1.\" $NetBSD: kauth.9,v 1.76 2009/04/20 19:37:08 elad Exp $ 2.\" 3.\" Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org> 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27.\" 28.Dd April 20, 2009 29.Dt KAUTH 9 30.Os 31.Sh NAME 32.Nm kauth 33.Nd kernel authorization framework 34.Sh SYNOPSIS 35.In sys/kauth.h 36.Sh DESCRIPTION 37.Nm , 38or kernel authorization, is the subsystem managing all authorization requests 39inside the kernel. 40It manages user credentials and rights, and can be used 41to implement a system-wide security policy. 42It allows external modules to plug-in the authorization process. 43.Pp 44.Nm 45introduces some new concepts, namely 46.Dq scopes 47and 48.Dq listeners , 49which will be detailed together with other useful information for kernel 50developers in this document. 51.Ss Types 52Some 53.Nm 54types include the following: 55.Bl -tag -width kauth_listener_t 56.It kauth_cred_t 57Representing credentials that can be associated with an object. 58Includes user- and group-ids (real, effective, and save) as well as group 59membership information. 60.It kauth_scope_t 61Describes a scope. 62.It kauth_listener_t 63Describes a listener. 64.El 65.Ss Terminology 66.Nm 67operates in various 68.Dq scopes , 69each scope holding a group of 70.Dq listeners . 71.Pp 72Each listener works as a callback for when an authorization request within the 73scope is made. 74When such a request is made, all listeners on the scope are passed common 75information such as the credentials of the request context, an identifier for 76the requested operation, and possibly other information as well. 77.Pp 78Every listener examines the passed information and returns its decision 79regarding the requested operation. 80It can either allow, deny, or defer the operation -- in which case, the 81decision is left to the other listeners. 82.Pp 83For an operation to be allowed, all listeners must not return any deny 84or defer decisions. 85.Pp 86Scopes manage listeners that operate in the same aspect of the system. 87.Ss Kernel Programming Interface 88.Nm 89exports a KPI that allows developers both of 90.Nx 91and third-party products to authorize requests, access and modify credentials, 92create and remove scopes and listeners, and perform other miscellaneous operations on 93credentials. 94.Ss Authorization Requests 95.Nm 96provides a single authorization request routine, which all authorization 97requests go through. 98This routine dispatches the request to the listeners of the appropriate scope, 99together with four optional user-data variables, and returns the augmented 100result. 101.Pp 102It is declared as 103.Pp 104.Ft int Fn kauth_authorize_action "kauth_scope_t scope" "kauth_cred_t cred" \ 105"kauth_action_t op" "void *arg0" "void *arg1" "void *arg2" "void *arg3" 106.Pp 107An authorization request can return one of two possible values. 108Zero indicates success -- the operation is allowed; 109.Er EPERM 110(see 111.Xr errno 2 ) 112indicates failure -- the operation is denied. 113.Pp 114Each scope has its own authorization wrapper, to make it easy to call from various 115places by eliminating the need to specify the scope and/or cast values. 116The authorization wrappers are detailed in each scope's section. 117.Pp 118.Fn kauth_authorize_action 119has several special cases, when it will always allow the request. 120These are for when the request is issued by the kernel itself (indicated by the 121credentials being either 122.Dv NOCRED 123or 124.Dv FSCRED ) , 125or when there was no definitive decision from any of the listeners (i.e., it 126was not explicitly allowed or denied) and no security model was loaded. 127.Ss Generic Scope 128The generic scope, 129.Dq org.netbsd.kauth.generic , 130manages generic authorization requests in the kernel. 131.Pp 132The authorization wrapper for this scope is declared as 133.Pp 134.Ft int Fn kauth_authorize_generic "kauth_cred_t cred" "kauth_action_t op" \ 135"void *arg0" 136.Pp 137The following operations are available for this scope: 138.Bl -tag -width compact 139.It Dv KAUTH_GENERIC_ISSUSER 140Checks whether the credentials belong to the super-user. 141.Pp 142Using this request is strongly discouraged and should only be done as a 143temporary place-holder, as it is breaking the separation between the 144interface for authorization requests from the back-end implementation. 145.It Dv KAUTH_GENERIC_CANSEE 146Checks whether an object with one set of credentials can access 147information about another object, possibly with a different set of 148credentials. 149.Pp 150.Ar arg0 151contains the credentials of the object looked at. 152.Pp 153This request should be issued only in cases where generic credentials 154check is required; otherwise it is recommended to use the object-specific 155routines. 156.El 157.Ss System Scope 158The system scope, 159.Dq org.netbsd.kauth.system , 160manages authorization requests affecting the entire system. 161.Pp 162The authorization wrapper for this scope is declared as 163.Pp 164.Ft int Fn kauth_authorize_system "kauth_cred_t cred" \ 165"kauth_action_t op" "enum kauth_system_req req" "void *arg1" "void *arg2" \ 166"void *arg3" 167.Pp 168The following requests are available for this scope: 169.Bl -tag -width compact 170.It Dv KAUTH_SYSTEM_ACCOUNTING 171Check if enabling/disabling accounting allowed. 