1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate /* 30*0Sstevel@tonic-gate * Privilege implementation. 31*0Sstevel@tonic-gate * 32*0Sstevel@tonic-gate * This file provides the infrastructure for privilege sets and limits 33*0Sstevel@tonic-gate * the number of files that requires to include <sys/cred_impl.h> and/or 34*0Sstevel@tonic-gate * <sys/priv_impl.h>. 35*0Sstevel@tonic-gate * 36*0Sstevel@tonic-gate * The Solaris privilege mechanism has been designed in a 37*0Sstevel@tonic-gate * future proof manner. While the kernel may use fixed size arrays 38*0Sstevel@tonic-gate * and fixed bitmasks and bit values, the representation of those 39*0Sstevel@tonic-gate * is kernel private. All external interfaces as well as K-to-K interfaces 40*0Sstevel@tonic-gate * have been constructed in a manner to provide the maximum flexibility. 41*0Sstevel@tonic-gate * 42*0Sstevel@tonic-gate * There can be X privilege sets each containing Y 32 bit words. 43*0Sstevel@tonic-gate * <X, Y> are constant for a kernel invocation. 44*0Sstevel@tonic-gate * 45*0Sstevel@tonic-gate * As a consequence, all privilege set manipulation happens in functions 46*0Sstevel@tonic-gate * below. 47*0Sstevel@tonic-gate * 48*0Sstevel@tonic-gate */ 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate #include <sys/systm.h> 51*0Sstevel@tonic-gate #include <sys/ddi.h> 52*0Sstevel@tonic-gate #include <sys/kmem.h> 53*0Sstevel@tonic-gate #include <sys/sunddi.h> 54*0Sstevel@tonic-gate #include <sys/errno.h> 55*0Sstevel@tonic-gate #include <sys/debug.h> 56*0Sstevel@tonic-gate #include <sys/priv_impl.h> 57*0Sstevel@tonic-gate #include <sys/procfs.h> 58*0Sstevel@tonic-gate #include <sys/policy.h> 59*0Sstevel@tonic-gate #include <sys/cred_impl.h> 60*0Sstevel@tonic-gate #include <sys/devpolicy.h> 61*0Sstevel@tonic-gate #include <sys/atomic.h> 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate /* 64*0Sstevel@tonic-gate * Privilege name to number mapping table consists in the generated 65*0Sstevel@tonic-gate * priv_const.c file. This lock protects against updates of the privilege 66*0Sstevel@tonic-gate * names and counts; all other priv_info fields are read-only. 67*0Sstevel@tonic-gate * The actual protected values are: 68*0Sstevel@tonic-gate * global variable nprivs 69*0Sstevel@tonic-gate * the priv_max field 70*0Sstevel@tonic-gate * the priv_names field 71*0Sstevel@tonic-gate * the priv names info item (cnt/strings) 72*0Sstevel@tonic-gate */ 73*0Sstevel@tonic-gate krwlock_t privinfo_lock; 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate static boolean_t priv_valid(const cred_t *); 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate priv_set_t priv_fullset; /* set of all privileges */ 78*0Sstevel@tonic-gate priv_set_t priv_unsafe; /* unsafe to exec set-uid root if these are not in L */ 79*0Sstevel@tonic-gate 80*0Sstevel@tonic-gate /* 81*0Sstevel@tonic-gate * Privilege initialization functions. 82*0Sstevel@tonic-gate * Called from common/os/cred.c when cred_init is called. 