration (create, halt, enter).
1722  */
1723 int
1724 secpolicy_zone_config(const cred_t *cr)
1725 {
1726 	/*
1727 	 * Require all privileges to avoid possibility of privilege
1728 	 * escalation.
1729 	 */
1730 	return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE));
1731 }
1732 
1733 /*
1734  * Various other system configuration calls
1735  */
1736 int
1737 secpolicy_coreadm(const cred_t *cr)
1738 {
1739 	return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, NULL));
1740 }
1741 
1742 int
1743 secpolicy_systeminfo(const cred_t *cr)
1744 {
1745 	return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, NULL));
1746 }
1747 
1748 int
1749 secpolicy_dispadm(const cred_t *cr)
1750 {
1751 	return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL));
1752 }
1753 
1754 int
1755 secpolicy_settime(const cred_t *cr)
1756 {
1757 	return (PRIV_POLICY(cr, PRIV_SYS_TIME, B_FALSE, EPERM, NULL));
1758 }
1759 
1760 /*
1761  * For realtime users: high resolution clock.
1762  */
1763 int
1764 secpolicy_clock_highres(const cred_t *cr)
1765 {
1766 	return (PRIV_POLICY(cr, PRIV_PROC_CLOCK_HIGHRES, B_FALSE, EPERM,
1767 	    NULL));
1768 }
1769 
1770 /*
1771  * drv_priv() is documented as callable from interrupt context, not that
1772  * anyone ever does, but still.  No debugging or auditing can be done when
1773  * it is called from interrupt context.
1774  * returns 0 on succes, EPERM on failure.
1775  */
1776 int
1777 drv_priv(cred_t *cr)
1778 {
1779 	return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL));
1780 }
1781 
1782 int
1783 secpolicy_sys_devices(const cred_t *cr)
1784 {
1785 	return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL));
1786 }
1787 
1788 int
1789 secpolicy_excl_open(const cred_t *cr)
1790 {
1791 	return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EBUSY, NULL));
1792 }
1793 
1794 int
1795 secpolicy_rctlsys(const cred_t *cr, boolean_t is_zone_rctl)
1796 {
1797 	/* zone.* rctls can only be set from the global zone */
1798 	if (is_zone_rctl && priv_policy_global(cr) != 0)
1799 		return (EPERM);
1800 	return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL));
1801 }
1802 
1803 int
1804 secpolicy_resource(const cred_t *cr)
1805 {
1806 	return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL));
1807 }
1808 
1809 int
1810 secpolicy_resource_anon_mem(const cred_t *cr)
1811 {
1812 	return (PRIV_POLICY_ONLY(cr, PRIV_SYS_RESOURCE, B_FALSE));
1813 }
1814 
1815 /*
1816  * Processes with a real uid of 0 escape any form of accounting, much
1817  * like before.
1818  */
1819 int
1820 secpolicy_newproc(const cred_t *cr)
1821 {
1822 	if (cr->cr_ruid == 0)
1823 		return (0);
1824 
1825 	return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL));
1826 }
1827 
1828 /*
1829  * Networking
1830  */
1831 int
1832 secpolicy_net_rawaccess(const cred_t *cr)
1833 {
1834 	return (PRIV_POLICY(cr, PRIV_NET_RAWACCESS, B_FALSE, EACCES, NULL));
1835 }
1836 
1837 int
1838 secpolicy_net_observability(const cred_t *cr)
1839 {
1840 	return (PRIV_POLICY(cr, PRIV_NET_OBSERVABILITY, B_FALSE, EACCES, NULL));
1841 }
1842 
1843 /*
1844  * Need this privilege for accessing the ICMP device
1845  */
1846 int
1847 secpolicy_net_icmpaccess(const cred_t *cr)
1848 {
1849 	return (PRIV_POLICY(cr, PRIV_NET_ICMPACCESS, B_FALSE, EACCES, NULL));
1850 }
1851 
1852 /*
1853  * There are a few rare cases where the kernel generates ioctls() from
1854  * interrupt context with a credential of kcred rather than NULL.
1855  * In those cases, we take the safe and cheap test.
