1 /* $NetBSD: kern_auth.c,v 1.26 2006/10/02 16:29:57 elad Exp $ */ 2 3 /*- 4 * Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by Elad Efrat. 18 * 4. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * Todo: 35 * - Garbage collection to pool_put() unused scopes/listeners. 36 */ 37 38 #include <sys/cdefs.h> 39 __KERNEL_RCSID(0, "$NetBSD: kern_auth.c,v 1.26 2006/10/02 16:29:57 elad Exp $"); 40 41 #include <sys/types.h> 42 #include <sys/param.h> 43 #include <sys/queue.h> 44 #include <sys/time.h> 45 #include <sys/proc.h> 46 #include <sys/ucred.h> 47 #include <sys/pool.h> 48 #include <sys/kauth.h> 49 #include <sys/acct.h> 50 #include <sys/sysctl.h> 51 52 /* 53 * Credentials. 54 */ 55 struct kauth_cred { 56 struct simplelock cr_lock; /* lock on cr_refcnt */ 57 u_int cr_refcnt; /* reference count */ 58 uid_t cr_uid; /* user id */ 59 uid_t cr_euid; /* effective user id */ 60 uid_t cr_svuid; /* saved effective user id */ 61 gid_t cr_gid; /* group id */ 62 gid_t cr_egid; /* effective group id */ 63 gid_t cr_svgid; /* saved effective group id */ 64 u_int cr_ngroups; /* number of groups */ 65 gid_t cr_groups[NGROUPS]; /* group memberships */ 66 }; 67 68 /* 69 * Listener. 70 */ 71 struct kauth_listener { 72 kauth_scope_callback_t func; /* callback */ 73 kauth_scope_t scope; /* scope backpointer */ 74 u_int refcnt; /* reference count */ 75 SIMPLEQ_ENTRY(kauth_listener) listener_next; /* listener list */ 76 }; 77 78 /* 79 * Scope. 80 */ 81 struct kauth_scope { 82 const char *id; /* scope name */ 83 void *cookie; /* user cookie */ 84 u_int nlisteners; /* # of listeners */ 85 SIMPLEQ_HEAD(, kauth_listener) listenq; /* listener list */ 86 SIMPLEQ_ENTRY(kauth_scope) next_scope; /* scope list */ 87 }; 88 89 static POOL_INIT(kauth_scope_pool, sizeof(struct kauth_scope), 0, 0, 0, 90 "kauth_scopepl", &pool_allocator_nointr); 91 static POOL_INIT(kauth_listener_pool, sizeof(struct kauth_listener), 0, 0, 0, 92 "kauth_listenerpl", &pool_allocator_nointr); 93 static POOL_INIT(kauth_cred_pool, sizeof(struct kauth_cred), 0, 0, 0, 94 "kauth_credpl", &pool_allocator_nointr); 95 96 /* List of scopes and its lock. */ 97 static SIMPLEQ_HEAD(, kauth_scope) scope_list; 98 static struct simplelock scopes_lock; 99 100 /* Built-in scopes: generic, process. */ 101 static kauth_scope_t kauth_builtin_scope_generic; 102 static kauth_scope_t kauth_builtin_scope_system; 103 static kauth_scope_t kauth_builtin_scope_process; 104 static kauth_scope_t kauth_builtin_scope_network; 105 static kauth_scope_t kauth_builtin_scope_machdep; 106 static kauth_scope_t kauth_builtin_scope_device; 107 108 static boolean_t listeners_have_been_loaded = FALSE; 109 110 /* Allocate new, empty kauth credentials. */ 111 kauth_cred_t 112 kauth_cred_alloc(void) 113 { 114 kauth_cred_t cred; 115 116 cred = pool_get(&kauth_cred_pool, PR_WAITOK); 117 memset(cred, 0, sizeof(*cred)); 118 simple_lock_init(&cred->cr_lock); 119 cred->cr_refcnt = 1; 120 121 return (cred); 122 } 123 124 /* Increment reference count to cred. */ 125 void 126 kauth_cred_hold(kauth_cred_t cred) 127 { 128 KASSERT(cred != NULL); 129 KASSERT(cred->cr_refcnt > 0); 130 131 simple_lock(&cred->cr_lock); 132 cred->cr_refcnt++; 133 