83*0Sstevel@tonic-gate */ 84*0Sstevel@tonic-gate 85*0Sstevel@tonic-gate void 86*0Sstevel@tonic-gate priv_init(void) 87*0Sstevel@tonic-gate { 88*0Sstevel@tonic-gate rw_init(&privinfo_lock, NULL, RW_DRIVER, NULL); 89*0Sstevel@tonic-gate 90*0Sstevel@tonic-gate PRIV_BASIC_ASSERT(priv_basic); 91*0Sstevel@tonic-gate PRIV_UNSAFE_ASSERT(&priv_unsafe); 92*0Sstevel@tonic-gate priv_fillset(&priv_fullset); 93*0Sstevel@tonic-gate 94*0Sstevel@tonic-gate devpolicy_init(); 95*0Sstevel@tonic-gate } 96*0Sstevel@tonic-gate 97*0Sstevel@tonic-gate /* Utility functions: privilege sets as opaque data types */ 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate /* 100*0Sstevel@tonic-gate * Guts of prgetprivsize. 101*0Sstevel@tonic-gate */ 102*0Sstevel@tonic-gate int 103*0Sstevel@tonic-gate priv_prgetprivsize(prpriv_t *tmpl) 104*0Sstevel@tonic-gate { 105*0Sstevel@tonic-gate return (sizeof (prpriv_t) + 106*0Sstevel@tonic-gate PRIV_SETBYTES - sizeof (priv_chunk_t) + 107*0Sstevel@tonic-gate (tmpl ? tmpl->pr_infosize : priv_info->priv_infosize)); 108*0Sstevel@tonic-gate } 109*0Sstevel@tonic-gate 110*0Sstevel@tonic-gate /* 111*0Sstevel@tonic-gate * Guts of prgetpriv. 112*0Sstevel@tonic-gate */ 113*0Sstevel@tonic-gate void 114*0Sstevel@tonic-gate cred2prpriv(const cred_t *cp, prpriv_t *pr) 115*0Sstevel@tonic-gate { 116*0Sstevel@tonic-gate priv_set_t *psa; 117*0Sstevel@tonic-gate int i; 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gate pr->pr_nsets = PRIV_NSET; 120*0Sstevel@tonic-gate pr->pr_setsize = PRIV_SETSIZE; 121*0Sstevel@tonic-gate pr->pr_infosize = priv_info->priv_infosize; 122*0Sstevel@tonic-gate 123*0Sstevel@tonic-gate psa = (priv_set_t *)pr->pr_sets; 124*0Sstevel@tonic-gate 125*0Sstevel@tonic-gate for (i = 0; i < PRIV_NSET; i++) 126*0Sstevel@tonic-gate psa[i] = *priv_getset(cp, i); 127*0Sstevel@tonic-gate 128*0Sstevel@tonic-gate priv_getinfo(cp, (char *)pr + PRIV_PRPRIV_INFO_OFFSET(pr)); 129*0Sstevel@tonic-gate } 130*0Sstevel@tonic-gate 131*0Sstevel@tonic-gate /* 132*0Sstevel@tonic-gate * Guts of pr_spriv: 133*0Sstevel@tonic-gate * 134*0Sstevel@tonic-gate * Set the privileges of a process. 135*0Sstevel@tonic-gate * 136*0Sstevel@tonic-gate * In order to set the privileges, the setting process will need to 137*0Sstevel@tonic-gate * have those privileges in its effective set in order to prevent 138*0Sstevel@tonic-gate * specially privileged processes to easily gain additional privileges. 139*0Sstevel@tonic-gate * Pre-existing privileges can be retained. To change any privileges, 140*0Sstevel@tonic-gate * PRIV_PROC_OWNER needs to be asserted. 141*0Sstevel@tonic-gate * 142*0Sstevel@tonic-gate * In formula: 143*0Sstevel@tonic-gate * 144*0Sstevel@tonic-gate * S' <= S || S' <= S + Ea 145*0Sstevel@tonic-gate * 146*0Sstevel@tonic-gate * the new set must either be subset of the old set or a subset of 147*0Sstevel@tonic-gate * the oldset merged with the effective set of the acting process; or just: 148*0Sstevel@tonic-gate * 149*0Sstevel@tonic-gate * S' <= S + Ea 150*0Sstevel@tonic-gate * 151*0Sstevel@tonic-gate * It's not legal to grow the limit set this way. 152*0Sstevel@tonic-gate * 153*0Sstevel@tonic-gate */ 154*0Sstevel@tonic-gate int 155*0Sstevel@tonic-gate priv_pr_spriv(proc_t *p, prpriv_t *prpriv, const cred_t *cr) 156*0Sstevel@tonic-gate { 157*0Sstevel@tonic-gate cred_t *oldcred; 158*0Sstevel@tonic-gate cred_t *newcred; 159*0Sstevel@tonic-gate int i; 160*0Sstevel@tonic-gate int err = EPERM; 161*0Sstevel@tonic-gate cred_priv_t *cp, *ocp; 162*0Sstevel@tonic-gate priv_set_t eset; 163*0Sstevel@tonic-gate 164*0Sstevel@tonic-gate ASSERT(MUTEX_HELD(&p->p_lock)); 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate /* 167*0Sstevel@tonic-gate * Set must have proper dimension; infosize must be absent 168*0Sstevel@tonic-gate * or properly sized. 