172.It Dv KAUTH_SYSTEM_CHROOT 173.Ar req 174can be any of the following: 175.Bl -tag -width compact 176.It Dv KAUTH_REQ_SYSTEM_CHROOT_CHROOT 177Check if calling 178.Xr chroot 2 179is allowed. 180.It Dv KAUTH_REQ_SYSTEM_CHROOT_FCHROOT 181Check if calling 182.Xr fchroot 2 183is allowed. 184.El 185.It Dv KAUTH_SYSTEM_CPU 186Check CPU-manipulation access. 187.Pp 188.Ar req 189can be any of the following: 190.Bl -tag -width compact 191.It Dv KAUTH_REQ_SYSTEM_CPU_SETSTATE 192Set CPU state, including setting it online or offline. 193.El 194.It Dv KAUTH_SYSTEM_DEBUG 195This request concentrates several debugging-related operations. 196.Ar req 197can be any of the following: 198.Bl -tag -width compact 199.It Dv KAUTH_REQ_SYSTEM_DEBUG_IPKDB 200Check if using 201.Xr ipkdb 4 202is allowed. 203.El 204.It Dv KAUTH_SYSTEM_FILEHANDLE 205Check if filehandle operations allowed. 206.It Dv KAUTH_SYSTEM_MODULE 207Check if a module request is allowed. 208.Pp 209.Ar arg1 210is the command. 211.It Dv KAUTH_SYSTEM_MKNOD 212Check if creating devices is allowed. 213.It Dv KAUTH_SYSTEM_MOUNT 214Check if mount-related operations are allowed. 215.Pp 216.Ar req 217can be any of the following: 218.Bl -tag -width compact 219.It Dv KAUTH_REQ_SYSTEM_MOUNT_GET 220Check if retrieving information about a mount is allowed. 221.Ar arg1 222is a 223.Ft struct mount * 224with the mount structure in question, 225.Ar arg2 226is a 227.Ft void * 228with file-system specific data, if any. 229.It Dv KAUTH_REQ_SYSTEM_MOUNT_NEW 230Check if mounting a new file-system is allowed. 231.Pp 232.Ar arg1 233is the 234.Ft struct vnode * 235on which the file-system is to be mounted, 236.Ar arg2 237is an 238.Ft int 239with the mount flags, and 240.Ar arg3 241is a 242.Ft void * 243with file-system specific data, if any. 244.It Dv KAUTH_REQ_SYSTEM_MOUNT_UNMOUNT 245Checks if unmounting a file-system is allowed. 246.Pp 247.Ar arg1 248is a 249.Ft struct mount * 250with the mount in question. 251.It Dv KAUTH_REQ_SYSTEM_MOUNT_UPDATE 252Checks if updating an existing mount is allowed. 253.Pp 254.Ar arg1 255is the 256.Ft struct mount * 257of the existing mount, 258.Ar arg2 259is an 260.Ft int 261with the new mount flags, and 262.Ar arg3 263is a 264.Ft void * 265with file-system specific data, if any. 266.El 267.It Dv KAUTH_SYSTEM_PSET 268Check processor-set manipulation. 269.Pp 270.Ar req 271can be any of the following: 272.Bl -tag -width compact 273.It Dv KAUTH_REQ_SYSTEM_PSET_ASSIGN 274Change processor-set processor assignment. 275.It Dv KAUTH_REQ_SYSTEM_PSET_BIND 276Bind an LWP to a processor-set. 277.It Dv KAUTH_REQ_SYSTEM_PSET_CREATE 278Create a processor-set. 279.It Dv KAUTH_REQ_SYSTEM_PSET_DESTROY 280Destroy a processor-set. 281.El 282.It Dv KAUTH_SYSTEM_REBOOT 283Check if rebooting is allowed. 284.It Dv KAUTH_SYSTEM_SETIDCORE 285Check if changing coredump settings for set-id processes is allowed. 286.It Dv KAUTH_SYSTEM_SWAPCTL 287Check if privileged 288.Xr swapctl 2 289requests are allowed. 290.It Dv KAUTH_SYSTEM_SYSCTL 291This requests operations related to 292.Xr sysctl 9 . 293.Ar req 294indicates the specific request and can be one of the following: 295.Bl -tag -width compact 296.It Dv KAUTH_REQ_SYSTEM_SYSCTL_ADD 297Check if adding a 298.Xr sysctl 9 299node is allowed. 300.It Dv KAUTH_REQ_SYSTEM_SYSCTL_DELETE 301Check if deleting a 302.Xr sysctl 9 303node is allowed. 304.It Dv KAUTH_REQ_SYSTEM_SYSCTL_DESC 305Check if adding description to a 306.Xr sysctl 9 307node is allowed. 308.It Dv KAUTH_REQ_SYSTEM_SYSCTL_MODIFY 309Check if modifying a 310.Xr sysctl 9 311node variable that doesn't have a custom sysctl helper function is allowed. 312.Pp 313This request might be deprecated in the future. 314.It Dv KAUTH_REQ_SYSTEM_SYSCTL_PRVT 315Check if accessing private 316.Xr sysctl 9 317nodes is allowed. 318.El 319.It Dv KAUTH_SYSTEM_TIME 320This request groups time-related operations. 321.Ar req 322can be any of the following: 323.Bl -tag -width compact 324.It Dv KAUTH_REQ_SYSTEM_TIME_ADJTIME 325Check if changing the time using 326.Xr adjtime 2 327is allowed. 328.It Dv KAUTH_REQ_SYSTEM_TIME_NTPADJTIME 329Check if setting the time using 330.Xr ntp_adjtime 2 331is allowed. 332.It Dv KAUTH_REQ_SYSTEM_TIME_SYSTEM 333Check if changing the time (usually via 334.Xr settimeofday 2 ) 335is allowed. 336.Pp 337.Ar arg1 338is a 339.Ft struct timespec * 340with the new time, 341.Ar arg2 342is a 343.Ft struct timeval * 344with the delta from the current time, 345.Ar arg3 346is a 347.Ft bool 348indicating whether the caller is a device context (eg. 349.Pa /dev/clockctl ) 350or not. 351.It Dv KAUTH_REQ_SYSTEM_TIME_RTCOFFSET 352Check if changing the RTC offset is allowed. 353.It Dv KAUTH_REQ_SYSTEM_TIME_TIMECOUNTERS 354Check if manipulating timecounters is allowed. 355.El 356.El 357.Ss Process Scope 358The process scope, 359.Dq org.netbsd.kauth.process , 360manages authorization requests related to processes in the system. 361.Pp 362The authorization wrapper for this scope is declared as 363.Pp 364.Ft int Fn kauth_authorize_process "kauth_cred_t cred" \ 365"kauth_action_t op" "struct proc *p" "void *arg1" "void *arg2" \ 366"void *arg3" 367.Pp 368The following operations are available for this scope: 369.Bl -tag -width compact 370.It Dv KAUTH_PROCESS_KTRACE 371Checks whether an object with one set of credentials can 372.Xr ktrace 1 373another process 374.Ar p , 375possibly with a different set of credentials. 