1 /* $NetBSD: kauth.h,v 1.64 2009/12/24 19:02:07 elad Exp $ */ 2 3 /*- 4 * Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * This is based on Apple TN2127, available online at 32 * http://developer.apple.com/technotes/tn2005/tn2127.html 33 */ 34 35 #ifndef _SYS_KAUTH_H_ 36 #define _SYS_KAUTH_H_ 37 38 struct uucred; 39 struct ki_ucred; 40 struct ki_pcred; 41 struct proc; 42 struct tty; 43 struct vnode; 44 45 /* Types. */ 46 typedef struct kauth_scope *kauth_scope_t; 47 typedef struct kauth_listener *kauth_listener_t; 48 typedef uint32_t kauth_action_t; 49 typedef int (*kauth_scope_callback_t)(kauth_cred_t, kauth_action_t, 50 void *, void *, void *, void *, void *); 51 typedef struct kauth_key *kauth_key_t; 52 53 /* 54 * Possible return values for a listener. 55 */ 56 #define KAUTH_RESULT_ALLOW 0 /* allow access */ 57 #define KAUTH_RESULT_DENY 1 /* deny access */ 58 #define KAUTH_RESULT_DEFER 2 /* let others decide */ 59 60 /* 61 * Scopes. 62 */ 63 #define KAUTH_SCOPE_GENERIC "org.netbsd.kauth.generic" 64 #define KAUTH_SCOPE_SYSTEM "org.netbsd.kauth.system" 65 #define KAUTH_SCOPE_PROCESS "org.netbsd.kauth.process" 66 #define KAUTH_SCOPE_NETWORK "org.netbsd.kauth.network" 67 #define KAUTH_SCOPE_MACHDEP "org.netbsd.kauth.machdep" 68 #define KAUTH_SCOPE_DEVICE "org.netbsd.kauth.device" 69 #define KAUTH_SCOPE_CRED "org.netbsd.kauth.cred" 70 #define KAUTH_SCOPE_VNODE "org.netbsd.kauth.vnode" 71 72 /* 73 * Generic scope - actions. 74 */ 75 enum { 76 KAUTH_GENERIC_UNUSED1=1, 77 KAUTH_GENERIC_ISSUSER, 78 }; 79 80 /* 81 * System scope - actions. 82 */ 83 enum { 84 KAUTH_SYSTEM_ACCOUNTING=1, 85 KAUTH_SYSTEM_CHROOT, 86 KAUTH_SYSTEM_CHSYSFLAGS, 87 KAUTH_SYSTEM_CPU, 88 KAUTH_SYSTEM_DEBUG, 89 KAUTH_SYSTEM_FILEHANDLE, 90 KAUTH_SYSTEM_MKNOD, 91 KAUTH_SYSTEM_MOUNT, 92 KAUTH_SYSTEM_PSET, 93 KAUTH_SYSTEM_REBOOT, 94 KAUTH_SYSTEM_SETIDCORE, 95 KAUTH_SYSTEM_SWAPCTL, 96 KAUTH_SYSTEM_SYSCTL, 97 KAUTH_SYSTEM_TIME, 98 KAUTH_SYSTEM_MODULE, 99 KAUTH_SYSTEM_FS_RESERVEDSPACE, 100 KAUTH_SYSTEM_FS_QUOTA, 101 }; 102 103 /* 104 * System scope - sub-actions. 105 */ 106 enum kauth_system_req { 107 KAUTH_REQ_SYSTEM_CHROOT_CHROOT=1, 108 KAUTH_REQ_SYSTEM_CHROOT_FCHROOT, 109 KAUTH_REQ_SYSTEM_CPU_SETSTATE, 110 KAUTH_REQ_SYSTEM_DEBUG_IPKDB, 111 KAUTH_REQ_SYSTEM_MOUNT_GET, 112 KAUTH_REQ_SYSTEM_MOUNT_NEW, 113 KAUTH_REQ_SYSTEM_MOUNT_UNMOUNT, 114 KAUTH_REQ_SYSTEM_MOUNT_UPDATE, 115 KAUTH_REQ_SYSTEM_PSET_ASSIGN, 116 KAUTH_REQ_SYSTEM_PSET_BIND, 117 KAUTH_REQ_SYSTEM_PSET_CREATE, 118 KAUTH_REQ_SYSTEM_PSET_DESTROY, 119 KAUTH_REQ_SYSTEM_SYSCTL_ADD, 120 KAUTH_REQ_SYSTEM_SYSCTL_DELETE, 121 KAUTH_REQ_SYSTEM_SYSCTL_DESC, 