169*0Sstevel@tonic-gate */ 170*0Sstevel@tonic-gate if (prpriv->pr_nsets != PRIV_NSET || 171*0Sstevel@tonic-gate prpriv->pr_setsize != PRIV_SETSIZE || 172*0Sstevel@tonic-gate (prpriv->pr_infosize & (sizeof (uint32_t) - 1)) != 0 || 173*0Sstevel@tonic-gate prpriv->pr_infosize > priv_info->priv_infosize || 174*0Sstevel@tonic-gate prpriv->pr_infosize < 0) 175*0Sstevel@tonic-gate return (EINVAL); 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate mutex_exit(&p->p_lock); 178*0Sstevel@tonic-gate 179*0Sstevel@tonic-gate if (priv_proc_cred_perm(cr, p, &oldcred, VWRITE) != 0) { 180*0Sstevel@tonic-gate mutex_enter(&p->p_lock); 181*0Sstevel@tonic-gate return (EPERM); 182*0Sstevel@tonic-gate } 183*0Sstevel@tonic-gate 184*0Sstevel@tonic-gate newcred = crdup(oldcred); 185*0Sstevel@tonic-gate 186*0Sstevel@tonic-gate /* Copy the privilege sets from prpriv to newcred */ 187*0Sstevel@tonic-gate bcopy(prpriv->pr_sets, CR_PRIVSETS(newcred), PRIV_SETBYTES); 188*0Sstevel@tonic-gate 189*0Sstevel@tonic-gate cp = &newcred->cr_priv; 190*0Sstevel@tonic-gate ocp = &oldcred->cr_priv; 191*0Sstevel@tonic-gate eset = CR_OEPRIV(cr); 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate priv_intersect(&CR_LPRIV(oldcred), &eset); 194*0Sstevel@tonic-gate 195*0Sstevel@tonic-gate /* 196*0Sstevel@tonic-gate * Verify the constraints laid out: 197*0Sstevel@tonic-gate * for the limit set, we require that the new set is a subset 198*0Sstevel@tonic-gate * of the old limit set. 199*0Sstevel@tonic-gate * for all other sets, we require that the new set is either a 200*0Sstevel@tonic-gate * subset of the old set or a subset of the intersection of 201*0Sstevel@tonic-gate * the old limit set and the effective set of the acting process. 202*0Sstevel@tonic-gate */ 203*0Sstevel@tonic-gate for (i = 0; i < PRIV_NSET; i++) 204*0Sstevel@tonic-gate if (!priv_issubset(&cp->crprivs[i], &ocp->crprivs[i]) && 205*0Sstevel@tonic-gate (i == PRIV_LIMIT || !priv_issubset(&cp->crprivs[i], &eset))) 206*0Sstevel@tonic-gate break; 207*0Sstevel@tonic-gate 208*0Sstevel@tonic-gate crfree(oldcred); 209*0Sstevel@tonic-gate 210*0Sstevel@tonic-gate if (i < PRIV_NSET || !priv_valid(newcred)) 211*0Sstevel@tonic-gate goto err; 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate /* Load the settable privilege information */ 214*0Sstevel@tonic-gate if (prpriv->pr_infosize > 0) { 215*0Sstevel@tonic-gate char *x = (char *)prpriv + PRIV_PRPRIV_INFO_OFFSET(prpriv); 216*0Sstevel@tonic-gate char *lastx = x + prpriv->pr_infosize; 217*0Sstevel@tonic-gate 218*0Sstevel@tonic-gate while (x < lastx) { 219*0Sstevel@tonic-gate priv_info_t *pi = (priv_info_t *)x; 220*0Sstevel@tonic-gate priv_info_uint_t *pii; 221*0Sstevel@tonic-gate 222*0Sstevel@tonic-gate switch (pi->priv_info_type) { 223*0Sstevel@tonic-gate case PRIV_INFO_FLAGS: 224*0Sstevel@tonic-gate pii = (priv_info_uint_t *)x; 