1856  */
1857 int
1858 secpolicy_net_config(const cred_t *cr, boolean_t checkonly)
1859 {
1860 	if (checkonly) {
1861 		return (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE) ?
1862 		    0 : EPERM);
1863 	} else {
1864 		return (PRIV_POLICY(cr, PRIV_SYS_NET_CONFIG, B_FALSE, EPERM,
1865 		    NULL));
1866 	}
1867 }
1868 
1869 
1870 /*
1871  * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_IP_CONFIG.
1872  *
1873  * There are a few rare cases where the kernel generates ioctls() from
1874  * interrupt context with a credential of kcred rather than NULL.
1875  * In those cases, we take the safe and cheap test.
1876  */
1877 int
1878 secpolicy_ip_config(const cred_t *cr, boolean_t checkonly)
1879 {
1880 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE))
1881 		return (secpolicy_net_config(cr, checkonly));
1882 
1883 	if (checkonly) {
1884 		return (PRIV_POLICY_ONLY(cr, PRIV_SYS_IP_CONFIG, B_FALSE) ?
1885 		    0 : EPERM);
1886 	} else {
1887 		return (PRIV_POLICY(cr, PRIV_SYS_IP_CONFIG, B_FALSE, EPERM,
1888 		    NULL));
1889 	}
1890 }
1891 
1892 /*
1893  * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_DL_CONFIG.
1894  */
1895 int
1896 secpolicy_dl_config(const cred_t *cr)
1897 {
1898 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE))
1899 		return (secpolicy_net_config(cr, B_FALSE));
1900 	return (PRIV_POLICY(cr, PRIV_SYS_DL_CONFIG, B_FALSE, EPERM, NULL));
1901 }
1902 
1903 /*
1904  * PRIV_SYS_DL_CONFIG is a superset of PRIV_SYS_IPTUN_CONFIG.
1905  */
1906 int
1907 secpolicy_iptun_config(const cred_t *cr)
1908 {
1909 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE))
1910 		return (secpolicy_net_config(cr, B_FALSE));
1911 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_DL_CONFIG, B_FALSE))
1912 		return (secpolicy_dl_config(cr));
1913 	return (PRIV_POLICY(cr, PRIV_SYS_IPTUN_CONFIG, B_FALSE, EPERM, NULL));
1914 }
1915 
1916 /*
1917  * Map IP pseudo privileges to actual privileges.
1918  * So we don't need to recompile IP when we change the privileges.
1919  */
1920 int
1921 secpolicy_ip(const cred_t *cr, int netpriv, boolean_t checkonly)
1922 {
1923 	int priv = PRIV_ALL;
1924 
1925 	switch (netpriv) {
1926 	case OP_CONFIG:
1927 		priv = PRIV_SYS_IP_CONFIG;
1928 		break;
1929 	case OP_RAW:
1930 		priv = PRIV_NET_RAWACCESS;
1931 		break;
1932 	case OP_PRIVPORT:
1933 		priv = PRIV_NET_PRIVADDR;
1934 		break;
1935 	}
1936 	ASSERT(priv != PRIV_ALL);
1937 	if (checkonly)
1938 		return (PRIV_POLICY_ONLY(cr, priv, B_FALSE) ? 0 : EPERM);
1939 	else
1940 		return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL));
1941 }
1942 
1943 /*
1944  * Map network pseudo privileges to actual privileges.
1945  * So we don't need to recompile IP when we change the privileges.
1946  */
1947 int
1948 secpolicy_net(const cred_t *cr, int netpriv, boolean_t checkonly)
1949 {
1950 	int priv = PRIV_ALL;
1951 
1952 	switch (netpriv) {
1953 	case OP_CONFIG:
1954 		priv = PRIV_SYS_NET_CONFIG;
1955 		break;
1956 	case OP_RAW:
1957 		priv = PRIV_NET_RAWACCESS;
1958 		break;
1959 	case OP_PRIVPORT:
1960 		priv = PRIV_NET_PRIVADDR;
1961 		break;
1962 	}
1963 	ASSERT(priv != PRIV_ALL);
1964 	if (checkonly)
1965 		return (PRIV_POLICY_ONLY(cr, priv, B_FALSE) ? 0 : EPERM);
1966 	else
1967 		return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL));
1968 }
1969 
1970 /*
1971  * Checks for operations that are either client-only or are used by
1972  * both clients and servers.