simple_unlock(&cred->cr_lock); 134 } 135 136 /* Decrease reference count to cred. If reached zero, free it. */ 137 void 138 kauth_cred_free(kauth_cred_t cred) 139 { 140 u_int refcnt; 141 142 KASSERT(cred != NULL); 143 KASSERT(cred->cr_refcnt > 0); 144 145 simple_lock(&cred->cr_lock); 146 refcnt = --cred->cr_refcnt; 147 simple_unlock(&cred->cr_lock); 148 149 if (refcnt == 0) 150 pool_put(&kauth_cred_pool, cred); 151 } 152 153 void 154 kauth_cred_clone(kauth_cred_t from, kauth_cred_t to) 155 { 156 KASSERT(from != NULL); 157 KASSERT(to != NULL); 158 KASSERT(from->cr_refcnt > 0); 159 160 to->cr_uid = from->cr_uid; 161 to->cr_euid = from->cr_euid; 162 to->cr_svuid = from->cr_svuid; 163 to->cr_gid = from->cr_gid; 164 to->cr_egid = from->cr_egid; 165 to->cr_svgid = from->cr_svgid; 166 to->cr_ngroups = from->cr_ngroups; 167 memcpy(to->cr_groups, from->cr_groups, sizeof(to->cr_groups)); 168 } 169 170 /* 171 * Duplicate cred and return a new kauth_cred_t. 172 */ 173 kauth_cred_t 174 kauth_cred_dup(kauth_cred_t cred) 175 { 176 kauth_cred_t new_cred; 177 178 KASSERT(cred != NULL); 179 KASSERT(cred->cr_refcnt > 0); 180 181 new_cred = kauth_cred_alloc(); 182 183 kauth_cred_clone(cred, new_cred); 184 185 return (new_cred); 186 } 187 188 /* 189 * Similar to crcopy(), only on a kauth_cred_t. 190 * XXX: Is this even needed? [kauth_cred_copy] 191 */ 192 kauth_cred_t 193 kauth_cred_copy(kauth_cred_t cred) 194 { 195 kauth_cred_t new_cred; 196 197 KASSERT(cred != NULL); 198 KASSERT(cred->cr_refcnt > 0); 199 200 /* If the provided credentials already have one reference, use them. */ 201 if (cred->cr_refcnt == 1) 202 return (cred); 203 204 new_cred = kauth_cred_alloc(); 205 206 kauth_cred_clone(cred, new_cred); 207 208 kauth_cred_free(cred); 209 210 return (new_cred); 211 } 212 213 uid_t 214 kauth_cred_getuid(kauth_cred_t cred) 215 { 216 KASSERT(cred != NULL); 217 218 return (cred->cr_uid); 219 } 220 221 uid_t 222 kauth_cred_geteuid(kauth_cred_t cred) 223 { 224 KASSERT(cred != NULL); 225 226 return (cred->cr_euid); 227 } 228 229 uid_t 230 kauth_cred_getsvuid(kauth_cred_t cred) 231 { 232 KASSERT(cred != NULL); 233 234 return (cred->cr_svuid); 235 } 236 237 gid_t 238 kauth_cred_getgid(kauth_cred_t cred) 239 { 240 KASSERT(cred != NULL); 241 242 return (cred->cr_gid); 243 } 244 245 gid_t 246 kauth_cred_getegid(kauth_cred_t cred) 247 { 248 KASSERT(cred != NULL); 249 250 return (cred->cr_egid); 251 } 252 253 gid_t 254 kauth_cred_getsvgid(kauth_cred_t cred) 255 { 256 KASSERT(cred != NULL); 257 258 return (cred->cr_svgid); 259 } 260 261 void 262 kauth_cred_setuid(kauth_cred_t cred, uid_t uid) 263 { 264 KASSERT(cred != NULL); 265 KASSERT(cred->cr_refcnt == 1); 266 267 cred->cr_uid = uid; 268 } 269 270 void 271 kauth_cred_seteuid(kauth_cred_t cred, uid_t uid) 272 { 273 KASSERT(cred != NULL); 274 KASSERT(cred->cr_refcnt == 1); 275 276 cred->cr_euid = uid; 277 } 278 279 void 280 kauth_cred_setsvuid(kauth_cred_t cred, uid_t uid) 281 { 282 KASSERT(cred != NULL); 283 KASSERT(cred->cr_refcnt == 1); 284 285 cred->cr_svuid = uid; 286 } 287 288 void 289 kauth_cred_setgid(kauth_cred_t cred, gid_t gid) 290 { 291 KASSERT(cred != NULL); 292 KASSERT(cred->cr_refcnt == 1); 293 