225*0Sstevel@tonic-gate if (pii->info.priv_info_size != sizeof (*pii)) { 226*0Sstevel@tonic-gate err = EINVAL; 227*0Sstevel@tonic-gate goto err; 228*0Sstevel@tonic-gate } 229*0Sstevel@tonic-gate CR_FLAGS(newcred) &= ~PRIV_USER; 230*0Sstevel@tonic-gate CR_FLAGS(newcred) |= (pii->val & PRIV_USER); 231*0Sstevel@tonic-gate break; 232*0Sstevel@tonic-gate default: 233*0Sstevel@tonic-gate err = EINVAL; 234*0Sstevel@tonic-gate goto err; 235*0Sstevel@tonic-gate } 236*0Sstevel@tonic-gate /* Guarantee alignment and forward progress */ 237*0Sstevel@tonic-gate if ((pi->priv_info_size & (sizeof (uint32_t) - 1)) || 238*0Sstevel@tonic-gate pi->priv_info_size < sizeof (*pi) || 239*0Sstevel@tonic-gate lastx - x > pi->priv_info_size) { 240*0Sstevel@tonic-gate err = EINVAL; 241*0Sstevel@tonic-gate goto err; 242*0Sstevel@tonic-gate } 243*0Sstevel@tonic-gate 244*0Sstevel@tonic-gate x += pi->priv_info_size; 245*0Sstevel@tonic-gate } 246*0Sstevel@tonic-gate } 247*0Sstevel@tonic-gate 248*0Sstevel@tonic-gate /* 249*0Sstevel@tonic-gate * We'll try to copy the privilege aware flag; but since the 250*0Sstevel@tonic-gate * privileges sets are all individually set, they are set 251*0Sstevel@tonic-gate * as if we're privilege aware. If PRIV_AWARE wasn't set 252*0Sstevel@tonic-gate * or was explicitely unset, we need to set the flag and then 253*0Sstevel@tonic-gate * try to get rid of it. 254*0Sstevel@tonic-gate */ 255*0Sstevel@tonic-gate if ((CR_FLAGS(newcred) & PRIV_AWARE) == 0) { 256*0Sstevel@tonic-gate CR_FLAGS(newcred) |= PRIV_AWARE; 257*0Sstevel@tonic-gate priv_adjust_PA(newcred); 258*0Sstevel@tonic-gate } 259*0Sstevel@tonic-gate 260*0Sstevel@tonic-gate mutex_enter(&p->p_crlock); 261*0Sstevel@tonic-gate oldcred = p->p_cred; 262*0Sstevel@tonic-gate p->p_cred = newcred; 263*0Sstevel@tonic-gate mutex_exit(&p->p_crlock); 264*0Sstevel@tonic-gate crfree(oldcred); 265*0Sstevel@tonic-gate 266*0Sstevel@tonic-gate mutex_enter(&p->p_lock); 267*0Sstevel@tonic-gate return (0); 268*0Sstevel@tonic-gate 269*0Sstevel@tonic-gate err: 270*0Sstevel@tonic-gate crfree(newcred); 271*0Sstevel@tonic-gate mutex_enter(&p->p_lock); 272*0Sstevel@tonic-gate return (err); 273*0Sstevel@tonic-gate } 274*0Sstevel@tonic-gate 275*0Sstevel@tonic-gate priv_impl_info_t 276*0Sstevel@tonic-gate *priv_hold_implinfo(void) 277*0Sstevel@tonic-gate { 278*0Sstevel@tonic-gate rw_enter(&privinfo_lock, RW_READER); 279*0Sstevel@tonic-gate return (priv_info); 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate 282*0Sstevel@tonic-gate void 283*0Sstevel@tonic-gate priv_release_implinfo(void) 284*0Sstevel@tonic-gate { 285*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 286*0Sstevel@tonic-gate } 287*0Sstevel@tonic-gate 288*0Sstevel@tonic-gate size_t 289*0Sstevel@tonic-gate priv_get_implinfo_size(void) 290*0Sstevel@tonic-gate { 291*0Sstevel@tonic-gate return (privinfosize); 292*0Sstevel@tonic-gate } 293*0Sstevel@tonic-gate 294*0Sstevel@tonic-gate 295*0Sstevel@tonic-gate /* 296*0Sstevel@tonic-gate * Return the nth privilege set 297*0Sstevel@tonic-gate */ 298*0Sstevel@tonic-gate const priv_set_t * 299*0Sstevel@tonic-gate priv_getset(const cred_t *cr, int set) 300*0Sstevel@tonic-gate { 301*0Sstevel@tonic-gate ASSERT(PRIV_VALIDSET(set)); 