1973  */
1974 int
1975 secpolicy_nfs(const cred_t *cr)
1976 {
1977 	return (PRIV_POLICY(cr, PRIV_SYS_NFS, B_FALSE, EPERM, NULL));
1978 }
1979 
1980 /*
1981  * Special case for opening rpcmod: have NFS privileges or network
1982  * config privileges.
1983  */
1984 int
1985 secpolicy_rpcmod_open(const cred_t *cr)
1986 {
1987 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NFS, B_FALSE))
1988 		return (secpolicy_nfs(cr));
1989 	else
1990 		return (secpolicy_net_config(cr, NULL));
1991 }
1992 
1993 int
1994 secpolicy_chroot(const cred_t *cr)
1995 {
1996 	return (PRIV_POLICY(cr, PRIV_PROC_CHROOT, B_FALSE, EPERM, NULL));
1997 }
1998 
1999 int
2000 secpolicy_tasksys(const cred_t *cr)
2001 {
2002 	return (PRIV_POLICY(cr, PRIV_PROC_TASKID, B_FALSE, EPERM, NULL));
2003 }
2004 
2005 int
2006 secpolicy_pfexec_register(const cred_t *cr)
2007 {
2008 	return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_TRUE, EPERM, NULL));
2009 }
2010 
2011 /*
2012  * Basic privilege checks.
2013  */
2014 int
2015 secpolicy_basic_exec(const cred_t *cr, vnode_t *vp)
2016 {
2017 	FAST_BASIC_CHECK(cr, PRIV_PROC_EXEC);
2018 
2019 	return (priv_policy_va(cr, PRIV_PROC_EXEC, B_FALSE, EPERM, NULL,
2020 	    KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE));
2021 }
2022 
2023 int
2024 secpolicy_basic_fork(const cred_t *cr)
2025 {
2026 	FAST_BASIC_CHECK(cr, PRIV_PROC_FORK);
2027 
2028 	return (PRIV_POLICY(cr, PRIV_PROC_FORK, B_FALSE, EPERM, NULL));
2029 }
2030 
2031 int
2032 secpolicy_basic_proc(const cred_t *cr)
2033 {
2034 	FAST_BASIC_CHECK(cr, PRIV_PROC_SESSION);
2035 
2036 	return (PRIV_POLICY(cr, PRIV_PROC_SESSION, B_FALSE, EPERM, NULL));
2037 }
2038 
2039 /*
2040  * Slightly complicated because we don't want to trigger the policy too
2041  * often.  First we shortcircuit access to "self" (tp == sp) or if
2042  * we don't have the privilege but if we have permission
2043  * just return (0) and we don't flag the privilege as needed.
2044  * Else, we test for the privilege because we either have it or need it.