376.Pp 377If 378.Ar arg1 379is 380.Dv KAUTH_REQ_PROCESS_KTRACE_PERSISTENT , 381this checks if persistent tracing can be done. 382Persistent tracing maintains the trace across a set-user-id/set-group-id 383.Xr exec 3 , 384and normally requires privileged credentials. 385.It Dv KAUTH_PROCESS_PROCFS 386Checks whether object with passed credentials can use 387.Em procfs 388to access process 389.Ar p . 390.Pp 391.Ar arg1 392is the 393.Ft struct pfsnode * 394for the target element in the target process, and 395.Ar arg2 396is the access type, which can be either 397.Dv KAUTH_REQ_PROCESS_PROCFS_CTL , 398.Dv KAUTH_REQ_PROCESS_PROCFS_READ , 399.Dv KAUTH_REQ_PROCESS_PROCFS_RW , 400or 401.Dv KAUTH_REQ_PROCESS_PROCFS_WRITE , 402indicating 403.Em control , 404.Em read , 405.Em read-write , 406or 407.Em write 408access respectively. 409.It Dv KAUTH_PROCESS_PTRACE 410Checks whether object with passed credentials can use 411.Xr ptrace 2 412to access process 413.Ar p . 414.Pp 415.Ar arg1 416is the 417.Xr ptrace 2 418command. 419.It Dv KAUTH_PROCESS_CANSEE 420Checks whether an object with one set of credentials can access 421information about another process, possibly with a different set of 422credentials. 423.Pp 424.Ar arg1 425indicates the class of information being viewed, and can either of 426.Dv KAUTH_REQ_PROCESS_CANSEE_ARGS , 427.Dv KAUTH_REQ_PROCESS_CANSEE_ENTRY , 428.Dv KAUTH_REQ_PROCESS_CANSEE_ENV , 429or 430.Dv KAUTH_REQ_PROCESS_CANSEE_OPENFILES . 431.It Dv KAUTH_PROCESS_SCHEDULER_GETAFFINITY 432Checks whether viewing the scheduler affinity is allowed. 433.It Dv KAUTH_PROCESS_SCHEDULER_SETAFFINITY 434Checks whether setting the scheduler affinity is allowed. 435.It Dv KAUTH_PROCESS_SCHEDULER_GETPARAMS 436Checks whether viewing the scheduler policy and parameters is allowed. 437.It Dv KAUTH_PROCESS_SCHEDULER_SETPARAMS 438Checks whether modifying the scheduler policy and parameters is allowed. 439.It Dv KAUTH_PROCESS_SIGNAL 440Checks whether an object with one set of credentials can post signals 441to another process. 442.Pp 443.Ar p 444is the process the signal is being posted to, and 445.Ar arg1 446is the signal number. 447.It Dv KAUTH_PROCESS_CORENAME 448Controls access to process corename. 449.Pp 450.Ar arg1 451can be 452.Dv KAUTH_REQ_PROCESS_CORENAME_GET 453or 454.Dv KAUTH_REQ_PROCESS_CORENAME_SET , 455indicating access to read or write the process' corename, respectively. 456.Pp 457When modifying the corename, 458.Ar arg2 459holds the new corename to be used. 460.It Dv KAUTH_PROCESS_FORK 461Checks if the process can fork. 462.Ar arg1 463is an 464.Ft int 465indicating how many processes exist on the system at the time of the check. 466.It Dv KAUTH_PROCESS_KEVENT_FILTER 467Checks whether setting a process 468.Xr kevent 2 469filter is allowed. 470.Pp 471.It Dv KAUTH_PROCESS_NICE 472Checks whether the 473.Em nice 474value of 475.Ar p 476can be changed to 477.Ar arg1 . 478.It Dv KAUTH_PROCESS_RLIMIT 479Controls access to process resource limits. 480.Pp 481.Ar arg1 482can be 483.Dv KAUTH_REQ_PROCESS_RLIMIT_GET 484or 485.Dv KAUTH_REQ_PROCESS_RLIMIT_SET , 486indicating access to read or write the process' resource limits, respectively. 487.Pp 488When modifying resource limits, 489.Ar arg2 490is the new value to be used and 491.Ar arg3 492indicates which resource limit is to be modified. 493.It Dv KAUTH_PROCESS_SETID 494Check if changing the user- or group-ids, groups, or login-name for 495.Ar p 496is allowed. 497.It Dv KAUTH_PROCESS_STOPFLAG 498Check if setting the stop flags for 499.Xr exec 3 , 500.Xr exit 3 , 501and 502.Xr fork 2 503is allowed. 504.Pp 505.Ar arg1 506indicates the flag, and can be either 507.Dv P_STOPEXEC , 508.Dv P_STOPEXIT , 509or 510.Dv P_STOPFORK 511respectively. 512.El 513.Ss Network Scope 514The network scope, 515.Dq org.netbsd.kauth.network , 516manages networking-related authorization requests in the kernel. 517.Pp 518The authorization wrapper for this scope is declared as 519.Pp 520.Ft int Fn kauth_authorize_network "kauth_cred_t cred" "kauth_action_t op" \ 521"enum kauth_network_req req" "void *arg1" "void *arg2" "void *arg3" 522.Pp 523The following operations are available for this scope: 524.Bl -tag -width compact 525.It Dv KAUTH_NETWORK_ALTQ 526Checks if an ALTQ operation is allowed. 527.Pp 528.Ar req 529indicates the ALTQ subsystem in question, and can be one of the following: 530.Pp 531.Bl -tag -compact -width compact 532.It Dv KAUTH_REQ_NETWORK_ALTQ_AFMAP 533.It Dv KAUTH_REQ_NETWORK_ALTQ_BLUE 534.It Dv KAUTH_REQ_NETWORK_ALTQ_CBQ 535.It Dv KAUTH_REQ_NETWORK_ALTQ_CDNR 536.It Dv KAUTH_REQ_NETWORK_ALTQ_CONF 537.It Dv KAUTH_REQ_NETWORK_ALTQ_FIFOQ 538.It Dv KAUTH_REQ_NETWORK_ALTQ_HFSC 539.It Dv KAUTH_REQ_NETWORK_ALTQ_JOBS 540.It Dv KAUTH_REQ_NETWORK_ALTQ_PRIQ 541.It Dv KAUTH_REQ_NETWORK_ALTQ_RED 542.It Dv KAUTH_REQ_NETWORK_ALTQ_RIO 543.It Dv KAUTH_REQ_NETWORK_ALTQ_WFQ 544.El 545.It Dv KAUTH_NETWORK_BIND 546Checks if a 547.Xr bind 2 548request is allowed. 549.Pp 550.Ar req 551allows to indicate the type of the request to structure listeners and callers 552easier. 553Supported request types: 554.Bl -tag -width compact 555.It Dv KAUTH_REQ_NETWORK_BIND_PORT 556Checks if binding to a non-privileged/reserved port is allowed. 557.It Dv KAUTH_REQ_NETWORK_BIND_PRIVPORT 558Checks if binding to a privileged/reserved port is allowed. 559.El 560.It Dv KAUTH_NETWORK_FIREWALL 561Checks if firewall-related operations are allowed. 