122 KAUTH_REQ_SYSTEM_SYSCTL_MODIFY, 123 KAUTH_REQ_SYSTEM_SYSCTL_PRVT, 124 KAUTH_REQ_SYSTEM_TIME_ADJTIME, 125 KAUTH_REQ_SYSTEM_TIME_NTPADJTIME, 126 KAUTH_REQ_SYSTEM_TIME_RTCOFFSET, 127 KAUTH_REQ_SYSTEM_TIME_SYSTEM, 128 KAUTH_REQ_SYSTEM_TIME_TIMECOUNTERS, 129 KAUTH_REQ_SYSTEM_FS_QUOTA_GET, 130 KAUTH_REQ_SYSTEM_FS_QUOTA_MANAGE, 131 KAUTH_REQ_SYSTEM_FS_QUOTA_NOLIMIT, 132 KAUTH_REQ_SYSTEM_FS_QUOTA_ONOFF, 133 }; 134 135 /* 136 * Process scope - actions. 137 */ 138 enum { 139 KAUTH_PROCESS_CANSEE=1, 140 KAUTH_PROCESS_CORENAME, 141 KAUTH_PROCESS_FORK, 142 KAUTH_PROCESS_KEVENT_FILTER, 143 KAUTH_PROCESS_KTRACE, 144 KAUTH_PROCESS_NICE, 145 KAUTH_PROCESS_PROCFS, 146 KAUTH_PROCESS_PTRACE, 147 KAUTH_PROCESS_RLIMIT, 148 KAUTH_PROCESS_SCHEDULER_GETAFFINITY, 149 KAUTH_PROCESS_SCHEDULER_SETAFFINITY, 150 KAUTH_PROCESS_SCHEDULER_GETPARAM, 151 KAUTH_PROCESS_SCHEDULER_SETPARAM, 152 KAUTH_PROCESS_SETID, 153 KAUTH_PROCESS_SIGNAL, 154 KAUTH_PROCESS_STOPFLAG 155 }; 156 157 /* 158 * Process scope - sub-actions. 159 */ 160 enum kauth_process_req { 161 KAUTH_REQ_PROCESS_CANSEE_ARGS=1, 162 KAUTH_REQ_PROCESS_CANSEE_ENTRY, 163 KAUTH_REQ_PROCESS_CANSEE_ENV, 164 KAUTH_REQ_PROCESS_CANSEE_OPENFILES, 165 KAUTH_REQ_PROCESS_CORENAME_GET, 166 KAUTH_REQ_PROCESS_CORENAME_SET, 167 KAUTH_REQ_PROCESS_KTRACE_PERSISTENT, 168 KAUTH_REQ_PROCESS_PROCFS_CTL, 169 KAUTH_REQ_PROCESS_PROCFS_READ, 170 KAUTH_REQ_PROCESS_PROCFS_RW, 171 KAUTH_REQ_PROCESS_PROCFS_WRITE, 172 KAUTH_REQ_PROCESS_RLIMIT_GET, 173 KAUTH_REQ_PROCESS_RLIMIT_SET 174 }; 175 176 /* 177 * Network scope - actions. 178 */ 179 enum { 180 KAUTH_NETWORK_ALTQ=1, 181 KAUTH_NETWORK_BIND, 182 KAUTH_NETWORK_FIREWALL, 183 KAUTH_NETWORK_INTERFACE, 184 KAUTH_NETWORK_FORWSRCRT, 185 KAUTH_NETWORK_NFS, 186 KAUTH_NETWORK_ROUTE, 187 KAUTH_NETWORK_SOCKET, 188 KAUTH_NETWORK_INTERFACE_PPP, 189 KAUTH_NETWORK_INTERFACE_SLIP, 190 KAUTH_NETWORK_INTERFACE_STRIP, 191 KAUTH_NETWORK_INTERFACE_TUN, 192 }; 193 194 /* 195 * Network scope - sub-actions. 196 */ 197 enum kauth_network_req { 198 KAUTH_REQ_NETWORK_ALTQ_AFMAP=1, 199 KAUTH_REQ_NETWORK_ALTQ_BLUE, 200 KAUTH_REQ_NETWORK_ALTQ_CBQ, 201 KAUTH_REQ_NETWORK_ALTQ_CDNR, 202 KAUTH_REQ_NETWORK_ALTQ_CONF, 203 KAUTH_REQ_NETWORK_ALTQ_FIFOQ, 204 KAUTH_REQ_NETWORK_ALTQ_HFSC, 205 KAUTH_REQ_NETWORK_ALTQ_JOBS, 206 KAUTH_REQ_NETWORK_ALTQ_PRIQ, 207 KAUTH_REQ_NETWORK_ALTQ_RED, 208 KAUTH_REQ_NETWORK_ALTQ_RIO, 209 KAUTH_REQ_NETWORK_ALTQ_WFQ, 210 KAUTH_REQ_NETWORK_BIND_PORT, 211 KAUTH_REQ_NETWORK_BIND_PRIVPORT, 212 KAUTH_REQ_NETWORK_FIREWALL_FW, 213 KAUTH_REQ_NETWORK_FIREWALL_NAT, 214 KAUTH_REQ_NETWORK_INTERFACE_GET, 215 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, 