294 cred->cr_gid = gid; 295 } 296 297 void 298 kauth_cred_setegid(kauth_cred_t cred, gid_t gid) 299 { 300 KASSERT(cred != NULL); 301 KASSERT(cred->cr_refcnt == 1); 302 303 cred->cr_egid = gid; 304 } 305 306 void 307 kauth_cred_setsvgid(kauth_cred_t cred, gid_t gid) 308 { 309 KASSERT(cred != NULL); 310 KASSERT(cred->cr_refcnt == 1); 311 312 cred->cr_svgid = gid; 313 } 314 315 /* Checks if gid is a member of the groups in cred. */ 316 int 317 kauth_cred_ismember_gid(kauth_cred_t cred, gid_t gid, int *resultp) 318 { 319 int i; 320 321 KASSERT(cred != NULL); 322 KASSERT(resultp != NULL); 323 324 *resultp = 0; 325 326 for (i = 0; i < cred->cr_ngroups; i++) 327 if (cred->cr_groups[i] == gid) { 328 *resultp = 1; 329 break; 330 } 331 332 return (0); 333 } 334 335 u_int 336 kauth_cred_ngroups(kauth_cred_t cred) 337 { 338 KASSERT(cred != NULL); 339 340 return (cred->cr_ngroups); 341 } 342 343 /* 344 * Return the group at index idx from the groups in cred. 345 */ 346 gid_t 347 kauth_cred_group(kauth_cred_t cred, u_int idx) 348 { 349 KASSERT(cred != NULL); 350 KASSERT(idx < cred->cr_ngroups); 351 352 return (cred->cr_groups[idx]); 353 } 354 355 /* XXX elad: gmuid is unused for now. */ 356 int 357 kauth_cred_setgroups(kauth_cred_t cred, gid_t *grbuf, size_t len, uid_t gmuid) 358 { 359 KASSERT(cred != NULL); 360 KASSERT(cred->cr_refcnt == 1); 361 KASSERT(len <= sizeof(cred->cr_groups) / sizeof(cred->cr_groups[0])); 362 363 if (len) 364 memcpy(cred->cr_groups, grbuf, len * sizeof(cred->cr_groups[0])); 365 memset(cred->cr_groups + len, 0xff, 366 sizeof(cred->cr_groups) - (len * sizeof(cred->cr_groups[0]))); 367 368 cred->cr_ngroups = len; 369 370 return (0); 371 } 372 373 int 374 kauth_cred_getgroups(kauth_cred_t cred, gid_t *grbuf, size_t len) 375 { 376 KASSERT(cred != NULL); 377 KASSERT(len <= cred->cr_ngroups); 378 379 memset(grbuf, 0xff, sizeof(*grbuf) * len); 380 memcpy(grbuf, cred->cr_groups, sizeof(*grbuf) * len); 381 382 return (0); 383 } 384 385 /* 386 * Match uids in two credentials. 387 */ 388 int 389 kauth_cred_uidmatch(kauth_cred_t cred1, kauth_cred_t cred2) 390 { 391 KASSERT(cred1 != NULL); 392 KASSERT(cred2 != NULL); 393 394 if (cred1->cr_uid == cred2->cr_uid || 395 cred1->cr_euid == cred2->cr_uid || 396 cred1->cr_uid == cred2->cr_euid || 397 cred1->cr_euid == cred2->cr_euid) 398 return (1); 399 400 return (0); 401 } 402 403 u_int 404 kauth_cred_getrefcnt(kauth_cred_t cred) 405 { 406 KASSERT(cred != NULL); 407 408 return (cred->cr_refcnt); 409 } 410 411 /* 412 * Convert userland credentials (struct uucred) to kauth_cred_t. 413 * XXX: For NFS code. 414 */ 415 void 416 kauth_cred_uucvt(kauth_cred_t cred, const struct uucred *uuc) 417 { 418 KASSERT(cred != NULL); 419 KASSERT(uuc != NULL); 420 421 cred->cr_refcnt = 1; 422 cred->cr_uid = uuc->cr_uid; 423 cred->cr_euid = uuc->cr_uid; 424 cred->cr_svuid = uuc->cr_uid; 425 cred->cr_gid = uuc->cr_gid; 426 cred->cr_egid = uuc->cr_gid; 427 cred->cr_svgid = uuc->cr_gid; 428 cred->cr_ngroups = min(uuc->cr_ngroups, NGROUPS); 429 kauth_cred_setgroups(cred, __UNCONST(uuc->cr_groups), 430 cred->cr_ngroups, -1); 431 } 432 433 /* 434 * Compare kauth_cred_t and uucred credentials. 