562.Pp 563.Ar req 564indicates the sub-action, and can be one of the following: 565.Bl -tag -width compact 566.It Dv KAUTH_REQ_NETWORK_FIREWALL_FW 567Modification of packet filtering rules. 568.It Dv KAUTH_REQ_NETWORK_FIREWALL_NAT 569Modification of NAT rules. 570.El 571.It Dv KAUTH_NETWORK_INTERFACE 572Checks if network interface-related operations are allowed. 573.Pp 574.Ar arg1 575is (optionally) the 576.Ft struct ifnet * 577associated with the interface. 578.Ar arg2 579is (optionally) an 580.Ft int 581describing the interface-specific operation. 582.Ar arg3 583is (optionally) a pointer to the interface-specific request structure. 584.Ar req 585indicates the sub-action, and can be one of the following: 586.Bl -tag -width compact 587.It Dv KAUTH_REQ_NETWORK_INTERFACE_GET 588Check if retrieving information from the device is allowed. 589.It Dv KAUTH_REQ_NETWORK_INTERFACE_GETPRIV 590Check if retrieving privileged information from the device is allowed. 591.It Dv KAUTH_REQ_NETWORK_INTERFACE_SET 592Check if setting parameters on the device is allowed. 593.It Dv KAUTH_REQ_NETWORK_INTERFACE_SETPRIV 594Check if setting privileged parameters on the device is allowed. 595.El 596.Pp 597Note that unless the 598.Ft struct ifnet * 599for the interface was passed in 600.Ar arg1 , 601there's no way to tell what structure 602.Ar arg3 603is. 604.It Dv KAUTH_NETWORK_FORWSRCRT 605Checks whether status of forwarding of source-routed packets can be modified 606or not. 607.It Dv KAUTH_NETWORK_NFS 608Check is an NFS related operation is allowed. 609.Pp 610.Ar req 611can be any of the following: 612.Bl -tag -width compact 613.It Dv KAUTH_REQ_NETWORK_NFS_EXPORT 614Check if modifying the NFS export table is allowed. 615.It Dv KAUTH_REQ_NETWORK_NFS_SVC 616Check if access to the NFS 617.Xr nfssvc 2 618syscall is allowed. 619.El 620.It Dv KAUTH_NETWORK_ROUTE 621Checks if a routing-related request is allowed. 622.Pp 623.Ar arg1 624is the 625.Ft struct rt_msghdr * 626for the request. 627.It Dv KAUTH_NETWORK_SOCKET 628Checks if a socket related operation is allowed. 629.Pp 630.Ar req 631allows to indicate the type of the request to structure listeners and callers 632easier. 633Supported request types: 634.Bl -tag -width compact 635.It Dv KAUTH_REQ_NETWORK_SOCKET_RAWSOCK 636Checks if opening a raw socket is allowed. 637.It Dv KAUTH_REQ_NETWORK_SOCKET_OPEN 638Checks if opening a socket is allowed. 639.Ar arg1 , arg2 , 640and 641.Ar arg3 642are all 643.Ft int 644parameters describing the domain, socket type, and protocol, 645respectively. 646.It Dv KAUTH_REQ_NETWORK_SOCKET_CANSEE 647Checks if looking at the socket passed is allowed. 648.Pp 649.Ar arg1 650is a 651.Ft struct socket * 652describing the socket. 653.It Dv KAUTH_REQ_NETWORK_SOCKET_DROP 654Checks if a connection can be dropped. 655.Pp 656.Ar arg1 657is a 658.Ft struct socket * 659describing the socket. 660.It Dv KAUTH_REQ_NETWORK_SOCKET_SETPRIV 661Checks if setting privileged socket options is allowed. 662.Pp 663.Ar arg1 664is a 665.Ft struct socket * 666describing the socket, 667.Ar arg2 668is a 669.Ft u_long 670describing the socket option. 671.El 672.El 673.Ss Machine-dependent Scope 674The machine-dependent (machdep) scope, 675.Dq org.netbsd.kauth.machdep , 676manages machine-dependent authorization requests in the kernel. 677.Pp 678The authorization wrapper for this scope is declared as 679.Pp 680.Ft int Fn kauth_authorize_machdep "kauth_cred_t cred" "kauth_action_t op" \ 681"void *arg0" "void *arg1" "void *arg2" "void *arg3" 682.Pp 683The actions on this scope provide a set that may or may not affect all 684platforms. 685Below is a list of available actions, along with which platforms are affected 686by each. 687.Bl -tag -width compact 688.It Dv KAUTH_MACHDEP_CACHEFLUSH 689Request to flush the whole CPU cache. 690Affects 691.Em m68k 692Linux emulation. 693.It Dv KAUTH_MACHDEP_IOPERM_GET 694Request to get the I/O permission level. 695Affects 696.Em amd64 , 697.Em i386 , 698.Em xen . 699.It Dv KAUTH_MACHDEP_IOPERM_SET 700Request to set the I/O permission level. 701Affects 702.Em amd64 , 703.Em i386 , 704.Em xen . 705.It Dv KAUTH_MACHDEP_IOPL 706Request to set the I/O privilege level. 707Affects 708.Em amd64 , 709.Em i386 , 710.Em xen . 711.It Dv KAUTH_MACHDEP_LDT_GET 712Request to get the LDT (local descriptor table). 713Affects 714.Em amd64 , 715.Em i386 , 716.Em xen . 717.It Dv KAUTH_MACHDEP_LDT_SET 718Request to set the LDT (local descriptor table). 719Affects 720.Em amd64 , 721.Em i386 , 722.Em xen . 723.It Dv KAUTH_MACHDEP_MTRR_GET 724Request to get the MTRR (memory type range registers). 725Affects 726.Em amd64 , 727.Em i386 , 728.Em xen . 729.It Dv KAUTH_MACHDEP_MTRR_SET 730Request to set the MTRR (memory type range registers). 731Affects 732.Em amd64 , 733.Em i386 , 734.Em xen . 735.It Dv KAUTH_MACHDEP_NVRAM 736Request to access (read/write) the NVRAM. 737Affects 738.Em i386 . 739.It Dv KAUTH_MACHDEP_UNMANAGEDMEM 740Request to access unmanaged memory. 741Affects 742.Em alpha , 743.Em amd64 , 744.Em arm , 745.Em i386 , 746.Em powerpc , 747.Em sh3 , 748.Em vax , 749.Em xen . 750.El 751.Ss Device Scope 752The device scope, 753.Dq org.netbsd.kauth.device , 754manages authorization requests related to devices on the system. 755Devices can be, for example, terminals, tape drives, and any other hardware. 756Network devices specifically are handled by the 757.Em network 758scope. 