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gate if ((CR_FLAGS(cr) & PRIV_AWARE) == 0) 304*0Sstevel@tonic-gate switch (set) { 305*0Sstevel@tonic-gate case PRIV_EFFECTIVE: 306*0Sstevel@tonic-gate return (&CR_OEPRIV(cr)); 307*0Sstevel@tonic-gate case PRIV_PERMITTED: 308*0Sstevel@tonic-gate return (&CR_OPPRIV(cr)); 309*0Sstevel@tonic-gate } 310*0Sstevel@tonic-gate return (&CR_PRIVS(cr)->crprivs[set]); 311*0Sstevel@tonic-gate } 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate /* 314*0Sstevel@tonic-gate * Buf must be allocated by caller and contain sufficient space to 315*0Sstevel@tonic-gate * contain all additional info structures using priv_info.priv_infosize. 316*0Sstevel@tonic-gate * The buffer must be properly aligned. 317*0Sstevel@tonic-gate */ 318*0Sstevel@tonic-gate /*ARGSUSED*/ 319*0Sstevel@tonic-gate void 320*0Sstevel@tonic-gate priv_getinfo(const cred_t *cr, void *buf) 321*0Sstevel@tonic-gate { 322*0Sstevel@tonic-gate struct priv_info_uint *ii; 323*0Sstevel@tonic-gate 324*0Sstevel@tonic-gate ii = buf; 325*0Sstevel@tonic-gate ii->val = CR_FLAGS(cr); 326*0Sstevel@tonic-gate ii->info.priv_info_size = (uint32_t)sizeof (*ii); 327*0Sstevel@tonic-gate ii->info.priv_info_type = PRIV_INFO_FLAGS; 328*0Sstevel@tonic-gate } 329*0Sstevel@tonic-gate 330*0Sstevel@tonic-gate int 331*0Sstevel@tonic-gate priv_getbyname(const char *name, uint_t flag) 332*0Sstevel@tonic-gate { 333*0Sstevel@tonic-gate int i; 334*0Sstevel@tonic-gate int wheld = 0; 335*0Sstevel@tonic-gate int len; 336*0Sstevel@tonic-gate char *p; 337*0Sstevel@tonic-gate 338*0Sstevel@tonic-gate if (flag != 0 && flag != PRIV_ALLOC) 339*0Sstevel@tonic-gate return (-EINVAL); 340*0Sstevel@tonic-gate 341*0Sstevel@tonic-gate if (strncasecmp(name, "priv_", 5) == 0) 342*0Sstevel@tonic-gate name += 5; 343*0Sstevel@tonic-gate 344*0Sstevel@tonic-gate rw_enter(&privinfo_lock, RW_READER); 345*0Sstevel@tonic-gate rescan: 346*0Sstevel@tonic-gate for (i = 0; i < nprivs; i++) 347*0Sstevel@tonic-gate if (strcasecmp(priv_names[i], name) == 0) { 348*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 349*0Sstevel@tonic-gate return (i); 350*0Sstevel@tonic-gate } 351*0Sstevel@tonic-gate 352*0Sstevel@tonic-gate 353*0Sstevel@tonic-gate if (!wheld) { 354*0Sstevel@tonic-gate if (!(flag & PRIV_ALLOC)) { 355*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 356*0Sstevel@tonic-gate return (-EINVAL); 357*0Sstevel@tonic-gate } 358*0Sstevel@tonic-gate 359*0Sstevel@tonic-gate /* check length, validity and available space */ 360*0Sstevel@tonic-gate len = strlen(name) + 1; 361*0Sstevel@tonic-gate 362*0Sstevel@tonic-gate if (len > PRIVNAME_MAX) { 363*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 364*0Sstevel@tonic-gate return (-ENAMETOOLONG); 365*0Sstevel@tonic-gate } 366*0Sstevel@tonic-gate 367*0Sstevel@tonic-gate for (p = (char *)name; *p != '\0'; p++) { 368*0Sstevel@tonic-gate char c = *p; 369*0Sstevel@tonic-gate 370*0Sstevel@tonic-gate if (!