435 * XXX: Modelled after crcmp() for NFS. 436 */ 437 int 438 kauth_cred_uucmp(kauth_cred_t cred, const struct uucred *uuc) 439 { 440 KASSERT(cred != NULL); 441 KASSERT(uuc != NULL); 442 443 if (cred->cr_euid == uuc->cr_uid && 444 cred->cr_egid == uuc->cr_gid && 445 cred->cr_ngroups == uuc->cr_ngroups) { 446 int i; 447 448 /* Check if all groups from uuc appear in cred. */ 449 for (i = 0; i < uuc->cr_ngroups; i++) { 450 int ismember; 451 452 ismember = 0; 453 if (kauth_cred_ismember_gid(cred, uuc->cr_groups[i], 454 &ismember) != 0 || !ismember) 455 return (1); 456 } 457 458 return (0); 459 } 460 461 return (1); 462 } 463 464 /* 465 * Make a struct ucred out of a kauth_cred_t. For compatibility. 466 */ 467 void 468 kauth_cred_toucred(kauth_cred_t cred, struct ucred *uc) 469 { 470 KASSERT(cred != NULL); 471 KASSERT(uc != NULL); 472 473 uc->cr_ref = cred->cr_refcnt; 474 uc->cr_uid = cred->cr_euid; 475 uc->cr_gid = cred->cr_egid; 476 uc->cr_ngroups = min(cred->cr_ngroups, 477 sizeof(uc->cr_groups) / sizeof(uc->cr_groups[0])); 478 memcpy(uc->cr_groups, cred->cr_groups, 479 uc->cr_ngroups * sizeof(uc->cr_groups[0])); 480 } 481 482 /* 483 * Make a struct pcred out of a kauth_cred_t. For compatibility. 484 */ 485 void 486 kauth_cred_topcred(kauth_cred_t cred, struct pcred *pc) 487 { 488 KASSERT(cred != NULL); 489 KASSERT(pc != NULL); 490 491 pc->pc_ucred = NULL; 492 pc->p_ruid = cred->cr_uid; 493 pc->p_svuid = cred->cr_svuid; 494 pc->p_rgid = cred->cr_gid; 495 pc->p_svgid = cred->cr_svgid; 496 pc->p_refcnt = cred->cr_refcnt; 497 } 498 499 /* 500 * Return kauth_cred_t for the current LWP. 501 */ 502 kauth_cred_t 503 kauth_cred_get(void) 504 { 505 return (curlwp->l_cred); 506 } 507 508 /* 509 * Returns a scope matching the provided id. 510 * Requires the scope list lock to be held by the caller. 511 */ 512 static kauth_scope_t 513 kauth_ifindscope(const char *id) 514 { 515 kauth_scope_t scope; 516 517 /* XXX: assert lock on scope list? */ 518 519 scope = NULL; 520 SIMPLEQ_FOREACH(scope, &scope_list, next_scope) { 521 if (strcmp(scope->id, id) == 0) 522 break; 523 } 524 525 return (scope); 526 } 527 528 /* 529 * Register a new scope. 530 * 531 * id - identifier for the scope 532 * callback - the scope's default listener 533 * cookie - cookie to be passed to the listener(s) 534 */ 535 kauth_scope_t 536 kauth_register_scope(const char *id, kauth_scope_callback_t callback, 537 void *cookie) 538 { 539 kauth_scope_t scope; 540 kauth_listener_t listener = NULL; /* XXX gcc */ 541 542 /* Sanitize input */ 543 if (id == NULL) 544 return (NULL); 545 546 /* Allocate space for a new scope and listener. */ 547 scope = pool_get(&kauth_scope_pool, PR_WAITOK); 548 if (callback != NULL) { 549 listener = pool_get(&kauth_listener_pool, PR_WAITOK); 550 } 551 552 /* Acquire scope list lock. */ 553 simple_lock(&scopes_lock); 554 555 /* Check we don't already have a scope with the same id */ 556 if (kauth_ifindscope(id) != NULL) { 557 simple_unlock(&scopes_lock); 558 559 pool_put(&kauth_scope_pool, scope); 560 if (callback != NULL) { 561 pool_put(&kauth_listener_pool, listener); 562 } 563 564 return (NULL); 565 } 566 567 /* Initialize new scope with parameters */ 568 scope->id = id; 