2045  */
2046 int
2047 secpolicy_basic_procinfo(const cred_t *cr, proc_t *tp, proc_t *sp)
2048 {
2049 	if (tp == sp ||
2050 	    !HAS_PRIVILEGE(cr, PRIV_PROC_INFO) && prochasprocperm(tp, sp, cr)) {
2051 		return (0);
2052 	} else {
2053 		return (PRIV_POLICY(cr, PRIV_PROC_INFO, B_FALSE, EPERM, NULL));
2054 	}
2055 }
2056 
2057 int
2058 secpolicy_basic_link(const cred_t *cr)
2059 {
2060 	FAST_BASIC_CHECK(cr, PRIV_FILE_LINK_ANY);
2061 
2062 	return (PRIV_POLICY(cr, PRIV_FILE_LINK_ANY, B_FALSE, EPERM, NULL));
2063 }
2064 
2065 int
2066 secpolicy_basic_net_access(const cred_t *cr)
2067 {
2068 	FAST_BASIC_CHECK(cr, PRIV_NET_ACCESS);
2069 
2070 	return (PRIV_POLICY(cr, PRIV_NET_ACCESS, B_FALSE, EACCES, NULL));
2071 }
2072 
2073 /* ARGSUSED */
2074 int
2075 secpolicy_basic_file_read(const cred_t *cr, vnode_t *vp, const char *pn)
2076 {
2077 	FAST_BASIC_CHECK(cr, PRIV_FILE_READ);
2078 
2079 	return (priv_policy_va(cr, PRIV_FILE_READ, B_FALSE, EACCES, NULL,
2080 	    KLPDARG_VNODE, vp, (char *)pn, KLPDARG_NOMORE));
2081 }
2082 
2083 /* ARGSUSED */
2084 int
2085 secpolicy_basic_file_write(const cred_t *cr, vnode_t *vp, const char *pn)
2086 {
2087 	FAST_BASIC_CHECK(cr, PRIV_FILE_WRITE);
2088 
2089 	return (priv_policy_va(cr, PRIV_FILE_WRITE, B_FALSE, EACCES, NULL,
2090 	    KLPDARG_VNODE, vp, (char *)pn, KLPDARG_NOMORE));
2091 }
2092 
2093 /*
2094  * Additional device protection.
2095  *
2096  * Traditionally, a device has specific permissions on the node in
2097  * the filesystem which govern which devices can be opened by what
2098  * processes.  In certain cases, it is desirable to add extra
2099  * restrictions, as writing to certain devices is identical to
2100  * having a complete run of the system.
2101  *
2102  * This mechanism is called the device policy.
2103  *
2104  * When a device is opened, its policy entry is looked up in the
2105  * policy cache and checked.
2106  */
2107 int
2108 secpolicy_spec_open(const cred_t *cr, struct vnode *vp, int oflag)
2109 {
2110 	devplcy_t *plcy;
2111 	int err;
2112 	struct snode *csp = VTOS(common_specvp(vp));
2113 	priv_set_t pset;
2114 
2115 	mutex_enter(&csp->s_lock);
2116 
2117 	if (csp->s_plcy == NULL || csp->s_plcy->dp_gen != devplcy_gen) {
2118 		plcy = devpolicy_find(vp);
2119 		if (csp->s_plcy)
2120 			dpfree(csp->s_plcy);
2121 		csp->s_plcy = plcy;
2122 		ASSERT(plcy != NULL);
2123 	} else
2124 		plcy = csp->s_plcy;
2125 
2126 	if (plcy == nullpolicy) {
2127 		mutex_exit(&csp->s_lock);
2128 		return (0);
2129 	}
2130 
2131 	dphold(plcy);
2132 
2133 	mutex_exit(&csp->s_lock);
2134 
2135 	if (oflag & FWRITE)
2136 		pset = plcy->dp_wrp;
2137 	else
2138 		pset = plcy->dp_rdp;
2139 	/*
2140 	 * Special case:
2141 	 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_IP_CONFIG.
2142 	 * If PRIV_SYS_NET_CONFIG is present and PRIV_SYS_IP_CONFIG is
2143 	 * required, replace PRIV_SYS_IP_CONFIG with PRIV_SYS_NET_CONFIG
2144 	 * in the required privilege set before doing the check.