((c >= 'A' && c <= 'Z') || 371*0Sstevel@tonic-gate (c >= 'a' && c <= 'z') || 372*0Sstevel@tonic-gate (c >= '0' && c <= '9') || 373*0Sstevel@tonic-gate c == '_')) { 374*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 375*0Sstevel@tonic-gate return (-EINVAL); 376*0Sstevel@tonic-gate } 377*0Sstevel@tonic-gate } 378*0Sstevel@tonic-gate 379*0Sstevel@tonic-gate if (!rw_tryupgrade(&privinfo_lock)) { 380*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 381*0Sstevel@tonic-gate rw_enter(&privinfo_lock, RW_WRITER); 382*0Sstevel@tonic-gate wheld = 1; 383*0Sstevel@tonic-gate /* Someone may have added our privilege */ 384*0Sstevel@tonic-gate goto rescan; 385*0Sstevel@tonic-gate } 386*0Sstevel@tonic-gate } 387*0Sstevel@tonic-gate 388*0Sstevel@tonic-gate if (nprivs == MAX_PRIVILEGE || len + privbytes > maxprivbytes) { 389*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 390*0Sstevel@tonic-gate return (-ENOMEM); 391*0Sstevel@tonic-gate } 392*0Sstevel@tonic-gate 393*0Sstevel@tonic-gate priv_names[i] = p = priv_str + privbytes; 394*0Sstevel@tonic-gate 395*0Sstevel@tonic-gate bcopy(name, p, len); 396*0Sstevel@tonic-gate 397*0Sstevel@tonic-gate /* make the priv_names[i] and privilege name globally visible */ 398*0Sstevel@tonic-gate membar_producer(); 399*0Sstevel@tonic-gate 400*0Sstevel@tonic-gate /* adjust priv count and bytes count */ 401*0Sstevel@tonic-gate priv_ninfo->cnt = priv_info->priv_max = ++nprivs; 402*0Sstevel@tonic-gate privbytes += len; 403*0Sstevel@tonic-gate 404*0Sstevel@tonic-gate rw_exit(&privinfo_lock); 405*0Sstevel@tonic-gate return (i); 406*0Sstevel@tonic-gate } 407*0Sstevel@tonic-gate 408*0Sstevel@tonic-gate /* 409*0Sstevel@tonic-gate * We can't afford locking the privileges here because of the locations 410*0Sstevel@tonic-gate * we call this from; so we make sure that the privileges table 411*0Sstevel@tonic-gate * is visible to us; it is made visible before the value of nprivs is 412*0Sstevel@tonic-gate * updated. 413*0Sstevel@tonic-gate */ 414*0Sstevel@tonic-gate const char * 415*0Sstevel@tonic-gate priv_getbynum(int priv) 416*0Sstevel@tonic-gate { 417*0Sstevel@tonic-gate int maxpriv = nprivs; 418*0Sstevel@tonic-gate 419*0Sstevel@tonic-gate membar_consumer(); 420*0Sstevel@tonic-gate 421*0Sstevel@tonic-gate if (priv >= 0 && priv < maxpriv) 422*0Sstevel@tonic-gate return (priv_names[priv]); 423*0Sstevel@tonic-gate 424*0Sstevel@tonic-gate return (NULL); 425*0Sstevel@tonic-gate } 426*0Sstevel@tonic-gate 427*0Sstevel@tonic-gate const char * 428*0Sstevel@tonic-gate priv_getsetbynum(int setno) 429*0Sstevel@tonic-gate { 430*0Sstevel@tonic-gate if (!PRIV_VALIDSET(setno)) 431*0Sstevel@tonic-gate return (NULL); 432*0Sstevel@tonic-gate 433*0Sstevel@tonic-gate return (priv_setnames[setno]); 434*0Sstevel@tonic-gate } 435*0Sstevel@tonic-gate 436*0Sstevel@tonic-gate /* 437*0Sstevel@tonic-gate * Privilege sanity checking when setting: E <= P. 438*0Sstevel@tonic-gate */ 439*0Sstevel@tonic-gate static boolean_t 440*0Sstevel@tonic-gate priv_valid(const cred_t *cr) 441*0Sstevel@tonic-gate { 442*0Sstevel@tonic-gate return (priv_issubset(&CR_EPRIV(cr), &CR_PPRIV(cr))); 443*0Sstevel@tonic-gate } 444*0Sstevel@tonic-gate 445*0Sstevel@tonic-gate /* 446*0Sstevel@tonic-gate * Privilege manipulation functions 447*0Sstevel@tonic-gate * 448*0Sstevel@tonic-gate * Without knowing the details of the privilege set implementation, 449*0Sstevel@tonic-gate * opaque pointers can be used to manipulate sets at will. 450*0Sstevel@tonic-gate */ 451*0Sstevel@tonic-gate