569 scope->cookie = cookie; 570 scope->nlisteners = 1; 571 572 SIMPLEQ_INIT(&scope->listenq); 573 574 /* Add default listener */ 575 if (callback != NULL) { 576 listener->func = callback; 577 listener->scope = scope; 578 listener->refcnt = 0; 579 SIMPLEQ_INSERT_HEAD(&scope->listenq, listener, listener_next); 580 } 581 582 /* Insert scope to scopes list */ 583 SIMPLEQ_INSERT_TAIL(&scope_list, scope, next_scope); 584 585 simple_unlock(&scopes_lock); 586 587 return (scope); 588 } 589 590 /* 591 * Initialize the kernel authorization subsystem. 592 * 593 * Initialize the scopes list lock. 594 * Register built-in scopes: generic, process. 595 */ 596 void 597 kauth_init(void) 598 { 599 SIMPLEQ_INIT(&scope_list); 600 simple_lock_init(&scopes_lock); 601 602 /* Register generic scope. */ 603 kauth_builtin_scope_generic = kauth_register_scope(KAUTH_SCOPE_GENERIC, 604 NULL, NULL); 605 606 /* Register system scope. */ 607 kauth_builtin_scope_system = kauth_register_scope(KAUTH_SCOPE_SYSTEM, 608 NULL, NULL); 609 610 /* Register process scope. */ 611 kauth_builtin_scope_process = kauth_register_scope(KAUTH_SCOPE_PROCESS, 612 NULL, NULL); 613 614 /* Register network scope. */ 615 kauth_builtin_scope_network = kauth_register_scope(KAUTH_SCOPE_NETWORK, 616 NULL, NULL); 617 618 /* Register machdep scope. */ 619 kauth_builtin_scope_machdep = kauth_register_scope(KAUTH_SCOPE_MACHDEP, 620 NULL, NULL); 621 622 /* Register device scope. */ 623 kauth_builtin_scope_device = kauth_register_scope(KAUTH_SCOPE_DEVICE, 624 NULL, NULL); 625 } 626 627 /* 628 * Deregister a scope. 629 * Requires scope list lock to be held by the caller. 630 * 631 * scope - the scope to deregister 632 */ 633 void 634 kauth_deregister_scope(kauth_scope_t scope) 635 { 636 if (scope != NULL) { 637 /* Remove scope from list */ 638 SIMPLEQ_REMOVE(&scope_list, scope, kauth_scope, next_scope); 639 } 640 } 641 642 /* 643 * Register a listener. 644 * 645 * id - scope identifier. 646 * callback - the callback routine for the listener. 647 * cookie - cookie to pass unmoidfied to the callback. 648 */ 649 kauth_listener_t 650 kauth_listen_scope(const char *id, kauth_scope_callback_t callback, 651 void *cookie) 652 { 653 kauth_scope_t scope; 654 kauth_listener_t listener; 655 656 /* Find scope struct */ 657 simple_lock(&scopes_lock); 658 scope = kauth_ifindscope(id); 659 simple_unlock(&scopes_lock); 660 if (scope == NULL) 661 return (NULL); 662 663 /* Allocate listener */ 664 listener = pool_get(&kauth_listener_pool, PR_WAITOK); 665 666 /* Initialize listener with parameters */ 667 listener->func = callback; 668 listener->refcnt = 0; 669 670 /* Add listener to scope */ 671 SIMPLEQ_INSERT_TAIL(&scope->listenq, listener, listener_next); 672 673 /* Raise number of listeners on scope. */ 674 scope->nlisteners++; 675 listener->scope = scope; 676 677 listeners_have_been_loaded = TRUE; 678 679 return (listener); 680 } 681 682 /* 683 * Deregister a listener. 684 * 685 * listener - listener reference as returned from kauth_listen_scope(). 686 */ 687 void 688 kauth_unlisten_scope(kauth_listener_t listener) 689 { 690 if (listener != NULL) { 691 SIMPLEQ_REMOVE(&listener->scope->listenq, listener, 692 kauth_listener, listener_next); 693 listener->scope->nlisteners--; 694 } 695 } 696 697 /* 698 * Authorize a request. 