2145 	 */
2146 	if (priv_ismember(&pset, PRIV_SYS_IP_CONFIG) &&
2147 	    priv_ismember(&CR_OEPRIV(cr), PRIV_SYS_NET_CONFIG) &&
2148 	    !priv_ismember(&CR_OEPRIV(cr), PRIV_SYS_IP_CONFIG)) {
2149 		priv_delset(&pset, PRIV_SYS_IP_CONFIG);
2150 		priv_addset(&pset, PRIV_SYS_NET_CONFIG);
2151 	}
2152 
2153 	err = secpolicy_require_set(cr, &pset, "devpolicy", KLPDARG_NONE);
2154 	dpfree(plcy);
2155 
2156 	return (err);
2157 }
2158 
2159 int
2160 secpolicy_modctl(const cred_t *cr, int cmd)
2161 {
2162 	switch (cmd) {
2163 	case MODINFO:
2164 	case MODGETMAJBIND:
2165 	case MODGETPATH:
2166 	case MODGETPATHLEN:
2167 	case MODGETNAME:
2168 	case MODGETFBNAME:
2169 	case MODGETDEVPOLICY:
2170 	case MODGETDEVPOLICYBYNAME:
2171 	case MODDEVT2INSTANCE:
2172 	case MODSIZEOF_DEVID:
2173 	case MODGETDEVID:
2174 	case MODSIZEOF_MINORNAME:
2175 	case MODGETMINORNAME:
2176 	case MODGETDEVFSPATH_LEN:
2177 	case MODGETDEVFSPATH:
2178 	case MODGETDEVFSPATH_MI_LEN:
2179 	case MODGETDEVFSPATH_MI:
2180 		/* Unprivileged */
2181 		return (0);
2182 	case MODLOAD:
2183 	case MODSETDEVPOLICY:
2184 		return (secpolicy_require_set(cr, PRIV_FULLSET, NULL,
2185 		    KLPDARG_NONE));
2186 	default:
2187 		return (secpolicy_sys_config(cr, B_FALSE));
2188 	}
2189 }
2190 
2191 int
2192 secpolicy_console(const cred_t *cr)
2193 {
2194 	return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL));
2195 }
2196 
2197 int
2198 secpolicy_power_mgmt(const cred_t *cr)
2199 {
2200 	return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL));
2201 }
2202 
2203 /*
2204  * Simulate terminal input; another escalation of privileges avenue.
2205  */
2206 
2207 int
2208 secpolicy_sti(const cred_t *cr)
2209 {
2210 	return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE));
2211 }
2212 
2213 boolean_t
2214 secpolicy_net_reply_equal(const cred_t *cr)
2215 {
2216 	return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL));
2217 }
2218 
2219 int
2220 secpolicy_swapctl(const cred_t *cr)
2221 {
2222 	return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL));
2223 }
2224 
2225 int
2226 secpolicy_cpc_cpu(const cred_t *cr)
2227 {
2228 	return (PRIV_POLICY(cr, PRIV_CPC_CPU, B_FALSE, EACCES, NULL));
2229 }
2230 
2231 /*
2232  * secpolicy_contract_identity
2233  *
2234  * Determine if the subject may set the process contract FMRI value
2235  */
2236 int
2237 secpolicy_contract_identity(const cred_t *cr)
2238 {
2239 	return (PRIV_POLICY(cr, PRIV_CONTRACT_IDENTITY, B_FALSE, EPERM, NULL));
2240 }
2241 
2242 /*
2243  * secpolicy_contract_observer
2244  *
2245  * Determine if the subject may observe a specific contract's events.
2246  */
2247 int
2248 secpolicy_contract_observer(const cred_t *cr, struct contract *ct)
2249 {
2250 	if (contract_owned(ct, cr, B_FALSE))
2251 		return (0);
2252 	return (PRIV_POLICY(cr, PRIV_CONTRACT_OBSERVER, B_FALSE, EPERM, NULL));
2253 }
2254 
2255 /*
2256  * secpolicy_contract_observer_choice
2257  *
2258  * Determine if the subject may observe any contract's events.  Just
2259  * tests privilege and audits on success.
2260  */
2261 boolean_t
2262 secpolicy_contract_observer_choice(const cred_t *cr)
2263 {
2264 	return (PRIV_POLICY_CHOICE(cr, PRIV_CONTRACT_OBSERVER, B_FALSE));
2265 }
2266 
2267 /*
2268  * secpolicy_contract_event
2269  *
2270  * Determine if the subject may request critical contract events or
2271  * reliable contract event delivery.
2272  */
2273 int
2274 secpolicy_contract_event(const cred_t *cr)
2275 {
2276 	return (PRIV_POLICY(cr, PRIV_CONTRACT_EVENT, B_FALSE, EPERM, NULL));
2277 }
2278 
2279 /*
2280  * secpolicy_contract_event_choice
2281  *
2282  * Determine if the subject may retain contract events in its critical
2283  * set when a change in other terms would normally require a change in
2284  * the critical set.  Just tests privilege and audits on success.