216 KAUTH_REQ_NETWORK_INTERFACE_SET, 217 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, 218 KAUTH_REQ_NETWORK_NFS_EXPORT, 219 KAUTH_REQ_NETWORK_NFS_SVC, 220 KAUTH_REQ_NETWORK_SOCKET_OPEN, 221 KAUTH_REQ_NETWORK_SOCKET_RAWSOCK, 222 KAUTH_REQ_NETWORK_SOCKET_CANSEE, 223 KAUTH_REQ_NETWORK_SOCKET_DROP, 224 KAUTH_REQ_NETWORK_SOCKET_SETPRIV, 225 KAUTH_REQ_NETWORK_INTERFACE_PPP_ADD, 226 KAUTH_REQ_NETWORK_INTERFACE_SLIP_ADD, 227 KAUTH_REQ_NETWORK_INTERFACE_STRIP_ADD, 228 KAUTH_REQ_NETWORK_INTERFACE_TUN_ADD, 229 }; 230 231 /* 232 * Machdep scope - actions. 233 */ 234 enum { 235 KAUTH_MACHDEP_CACHEFLUSH=1, 236 KAUTH_MACHDEP_IOPERM_GET, 237 KAUTH_MACHDEP_IOPERM_SET, 238 KAUTH_MACHDEP_IOPL, 239 KAUTH_MACHDEP_LDT_GET, 240 KAUTH_MACHDEP_LDT_SET, 241 KAUTH_MACHDEP_MTRR_GET, 242 KAUTH_MACHDEP_MTRR_SET, 243 KAUTH_MACHDEP_NVRAM, 244 KAUTH_MACHDEP_UNMANAGEDMEM 245 }; 246 247 /* 248 * Device scope - actions. 249 */ 250 enum { 251 KAUTH_DEVICE_TTY_OPEN=1, 252 KAUTH_DEVICE_TTY_PRIVSET, 253 KAUTH_DEVICE_TTY_STI, 254 KAUTH_DEVICE_RAWIO_SPEC, 255 KAUTH_DEVICE_RAWIO_PASSTHRU, 256 KAUTH_DEVICE_BLUETOOTH_SETPRIV, 257 KAUTH_DEVICE_RND_ADDDATA, 258 KAUTH_DEVICE_RND_GETPRIV, 259 KAUTH_DEVICE_RND_SETPRIV, 260 KAUTH_DEVICE_BLUETOOTH_BCSP, 261 KAUTH_DEVICE_BLUETOOTH_BTUART, 262 KAUTH_DEVICE_GPIO_PINSET, 263 KAUTH_DEVICE_BLUETOOTH_SEND, 264 KAUTH_DEVICE_BLUETOOTH_RECV 265 }; 266 267 /* 268 * Device scope - sub-actions. 269 */ 270 enum kauth_device_req { 271 KAUTH_REQ_DEVICE_RAWIO_SPEC_READ=1, 272 KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE, 273 KAUTH_REQ_DEVICE_RAWIO_SPEC_RW, 274 KAUTH_REQ_DEVICE_BLUETOOTH_BCSP_ADD, 275 KAUTH_REQ_DEVICE_BLUETOOTH_BTUART_ADD, 276 }; 277 278 /* 279 * Credentials scope - actions. 280 */ 281 enum { 282 KAUTH_CRED_INIT=1, 283 KAUTH_CRED_FORK, 284 KAUTH_CRED_COPY, 285 KAUTH_CRED_FREE 286 }; 287 288 /* 289 * Vnode scope - action bits. 290 */ 291 #define KAUTH_VNODE_READ_DATA (1U << 0) 292 #define KAUTH_VNODE_LIST_DIRECTORY KAUTH_VNODE_READ_DATA 293 #define KAUTH_VNODE_WRITE_DATA (1U << 1) 294 #define KAUTH_VNODE_ADD_FILE KAUTH_VNODE_WRITE_DATA 295 #define KAUTH_VNODE_EXECUTE (1U << 2) 296 #define KAUTH_VNODE_SEARCH KAUTH_VNODE_EXECUTE 297 #define KAUTH_VNODE_DELETE (1U << 3) 298 #define KAUTH_VNODE_APPEND_DATA (1U << 4) 299 #define KAUTH_VNODE_ADD_SUBDIRECTORY KAUTH_VNODE_APPEND_DATA 300 #define KAUTH_VNODE_READ_TIMES (1U << 5) 301 #define KAUTH_VNODE_WRITE_TIMES (1U << 6) 302 #define KAUTH_VNODE_READ_FLAGS (1U << 7) 303 #define KAUTH_VNODE_WRITE_FLAGS (1U << 8) 304 #define KAUTH_VNODE_READ_SYSFLAGS (1U << 9) 305 #define KAUTH_VNODE_WRITE_SYSFLAGS (1U << 10) 306 #define KAUTH_VNODE_RENAME (1U << 11) 307 #define KAUTH_VNODE_CHANGE_OWNERSHIP (1U << 12) 308 #define KAUTH_VNODE_READ_SECURITY (1U << 13) 309 #define KAUTH_VNODE_WRITE_SECURITY (1U << 14) 310 #define KAUTH_VNODE_READ_ATTRIBUTES (1U << 15) 311 #define KAUTH_VNODE_WRITE_ATTRIBUTES (1U << 16) 312 #define KAUTH_VNODE_READ_EXTATTRIBUTES (1U << 17) 313 #define KAUTH_VNODE_WRITE_EXTATTRIBUTES (1U << 18) 314 315 #define KAUTH_VNODE_HAS_SYSFLAGS (1U << 30) 316 #define KAUTH_VNODE_ACCESS (1U << 31) 317 318 /* 319 * This is a special fs_decision indication that can be used by file-systems 320 * that don't support decision-before-action to tell kauth(9) it can only 321 * short-circuit the operation beforehand. 322 */ 323 #define KAUTH_VNODE_REMOTEFS (-1) 324 325 /* 326 * Device scope, passthru request - identifiers. 327 */ 328 #define KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READ 0x00000001 329 #define KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_WRITE 0x00000002 330 #define KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READCONF 0x00000004 331 #define KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_WRITECONF 0x00000008 332 #define KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL 0x0000000F 333 334 #define NOCRED ((kauth_cred_t)-1) /* no credential available */ 335 #define FSCRED ((kauth_cred_t)-2) /* filesystem credential */ 336 337 /* Macro to help passing arguments to authorization wrappers. */ 338 #define KAUTH_ARG(arg) ((void *)(unsigned long)(arg)) 339 340 /* 341 * Prototypes. 342 */ 343 void kauth_init(void); 344 kauth_scope_t kauth_register_scope(const char *, kauth_scope_callback_t, void *); 345 void kauth_deregister_scope(kauth_scope_t); 346 kauth_listener_t kauth_listen_scope(const char *, kauth_scope_callback_t, void *); 347 void kauth_unlisten_scope(kauth_listener_t); 348 int kauth_authorize_action(kauth_scope_t, kauth_cred_t, kauth_action_t, void *, 349 void *, void *, void *); 350 351 /* Authorization wrappers. */ 352 int kauth_authorize_generic(kauth_cred_t, kauth_action_t, void *); 353 int kauth_authorize_system(kauth_cred_t, kauth_action_t, enum kauth_system_req, 354 void *, void *, void *); 355 int kauth_authorize_process(kauth_cred_t, kauth_action_t, struct proc *, 356 void *, void *, void *); 357 int kauth_authorize_network(kauth_cred_t, kauth_action_t, 358 enum kauth_network_req, void *, void *, void *); 359 int kauth_authorize_machdep(kauth_cred_t, kauth_action_t, 360 void *, void *, void *, void *); 361 int kauth_authorize_device(kauth_cred_t, kauth_action_t, 362 void *, void *, void *, void *); 363 int kauth_authorize_device_tty(kauth_cred_t, kauth_action_t, struct tty *); 364 int kauth_authorize_device_spec(kauth_cred_t, enum kauth_device_req, 365 struct vnode *); 366 int kauth_authorize_device_passthru(kauth_cred_t, dev_t, u_long, void *); 367 int kauth_authorize_vnode(kauth_cred_t, kauth_action_t, struct vnode *, 368 struct vnode *, int); 369 370 /* Kauth credentials management routines. */ 371 kauth_cred_t kauth_cred_alloc(void); 372 void kauth_cred_free(kauth_cred_t); 373 void kauth_cred_clone(kauth_cred_t, kauth_cred_t); 374 kauth_cred_t kauth_cred_dup(kauth_cred_t); 375 kauth_cred_t kauth_cred_copy(kauth_cred_t); 376 377 uid_t kauth_cred_getuid(kauth_cred_t); 378 uid_t kauth_cred_geteuid(kauth_cred_t); 379 uid_t kauth_cred_getsvuid(kauth_cred_t); 380 gid_t kauth_cred_getgid(kauth_cred_t); 381 gid_t kauth_cred_getegid(kauth_cred_t); 382 gid_t kauth_cred_getsvgid(kauth_cred_t); 383 int kauth_cred_ismember_gid(kauth_cred_t, gid_t, int *); 384 u_int kauth_cred_ngroups(kauth_cred_t); 385 gid_t kauth_cred_group(kauth_cred_t, u_int); 386 387 void kauth_cred_setuid(kauth_cred_t, uid_t); 388 void kauth_cred_seteuid(kauth_cred_t, uid_t); 389 void kauth_cred_setsvuid(kauth_cred_t, uid_t); 390 void kauth_cred_setgid(kauth_cred_t, gid_t); 391 void kauth_cred_setegid(kauth_cred_t, gid_t); 392 void kauth_cred_setsvgid(kauth_cred_t, gid_t); 393 394 void kauth_cred_hold(kauth_cred_t); 395 u_int kauth_cred_getrefcnt(kauth_cred_t); 396 397 int kauth_cred_setgroups(kauth_cred_t, const gid_t *, size_t, uid_t, 398 enum uio_seg); 399 int kauth_cred_getgroups(kauth_cred_t, gid_t *, size_t, enum uio_seg); 400 401 /* This is for sys_setgroups() */ 402 int kauth_proc_setgroups(struct lwp *, kauth_cred_t); 403 404 int kauth_register_key(const char *, kauth_key_t *); 405 int kauth_deregister_key(kauth_key_t); 406 void kauth_cred_setdata(kauth_cred_t, kauth_key_t, void *); 407 void *kauth_cred_getdata(kauth_cred_t, kauth_key_t); 408 409 int kauth_cred_uidmatch(kauth_cred_t, kauth_cred_t); 410 void kauth_uucred_to_cred(kauth_cred_t, const struct uucred *); 411 void kauth_cred_to_uucred(struct uucred *, const kauth_cred_t); 412 int kauth_cred_uucmp(kauth_cred_t, const struct uucred *); 413 void kauth_cred_toucred(kauth_cred_t, struct ki_ucred *); 414 void kauth_cred_topcred(kauth_cred_t, struct ki_pcred *); 415 416 kauth_action_t kauth_mode_to_action(mode_t mode); 417 418 kauth_cred_t kauth_cred_get(void); 419 420 void kauth_proc_fork(struct proc *, struct proc *); 421 422 void secmodel_register(void); 423 void secmodel_deregister(void); 424 425 #endif /* !_SYS_KAUTH_H_ */ 426