759.Pp 760In addition to the standard authorization wrapper: 761.Pp 762.Ft int Fn kauth_authorize_device "kauth_cred_t cred" "kauth_action_t op" \ 763"void *arg0" "void *arg1" "void *arg2" "void *arg3" 764.Pp 765this scope provides authorization wrappers for various device types. 766.Pp 767.Ft int Fn kauth_authorize_device_tty "kauth_cred_t cred" "kauth_action_t op" \ 768"struct tty *tty" 769.Pp 770Authorizes requests for 771.Em terminal devices 772on the system. 773The third argument, 774.Ar tty , 775is the terminal device in question. 776It is passed to the listener as 777.Ar arg0 . 778The second argument, 779.Ar op , 780is the action and can be one of the following: 781.Bl -tag -width compact 782.It Dv KAUTH_DEVICE_TTY_OPEN 783Open the terminal device pointed to by 784.Ar tty . 785.It Dv KAUTH_DEVICE_TTY_PRIVSET 786Set privileged settings on the terminal device pointed to by 787.Ar tty . 788.It Dv KAUTH_DEVICE_TTY_STI 789Use the 790.Dq TIOCSTI 791device 792.Xr ioctl 2 , 793allowing to inject characters into the terminal buffer, simulating terminal 794input. 795.El 796.Pp 797.Ft int Fn kauth_authorize_device_spec "kauth_cred_t cred" \ 798"enum kauth_device_req req" "struct vnode *vp" 799.Pp 800Authorizes requests for 801.Em special files , 802usually disk devices, but also direct memory access, on the system. 803.Pp 804It passes 805.Dv KAUTH_DEVICE_RAWIO_SPEC 806as the action to the listener, and accepts two arguments. 807.Ar req , 808passed to the listener as 809.Ar arg0 , 810is access requested, and can be one of 811.Dv KAUTH_REQ_DEVICE_RAWIO_SPEC_READ , 812.Dv KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE , 813or 814.Dv KAUTH_REQ_DEVICE_RAWIO_SPEC_RW , 815representing read, write, or both read/write access respectively. 816.Ar vp 817is the vnode of the special file in question, and is passed to the listener as 818.Ar arg1 . 819.Pp 820Keep in mind that it is the responsibility of the security model developer to 821check whether the underlying device is a disk or the system memory, using 822.Fn iskmemdev : 823.Bd -literal -offset indent 824if ((vp-\*[Gt]v_type == VCHR) \*[Am]\*[Am] 825 iskmemdev(vp-\*[Gt]v_un.vu_specinfo-\*[Gt]si_rdev)) 826 /* system memory access */ 827.Ed 828.Pp 829.Ft int Fn kauth_authorize_device_passthru "kauth_cred_t cred" "dev_t dev" \ 830"u_long mode" "void *data" 831.Pp 832Authorizes hardware 833.Em passthru 834requests, or user commands passed directly to the hardware. 835These have the potential of resulting in direct disk and/or memory access. 836.Pp 837It passes 838.Dv KAUTH_DEVICE_RAWIO_PASSTHRU 839as the action to the listener, and accepts three arguments. 840.Ar dev , 841passed as 842.Ar arg1 843to the listener, is the device for which the request is made. 844.Ar mode , 845passed as 846.Ar arg0 847to the listener, is a generic representation of the access mode requested. 848It can be one or more (binary-OR'd) of the following: 849.Pp 850.Bl -tag -width compact -offset indent -compact 851.It KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READ 852.It KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READCONF 853.It KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_WRITE 854.It KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_WRITECONF 855.El 856.Pp 857.Ar data , 858passed as 859.Ar arg2 860to the listener, is device-specific data that may be associated with the 861request. 862.Ss Credentials Scope 863The credentials scope, 864.Dq org.netbsd.kauth.cred , 865is a special scope used internally by the 866.Nm 867framework to provide hooking to credential-related operations. 868.Pp 869It is a 870.Dq notify-only 871scope, allowing hooking operations such as initialization of new credentials, 872credential inheritance during a fork, and copying and freeing of credentials. 873The main purpose for this scope is to give a security model a way to control 874the aforementioned operations, especially in cases where the credentials 875hold security model-private data. 876.Pp 877Notifications are made using the following function, which is internal to 878.Nm : 879.Pp 880.Ft int Fn kauth_cred_hook "kauth_cred_t cred" "kauth_action_t action" \ 881"void *arg0" "void *arg1" 882.Pp 883With the following actions: 884.Bl -tag -width compact 885.It Dv KAUTH_CRED_COPY 886The credentials are being copied. 887.Ar cred 888are the credentials of the lwp context doing the copy, and 889.Ar arg0 890and 891.Ar arg1 892are both 893.Ft kauth_cred_t 894representing the 895.Dq from 896and 897.Dq to 898credentials, respectively. 899.It Dv KAUTH_CRED_FORK 900The credentials are being inherited from a parent to a child process during a 901fork. 902.Pp 903.Ar cred 904are the credentials of the lwp context doing the fork, and 905.Ar arg0 906and 907.Ar arg1 908are both 909.Ft struct proc * 910of the parent and child processes, respectively. 911.It Dv KAUTH_CRED_FREE 912The credentials in 913.Ar cred 914are being freed. 915.It Dv KAUTH_CRED_INIT 916The credentials in 917.Ar cred 918are being initialized. 919.El 920.Pp 921Since this is a notify-only scope, all listeners are required to return 922.Dv KAUTH_RESULT_ALLOW . 923.Ss Credentials Accessors and Mutators 924.Nm 925has a variety of accessor and mutator routines to handle 926.Ft kauth_cred_t 927objects. 928.Pp 929The following routines can be used to access and modify the user- and 930group-ids in a 931.Ft kauth_cred_t : 932.Bl -tag -width compact 933.It Ft uid_t Fn kauth_cred_getuid "kauth_cred_t cred" 934Returns the real user-id from 935.Ar cred . 