2285  */
2286 boolean_t
2287 secpolicy_contract_event_choice(const cred_t *cr)
2288 {
2289 	return (PRIV_POLICY_CHOICE(cr, PRIV_CONTRACT_EVENT, B_FALSE));
2290 }
2291 
2292 /*
2293  * secpolicy_gart_access
2294  *
2295  * Determine if the subject has sufficient priveleges to make ioctls to agpgart
2296  * device.
2297  */
2298 int
2299 secpolicy_gart_access(const cred_t *cr)
2300 {
2301 	return (PRIV_POLICY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE, EPERM, NULL));
2302 }
2303 
2304 /*
2305  * secpolicy_gart_map
2306  *
2307  * Determine if the subject has sufficient priveleges to map aperture range
2308  * through agpgart driver.
2309  */
2310 int
2311 secpolicy_gart_map(const cred_t *cr)
2312 {
2313 	if (PRIV_POLICY_ONLY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE)) {
2314 		return (PRIV_POLICY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE, EPERM,
2315 		    NULL));
2316 	} else {
2317 		return (PRIV_POLICY(cr, PRIV_GRAPHICS_MAP, B_FALSE, EPERM,
2318 		    NULL));
2319 	}
2320 }
2321 
2322 /*
2323  * secpolicy_zinject
2324  *
2325  * Determine if the subject can inject faults in the ZFS fault injection
2326  * framework.  Requires all privileges.
2327  */
2328 int
2329 secpolicy_zinject(const cred_t *cr)
2330 {
2331 	return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE));
2332 }
2333 
2334 /*
2335  * secpolicy_zfs
2336  *
2337  * Determine if the subject has permission to manipulate ZFS datasets
2338  * (not pools).  Equivalent to the SYS_MOUNT privilege.
2339  */
2340 int
2341 secpolicy_zfs(const cred_t *cr)
2342 {
2343 	return (PRIV_POLICY(cr, PRIV_SYS_MOUNT, B_FALSE, EPERM, NULL));
2344 }
2345 
2346 /*
2347  * secpolicy_idmap
2348  *
2349  * Determine if the calling process has permissions to register an SID
2350  * mapping daemon and allocate ephemeral IDs.
2351  */
2352 int
2353 secpolicy_idmap(const cred_t *cr)
2354 {
2355 	return (PRIV_POLICY(cr, PRIV_FILE_SETID, B_TRUE, EPERM, NULL));
2356 }
2357 
2358 /*
2359  * secpolicy_ucode_update
2360  *
2361  * Determine if the subject has sufficient privilege to update microcode.
2362  */
2363 int
2364 secpolicy_ucode_update(const cred_t *scr)
2365 {
2366 	return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL));
2367 }
2368 
2369 /*
2370  * secpolicy_sadopen
2371  *
2372  * Determine if the subject has sufficient privilege to access /dev/sad/admin.
2373  * /dev/sad/admin appear in global zone and exclusive-IP zones only.
2374  * In global zone, sys_config is required.
2375  * In exclusive-IP zones, sys_ip_config is required.
2376  * Note that sys_config is prohibited in non-global zones.
2377  */
2378 int
2379 secpolicy_sadopen(const cred_t *credp)
2380 {
2381 	priv_set_t pset;
2382 
2383 	priv_emptyset(&pset);
2384 
2385 	if (crgetzoneid(credp) == GLOBAL_ZONEID)
2386 		priv_addset(&pset, PRIV_SYS_CONFIG);
2387 	else
2388 		priv_addset(&pset, PRIV_SYS_IP_CONFIG);
2389 
2390 	return (secpolicy_require_set(credp, &pset, "devpolicy", KLPDARG_NONE));
2391 }
2392 
2393 
2394 /*
2395  * Add privileges to a particular privilege set; this is called when the
2396  * current sets of privileges are not sufficient.  I.e., we should always
2397  * call the policy override functions from here.
2398  * What we are allowed to have is in the Observed Permitted set; so
2399  * we compute the difference between that and the newset.