void 452*0Sstevel@tonic-gate priv_emptyset(priv_set_t *set) 453*0Sstevel@tonic-gate { 454*0Sstevel@tonic-gate bzero(set, sizeof (*set)); 455*0Sstevel@tonic-gate } 456*0Sstevel@tonic-gate 457*0Sstevel@tonic-gate void 458*0Sstevel@tonic-gate priv_fillset(priv_set_t *set) 459*0Sstevel@tonic-gate { 460*0Sstevel@tonic-gate int i; 461*0Sstevel@tonic-gate 462*0Sstevel@tonic-gate /* memset? */ 463*0Sstevel@tonic-gate for (i = 0; i < PRIV_SETSIZE; i++) 464*0Sstevel@tonic-gate set->pbits[i] = ~(priv_chunk_t)0; 465*0Sstevel@tonic-gate } 466*0Sstevel@tonic-gate 467*0Sstevel@tonic-gate void 468*0Sstevel@tonic-gate priv_addset(priv_set_t *set, int priv) 469*0Sstevel@tonic-gate { 470*0Sstevel@tonic-gate ASSERT(priv >= 0 && priv < MAX_PRIVILEGE); 471*0Sstevel@tonic-gate __PRIV_ASSERT(set, priv); 472*0Sstevel@tonic-gate } 473*0Sstevel@tonic-gate 474*0Sstevel@tonic-gate void 475*0Sstevel@tonic-gate priv_delset(priv_set_t *set, int priv) 476*0Sstevel@tonic-gate { 477*0Sstevel@tonic-gate ASSERT(priv >= 0 && priv < MAX_PRIVILEGE); 478*0Sstevel@tonic-gate __PRIV_CLEAR(set, priv); 479*0Sstevel@tonic-gate } 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate boolean_t 482*0Sstevel@tonic-gate priv_ismember(const priv_set_t *set, int priv) 483*0Sstevel@tonic-gate { 484*0Sstevel@tonic-gate ASSERT(priv >= 0 && priv < MAX_PRIVILEGE); 485*0Sstevel@tonic-gate return (__PRIV_ISASSERT(set, priv) ? B_TRUE : B_FALSE); 486*0Sstevel@tonic-gate } 487*0Sstevel@tonic-gate 488*0Sstevel@tonic-gate #define PRIV_TEST_BODY(test) \ 489*0Sstevel@tonic-gate int i; \ 490*0Sstevel@tonic-gate \ 491*0Sstevel@tonic-gate for (i = 0; i < PRIV_SETSIZE; i++) \ 492*0Sstevel@tonic-gate if (!(test)) \ 493*0Sstevel@tonic-gate return (B_FALSE); \ 494*0Sstevel@tonic-gate \ 495*0Sstevel@tonic-gate return (B_TRUE) 496*0Sstevel@tonic-gate 497*0Sstevel@tonic-gate boolean_t 498*0Sstevel@tonic-gate priv_isequalset(const priv_set_t *a, const priv_set_t *b) 499*0Sstevel@tonic-gate { 500*0Sstevel@tonic-gate return ((boolean_t)(bcmp(a, b, sizeof (*a)) == 0)); 501*0Sstevel@tonic-gate } 502*0Sstevel@tonic-gate 503*0Sstevel@tonic-gate boolean_t 504*0Sstevel@tonic-gate priv_isemptyset(const priv_set_t *set) 505*0Sstevel@tonic-gate { 506*0Sstevel@tonic-gate PRIV_TEST_BODY(set->pbits[i] == 0); 507*0Sstevel@tonic-gate } 508*0Sstevel@tonic-gate 509*0Sstevel@tonic-gate boolean_t 510*0Sstevel@tonic-gate priv_isfullset(const priv_set_t *set) 511*0Sstevel@tonic-gate { 512*0Sstevel@tonic-gate PRIV_TEST_BODY(set->pbits[i] == ~(priv_chunk_t)0); 513*0Sstevel@tonic-gate } 514*0Sstevel@tonic-gate 515*0Sstevel@tonic-gate /* 516*0Sstevel@tonic-gate * Return true if a is a subset of b 517*0Sstevel@tonic-gate */ 518*0Sstevel@tonic-gate boolean_t 519*0Sstevel@tonic-gate priv_issubset(const priv_set_t *a, const priv_set_t *b) 520*0Sstevel@tonic-gate { 521*0Sstevel@tonic-gate PRIV_TEST_BODY((a->pbits[i] | b->pbits[i]) == b->pbits[i]); 522*0Sstevel@tonic-gate } 523*0Sstevel@tonic-gate 524*0Sstevel@tonic-gate #define PRIV_CHANGE_BODY(a, op, b) \ 525*0Sstevel@tonic-gate int i; \ 526*0Sstevel@tonic-gate \ 527*0Sstevel@tonic-gate for (i = 0; i < PRIV_SETSIZE; i++) \ 528*0Sstevel@tonic-gate a->pbits[i] op b->pbits[i] 529*0Sstevel@tonic-gate 