936.It Ft uid_t Fn kauth_cred_geteuid "kauth_cred_t cred" 937Returns the effective user-id from 938.Ar cred . 939.It Ft uid_t Fn kauth_cred_getsvuid "kauth_cred_t cred" 940Returns the saved user-id from 941.Ar cred . 942.It Ft void Fn kauth_cred_setuid "kauth_cred_t cred" "uid_t uid" 943Sets the real user-id in 944.Ar cred 945to 946.Ar uid . 947.It Ft void Fn kauth_cred_seteuid "kauth_cred_t cred" "uid_t uid" 948Sets the effective user-id in 949.Ar cred 950to 951.Ar uid . 952.It Ft void Fn kauth_cred_setsvuid "kauth_cred_t cred" "uid_t uid" 953Sets the saved user-id in 954.Ar cred 955to 956.Ar uid . 957.It Ft gid_t Fn kauth_cred_getgid "kauth_cred_t cred" 958Returns the real group-id from 959.Ar cred . 960.It Ft gid_t Fn kauth_cred_getegid "kauth_cred_t cred" 961Returns the effective group-id from 962.Ar cred . 963.It Ft gid_t Fn kauth_cred_getsvgid "kauth_cred_t cred" 964Returns the saved group-id from 965.Ar cred . 966.It Ft void Fn kauth_cred_setgid "kauth_cred_t cred" "gid_t gid" 967Sets the real group-id in 968.Ar cred 969to 970.Ar gid . 971.It Ft void Fn kauth_cred_setegid "kauth_cred_t cred" "gid_t gid" 972Sets the effective group-id in 973.Ar cred 974to 975.Ar gid . 976.It Ft void Fn kauth_cred_setsvgid "kauth_cred_t cred" "gid_t gid" 977Sets the saved group-id in 978.Ar cred 979to 980.Ar gid . 981.It Ft u_int Fn kauth_cred_getrefcnt "kauth_cred_t cred" 982Return the reference count for 983.Ar cred . 984.El 985.Pp 986The following routines can be used to access and modify the group 987list in a 988.Ft kauth_cred_t : 989.Bl -tag -width compact 990.It Ft int Fn kauth_cred_ismember_gid "kauth_cred_t cred" "gid_t gid" \ 991"int *resultp" 992Checks if the group-id 993.Ar gid 994is a member in the group list of 995.Ar cred . 996.Pp 997If it is, 998.Ar resultp 999will be set to one, otherwise, to zero. 1000.Pp 1001The return value is an error code, or zero for success. 1002.It Ft u_int Fn kauth_cred_ngroups "kauth_cred_t cred" 1003Return the number of groups in the group list of 1004.Ar cred . 1005.It Ft gid_t Fn kauth_cred_group "kauth_cred_t cred" "u_int idx" 1006Return the group-id of the group at index 1007.Ar idx 1008in the group list of 1009.Ar cred . 1010.It Ft int Fn kauth_cred_setgroups "kauth_cred_t cred" "const gid_t *groups" \ 1011"size_t ngroups" "uid_t gmuid" "enum uio_seg seg" 1012Copy 1013.Ar ngroups 1014groups from array pointed to by 1015.Ar groups 1016to the group list in 1017.Ar cred , 1018adjusting the number of groups in 1019.Ar cred 1020appropriately. 1021.Ar seg 1022should be either 1023.Dv UIO_USERSPACE 1024or 1025.Dv UIO_SYSSPACE 1026indicating whether 1027.Ar groups 1028is a user or kernel space address. 1029.Pp 1030Any groups remaining will be set to an invalid value. 1031.Pp 1032.Ar gmuid 1033is unused for now, and to maintain interface compatibility with the Darwin 1034KPI. 1035.Pp 1036The return value is an error code, or zero for success. 1037.It Ft int Fn kauth_cred_getgroups "kauth_cred_t cred" "gid_t *groups" \ 1038"size_t ngroups" "enum uio_seg seg" 1039Copy 1040.Ar ngroups 1041groups from the group list in 1042.Ar cred 1043to the buffer pointed to by 1044.Ar groups . 1045.Ar seg 1046should be either 1047.Dv UIO_USERSPACE 1048or 1049.Dv UIO_SYSSPACE 1050indicating whether 1051.Ar groups 1052is a user or kernel space address. 1053.Pp 1054The return value is an error code, or zero for success. 1055.El 1056.Ss Credential Private Data 1057.Nm 1058provides an interface to allow attaching security-model private data to 1059credentials. 1060.Pp 1061The use of this interface has two parts that can be divided to direct and 1062indirect control of the private-data. 1063Directly controlling the private data is done by using the below routines, 1064while the indirect control is often dictated by events such as process 1065fork, and is handled by listening on the credentials scope (see above). 1066.Pp 1067Attaching private data to credentials works by registering a key to serve 1068as a unique identifier, distinguishing various sets of private data that 1069may be associated with the credentials. 1070Registering, and deregistering, a key is done by using these routines: 1071.Pp 1072.Bl -tag -width compact 1073.It Ft int Fn kauth_register_key "const char *name" "kauth_key_t *keyp" 1074Register new key for private data for 1075.Ar name 1076(usually, the security model name). 1077.Ar keyp 1078will be used to return the key to be used in further calls. 1079.Pp 1080The function returns 0 on success and an error code (see 1081.Xr errno 2 ) 1082on failure. 1083.It Ft int Fn kauth_deregister_key "kauth_key_t key" 1084Deregister private data key 1085.Ar key . 1086.El 1087.Pp 1088Once registered, private data may be manipulated by the following routines: 1089.Bl -tag -width compact 1090.It Ft void Fn kauth_cred_setdata "kauth_cred_t cred" "kauth_key_t key" \ 1091"void *data" 1092Set private data for 1093.Ar key 1094in 1095.Ar cred 1096to be 1097.Ar data . 1098.It Ft void * Fn kauth_cred_getdata "kauth_cred_t cred" "kauth_key_t key" 1099Retrieve private data for 1100.Ar key 1101in 1102.Ar cred . 1103.El 1104.Pp 1105Note that it is required to use the above routines every time the private 1106data is changed, i.e., using 1107.Fn kauth_cred_getdata 1108and later modifying the private data should be accompanied by a call to 1109.Fn kauth_cred_setdata 1110with the 1111.Dq new 1112private data. 1113.Ss Credential Inheritance and Reference Counting 1114.Nm 1115provides an interface for handling shared credentials. 