2400  */
2401 int
2402 secpolicy_require_privs(const cred_t *cr, const priv_set_t *nset)
2403 {
2404 	priv_set_t rqd;
2405 
2406 	rqd = CR_OPPRIV(cr);
2407 
2408 	priv_inverse(&rqd);
2409 	priv_intersect(nset, &rqd);
2410 
2411 	return (secpolicy_require_set(cr, &rqd, NULL, KLPDARG_NONE));
2412 }
2413 
2414 /*
2415  * secpolicy_smb
2416  *
2417  * Determine if the cred_t has PRIV_SYS_SMB privilege, indicating
2418  * that it has permission to access the smbsrv kernel driver.
2419  * PRIV_POLICY checks the privilege and audits the check.
2420  *
2421  * Returns:
2422  * 0       Driver access is allowed.
2423  * EPERM   Driver access is NOT permitted.
2424  */
2425 int
2426 secpolicy_smb(const cred_t *cr)
2427 {
2428 	return (PRIV_POLICY(cr, PRIV_SYS_SMB, B_FALSE, EPERM, NULL));
2429 }
2430 
2431 /*
2432  * secpolicy_vscan
2433  *
2434  * Determine if cred_t has the necessary privileges to access a file
2435  * for virus scanning and update its extended system attributes.
2436  * PRIV_FILE_DAC_SEARCH, PRIV_FILE_DAC_READ - file access
2437  * PRIV_FILE_FLAG_SET - set extended system attributes
2438  *
2439  * PRIV_POLICY checks the privilege and audits the check.
2440  *
2441  * Returns:
2442  * 0      file access for virus scanning allowed.
2443  * EPERM  file access for virus scanning is NOT permitted.
2444  */
2445 int
2446 secpolicy_vscan(const cred_t *cr)
2447 {
2448 	if ((PRIV_POLICY(cr, PRIV_FILE_DAC_SEARCH, B_FALSE, EPERM, NULL)) ||
2449 	    (PRIV_POLICY(cr, PRIV_FILE_DAC_READ, B_FALSE, EPERM, NULL)) ||
2450 	    (PRIV_POLICY(cr, PRIV_FILE_FLAG_SET, B_FALSE, EPERM, NULL))) {
2451 		return (EPERM);
2452 	}
2453 
2454 	return (0);
2455 }
2456 
2457 /*
2458  * secpolicy_smbfs_login
2459  *
2460  * Determines if the caller can add and delete the smbfs login
2461  * password in the the nsmb kernel module for the CIFS client.
2462  *
2463  * Returns:
2464  * 0       access is allowed.
2465  * EPERM   access is NOT allowed.
2466  */
2467 int
2468 secpolicy_smbfs_login(const cred_t *cr, uid_t uid)
2469 {
2470 	uid_t cruid = crgetruid(cr);
2471 
2472 	if (cruid == uid)
2473 		return (0);
2474 	return (PRIV_POLICY(cr, PRIV_PROC_OWNER, B_FALSE,
2475 	    EPERM, NULL));
2476 }
2477 
2478 /*
2479  * secpolicy_xvm_control
2480  *
2481  * Determines if a caller can control the xVM hypervisor and/or running
2482  * domains (x86 specific).
2483  *
2484  * Returns:
2485  * 0       access is allowed.
2486  * EPERM   access is NOT allowed.
2487  */
2488 int
2489 secpolicy_xvm_control(const cred_t *cr)
2490 {
2491 	if (PRIV_POLICY(cr, PRIV_XVM_CONTROL, B_FALSE, EPERM, NULL))
2492 		return (EPERM);
2493 	return (0);
2494 }
2495 
2496 /*
2497  * secpolicy_ppp_config
2498  *
2499  * Determine if the subject has sufficient privileges to configure PPP and
2500  * PPP-related devices.
2501  */
2502 int
2503 secpolicy_ppp_config(const cred_t *cr)
2504 {
2505 	if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE))
2506 		return (secpolicy_net_config(cr, B_FALSE));
2507 	return (PRIV_POLICY(cr, PRIV_SYS_PPP_CONFIG, B_FALSE, EPERM, NULL));
2508 }
2509