699 * 700 * scope - the scope of the request as defined by KAUTH_SCOPE_* or as 701 * returned from kauth_register_scope(). 702 * credential - credentials of the user ("actor") making the request. 703 * action - request identifier. 704 * arg[0-3] - passed unmodified to listener(s). 705 */ 706 int 707 kauth_authorize_action(kauth_scope_t scope, kauth_cred_t cred, 708 kauth_action_t action, void *arg0, void *arg1, 709 void *arg2, void *arg3) 710 { 711 kauth_listener_t listener; 712 int error, allow, fail; 713 714 #if 0 /* defined(LOCKDEBUG) */ 715 spinlock_switchcheck(); 716 simple_lock_only_held(NULL, "kauth_authorize_action"); 717 #endif 718 719 KASSERT(cred != NULL); 720 KASSERT(action != 0); 721 722 /* Short-circuit requests coming from the kernel. */ 723 if (cred == NOCRED || cred == FSCRED) 724 return (0); 725 726 KASSERT(scope != NULL); 727 728 if (!listeners_have_been_loaded) { 729 KASSERT(SIMPLEQ_EMPTY(&scope->listenq)); 730 731 return (0); 732 } 733 734 fail = 0; 735 allow = 0; 736 SIMPLEQ_FOREACH(listener, &scope->listenq, listener_next) { 737 error = listener->func(cred, action, scope->cookie, arg0, 738 arg1, arg2, arg3); 739 740 if (error == KAUTH_RESULT_ALLOW) 741 allow = 1; 742 else if (error == KAUTH_RESULT_DENY) 743 fail = 1; 744 } 745 746 return ((allow && !fail) ? 0 : EPERM); 747 }; 748 749 /* 750 * Generic scope authorization wrapper. 751 */ 752 int 753 kauth_authorize_generic(kauth_cred_t cred, kauth_action_t action, void *arg0) 754 { 755 return (kauth_authorize_action(kauth_builtin_scope_generic, cred, 756 action, arg0, NULL, NULL, NULL)); 757 } 758 759 /* 760 * System scope authorization wrapper. 761 */ 762 int 763 kauth_authorize_system(kauth_cred_t cred, kauth_action_t action, 764 enum kauth_system_req req, void *arg1, void *arg2, void *arg3) 765 { 766 return (kauth_authorize_action(kauth_builtin_scope_system, cred, 767 action, (void *)req, arg1, arg2, arg3)); 768 } 769 770 /* 771 * Process scope authorization wrapper. 772 */ 773 int 774 kauth_authorize_process(kauth_cred_t cred, kauth_action_t action, 775 struct proc *p, void *arg1, void *arg2, void *arg3) 776 { 777 return (kauth_authorize_action(kauth_builtin_scope_process, cred, 778 action, p, arg1, arg2, arg3)); 779 } 780 781 /* 782 * Network scope authorization wrapper. 783 */ 784 int 785 kauth_authorize_network(kauth_cred_t cred, kauth_action_t action, 786 enum kauth_network_req req, void *arg1, void *arg2, void *arg3) 787 { 788 return (kauth_authorize_action(kauth_builtin_scope_network, cred, 789 action, (void *)req, arg1, arg2, arg3)); 790 } 791 792 int 793 kauth_authorize_machdep(kauth_cred_t cred, kauth_action_t action, 794 enum kauth_machdep_req req, void *arg1, void *arg2, void *arg3) 795 { 796 return (kauth_authorize_action(kauth_builtin_scope_machdep, cred, 797 action, (void *)req, arg1, arg2, arg3)); 798 } 799 800 int 801 kauth_authorize_device_tty(kauth_cred_t cred, kauth_action_t action, 802 struct tty *tty) 803 { 804 return (kauth_authorize_action(kauth_builtin_scope_device, cred, 805 action, tty, NULL, NULL, NULL)); 806 } 807