1116.Pp 1117When a 1118.Ft kauth_cred_t 1119is first allocated, its reference count is set to 1. 1120However, with time, its reference count can grow as more objects (processes, 1121LWPs, files, etc.) reference it. 1122.Pp 1123The following routines are available for managing credentials reference 1124counting: 1125.Bl -tag -width compact 1126.It Ft void Fn kauth_cred_hold "kauth_cred_t cred" 1127Increases reference count to 1128.Ar cred 1129by one. 1130.It Ft void Fn kauth_cred_free "kauth_cred_t cred" 1131Decreases the reference count to 1132.Ar cred 1133by one. 1134.Pp 1135If the reference count dropped to zero, the memory used by 1136.Ar cred 1137will be freed. 1138.El 1139.Pp 1140Credential inheritance happens during a 1141.Xr fork 2 , 1142and is handled by the following function: 1143.Pp 1144.Ft void Fn kauth_proc_fork "struct proc *parent" "struct proc *child" 1145.Pp 1146When called, it references the parent's credentials from the child, 1147and calls the credentials scope's hook with the 1148.Dv KAUTH_CRED_FORK 1149action to allow security model-specific handling of the inheritance 1150to take place. 1151.Ss Credentials Memory Management 1152Data-structures for credentials, listeners, and scopes are allocated from 1153memory pools managed by the 1154.Xr pool 9 1155subsystem. 1156.Pp 1157The 1158.Ft kauth_cred_t 1159objects have their own memory management routines: 1160.Bl -tag -width compact 1161.It Ft kauth_cred_t Fn kauth_cred_alloc "void" 1162Allocates a new 1163.Ft kauth_cred_t , 1164initializes its lock, and sets its reference count to one. 1165.El 1166.Ss Conversion Routines 1167Sometimes it might be necessary to convert a 1168.Ft kauth_cred_t 1169to userland's view of credentials, a 1170.Ft struct uucred , 1171or vice versa. 1172.Pp 1173The following routines are available for these cases: 1174.Bl -tag -width compact 1175.It Ft void Fn kauth_uucred_to_cred "kauth_cred_t cred" "const struct uucred *uucred" 1176Convert userland's view of credentials to a 1177.Ft kauth_cred_t . 1178.Pp 1179This includes effective user- and group-ids, a number of groups, and a group 1180list. 1181The reference count is set to one. 1182.Pp 1183Note that 1184.Nm 1185will try to copy as many groups as can be held inside a 1186.Ft kauth_cred_t . 1187.It Ft void Fn kauth_cred_to_uucred "struct uucred *uucred" "const kauth_cred_t cred" 1188Convert 1189.Ft kauth_cred_t 1190to userland's view of credentials. 1191.Pp 1192This includes effective user- and group-ids, a number of groups, and a group 1193list. 1194.Pp 1195Note that 1196.Nm 1197will try to copy as many groups as can be held inside a 1198.Ft struct uucred . 1199.It Ft int Fn kauth_cred_uucmp "kauth_cred_t cred" "struct uucred *uucred" 1200Compares 1201.Ar cred 1202with the userland credentials in 1203.Ar uucred . 1204.Pp 1205Common values that will be compared are effective user- and group-ids, and 1206the group list. 1207.El 1208.Ss Miscellaneous Routines 1209Other routines provided by 1210.Nm 1211are: 1212.Bl -tag -width compact 1213.It Ft void Fn kauth_cred_clone "kauth_cred_t cred1" "kauth_cred_t cred2" 1214Clone credentials from 1215.Ar cred1 1216to 1217.Ar cred2 , 1218except for the lock and reference count. 1219.Pp 1220.It Ft kauth_cred_t Fn kauth_cred_dup "kauth_cred_t cred" 1221Duplicate 1222.Ar cred . 1223.Pp 1224What this routine does is call 1225.Fn kauth_cred_alloc 1226followed by a call to 1227.Fn kauth_cred_clone . 1228.It Ft kauth_cred_t Fn kauth_cred_copy "kauth_cred_t cred" 1229Works like 1230.Fn kauth_cred_dup , 1231except for a few differences. 1232.Pp 1233If 1234.Ar cred 1235already has a reference count of one, it will be returned. 1236Otherwise, a new 1237.Ft kauth_cred_t 1238will be allocated and the credentials from 1239.Ar cred 1240will be cloned to it. 1241Last, a call to 1242.Fn kauth_cred_free 1243for 1244.Ar cred 1245will be done. 1246.It Ft kauth_cred_t Fn kauth_cred_get "void" 1247Return the credentials associated with the current LWP. 1248.El 1249.Ss Scope Management 1250.Nm 1251provides routines to manage the creation and deletion of scopes on the 1252system. 1253.Pp 1254Note that the built-in scopes, the 1255.Dq generic 1256scope and the 1257.Dq process 1258scope, can't be deleted. 1259.Bl -tag -width compact 1260.It Ft kauth_scope_t Fn kauth_register_scope "const char *id" \ 1261"kauth_scope_callback_t cb" "void *cookie" 1262Register a new scope on the system. 1263.Ar id 1264is the name of the scope, usually in reverse DNS-like notation. 1265For example, 1266.Dq org.netbsd.kauth.myscope . 1267.Ar cb 1268is the default listener, to which authorization requests for this scope 1269will be dispatched to. 1270.Ar cookie 1271is optional user-data that will be passed to all listeners 1272during authorization on the scope. 1273.It Ft void Fn kauth_deregister_scope "kauth_scope_t scope" 1274Deregister 1275.Ar scope 1276from the scopes available on the system, and free the 1277.Ft kauth_scope_t 1278object 1279.Ar scope . 1280.El 1281.Ss Listener Management 1282Listeners in 1283.Nm 1284are authorization callbacks that are called during an authorization 1285request in the scope which they belong to. 1286.Pp 1287When an authorization request is made, all listeners associated with 1288a scope are called to allow, deny, or defer the request. 1289.Pp 1290It is enough for one listener to deny the request in order for the 1291request to be denied; but all listeners are called during an authorization 1292process none-the-less. 1293All listeners are required to allow the request for it to be granted, 1294and in a case where all listeners defer the request -- leaving the decision 1295for other listeners -- the request is denied. 1296.Pp 1297The following KPI is provided for the management of listeners: 1298.Bl -tag -width compact 1299.It Ft kauth_listener_t Fn kauth_listen_scope "const char *id" \ 1300"kauth_scope_callback_t cb" "void *cookie" 1301Create a new listener on the scope with the id 1302.Ar id , 1303setting the default listener to 1304.Ar cb . 1305.Ar cookie 1306is optional user-data that will be passed to the listener when called 1307during an authorization request. 1308.It Ft void Fn kauth_unlisten_scope "kauth_listener_t listener" 1309Removes 1310.Ar listener 1311from the scope which it belongs to, ensuring it won't be called again, 1312and frees the 1313.Ft kauth_listener_t 1314object 1315.Ar listener . 1316.El 1317.Pp 1318.Nm 1319provides no means for synchronization within listeners. 1320It is the the programmer's responsibility to make sure data used by the 1321listener is properly locked during its use, as it can be accessed 1322simultaneously from the same listener called multiple times. 1323It is also the programmer's responsibility to do garbage collection after 1324the listener, possibly freeing any allocated data it used. 1325.Pp 1326The common method to do the above is by having a reference count to 1327each listener. 1328On entry to the listener, this reference count should be raised, and 1329on exit -- lowered. 1330.Pp 1331During the removal of a listener, first 1332.Fn kauth_scope_unlisten 1333should be called to make sure the listener code will not be entered in 1334the future. 1335Then, the code should wait (possibly sleeping) until the reference count 1336drops to zero. 1337When that happens, it is safe to do the final cleanup. 1338.Pp 1339Listeners might sleep, so no locks can be held when calling an authorization 1340wrapper. 1341.Sh EXAMPLES 1342Older code had no abstraction of the security model, so most privilege 1343checks looked like this: 1344.Bd -literal -offset indent 1345if (suser(cred, \*[Am]acflag) == 0) 1346 /* allow privileged operation */ 1347.Ed 1348.Pp 1349Using the new interface, you must ask for a specific privilege explicitly. 1350For example, checking whether it is possible to open a socket would look 1351something like this: 1352.Bd -literal -offset indent 1353if (kauth_authorize_network(cred, KAUTH_NETWORK_SOCKET, 1354 KAUTH_REQ_NETWORK_SOCKET_OPEN, PF_INET, SOCK_STREAM, 1355 IPPROTO_TCP) == 0) 1356 /* allow opening the socket */ 1357.Ed 1358.Pp 1359Note that the 1360.Em securelevel 1361implications were also integrated into the 1362.Nm 1363framework so you don't have to note anything special in the call to the 1364authorization wrapper, but rather just have to make sure the security 1365model handles the request as you expect it to. 1366.Pp 1367To do that you can just 1368.Xr grep 1 1369in the relevant security model directory and have a look at the code. 1370.Sh EXTENDING KAUTH 1371Although 1372.Nm 1373provides a large set of both detailed and more or less generic requests, 1374it might be needed eventually to introduce more scopes, actions, or 1375requests. 1376.Pp 1377Adding a new scope should happen only when an entire subsystem is 1378introduced and it is assumed other parts of the kernel may want to 1379interfere with its inner-workings. 1380When a subsystem that has the potential of impacting the security 1381of the system is introduced, existing security modules must be updated 1382to also handle actions on the newly added scope. 1383.Pp 1384New actions should be added when sets of operations not covered at all 1385belong in an already existing scope. 1386.Pp 1387Requests (or sub-actions) can be added as subsets of existing actions 1388when an operation that belongs in an already covered area is introduced. 1389.Pp 1390Note that all additions should include updates to this manual, the 1391security models shipped with 1392.Nx , 1393and the example skeleton security model. 1394.Sh SEE ALSO 1395.Xr secmodel 9 1396.Sh HISTORY 1397The kernel authorization framework first appeared in Mac OS X 10.4. 1398.Pp 1399The kernel authorization framework in 1400.Nx 1401first appeared in 1402.Nx 4.0 , 1403and is a clean-room implementation based on Apple TN2127, available at 1404http://developer.apple.com/technotes/tn2005/tn2127.html 1405.Sh NOTES 1406As 1407.Nm 1408in 1409.Nx 1410is still under active development, it is likely that the ABI, and possibly the 1411API, will differ between 1412.Nx 1413versions. 1414Developers are to take notice of this fact in order to avoid building code 1415that expects one version of the ABI and running it in a system with a different 1416one. 1417.Sh AUTHORS 1418.An Elad Efrat Aq elad@NetBSD.org 1419implemented the kernel authorization framework in 1420.Nx . 1421.Pp 1422.An Jason R. Thorpe Aq thorpej@NetBSD.org 1423provided guidance and answered questions about the Darwin implementation. 1424.Sh ONE MORE THING 1425The 1426.Nm 1427framework is dedicated to Brian Mitchell, one of the most talented people 1428I know. 1429Thanks for everything. 1430