530*0Sstevel@tonic-gate /* B = A ^ B */ 531*0Sstevel@tonic-gate void 532*0Sstevel@tonic-gate priv_intersect(const priv_set_t *a, priv_set_t *b) 533*0Sstevel@tonic-gate { 534*0Sstevel@tonic-gate /* CSTYLED */ 535*0Sstevel@tonic-gate PRIV_CHANGE_BODY(b, &=, a); 536*0Sstevel@tonic-gate } 537*0Sstevel@tonic-gate 538*0Sstevel@tonic-gate /* B = A v B */ 539*0Sstevel@tonic-gate void 540*0Sstevel@tonic-gate priv_union(const priv_set_t *a, priv_set_t *b) 541*0Sstevel@tonic-gate { 542*0Sstevel@tonic-gate /* CSTYLED */ 543*0Sstevel@tonic-gate PRIV_CHANGE_BODY(b, |=, a); 544*0Sstevel@tonic-gate } 545*0Sstevel@tonic-gate 546*0Sstevel@tonic-gate /* A = ! A */ 547*0Sstevel@tonic-gate void 548*0Sstevel@tonic-gate priv_inverse(priv_set_t *a) 549*0Sstevel@tonic-gate { 550*0Sstevel@tonic-gate PRIV_CHANGE_BODY(a, = ~, a); 551*0Sstevel@tonic-gate } 552*0Sstevel@tonic-gate 553*0Sstevel@tonic-gate /* 554*0Sstevel@tonic-gate * Can the source cred act on the target credential? 555*0Sstevel@tonic-gate * 556*0Sstevel@tonic-gate * We will you allow to gain uids this way but not privileges. 557*0Sstevel@tonic-gate */ 558*0Sstevel@tonic-gate int 559*0Sstevel@tonic-gate priv_proc_cred_perm(const cred_t *scr, proc_t *tp, cred_t **pcr, int mode) 560*0Sstevel@tonic-gate { 561*0Sstevel@tonic-gate const priv_set_t *eset; 562*0Sstevel@tonic-gate int idsmatch; 563*0Sstevel@tonic-gate cred_t *tcr; 564*0Sstevel@tonic-gate int res = 0; 565*0Sstevel@tonic-gate 566*0Sstevel@tonic-gate /* prevent the cred from going away */ 567*0Sstevel@tonic-gate mutex_enter(&tp->p_crlock); 568*0Sstevel@tonic-gate crhold(tcr = tp->p_cred); 569*0Sstevel@tonic-gate mutex_exit(&tp->p_crlock); 570*0Sstevel@tonic-gate 571*0Sstevel@tonic-gate if (scr == tcr) 572*0Sstevel@tonic-gate goto out; 573*0Sstevel@tonic-gate 574*0Sstevel@tonic-gate idsmatch = (scr->cr_uid == tcr->cr_uid && 575*0Sstevel@tonic-gate scr->cr_uid == tcr->cr_ruid && 576*0Sstevel@tonic-gate scr->cr_uid == tcr->cr_suid && 577*0Sstevel@tonic-gate scr->cr_gid == tcr->cr_gid && 578*0Sstevel@tonic-gate scr->cr_gid == tcr->cr_rgid && 579*0Sstevel@tonic-gate scr->cr_gid == tcr->cr_sgid && 580*0Sstevel@tonic-gate !(tp->p_flag & SNOCD)); 581*0Sstevel@tonic-gate 582*0Sstevel@tonic-gate /* 583*0Sstevel@tonic-gate * Source credential must have the proc_zone privilege if referencing 584*0Sstevel@tonic-gate * a process in another zone. 585*0Sstevel@tonic-gate */ 586*0Sstevel@tonic-gate if (scr->cr_zone != tcr->cr_zone && secpolicy_proc_zone(scr) != 0) { 587*0Sstevel@tonic-gate res = EACCES; 588*0Sstevel@tonic-gate goto out; 589*0Sstevel@tonic-gate } 590*0Sstevel@tonic-gate 591*0Sstevel@tonic-gate if (!(mode & VWRITE)) { 592*0Sstevel@tonic-gate if (!idsmatch && secpolicy_proc_owner(scr, tcr, 0) != 0) 593*0Sstevel@tonic-gate res = EACCES; 594*0Sstevel@tonic-gate goto out; 595*0Sstevel@tonic-gate } 596*0Sstevel@tonic-gate 597*0Sstevel@tonic-gate /* 598*0Sstevel@tonic-gate * For writing, the effective set of scr must dominate all sets of tcr, 599*0Sstevel@tonic-gate * We test Pt <= Es (Et <= Pt so no need to test) and It <= Es 600*0Sstevel@tonic-gate * The Limit set of scr must be a superset of the limitset of 601*0Sstevel@tonic-gate * tcr. 602*0Sstevel@tonic-gate */ 603*0Sstevel@tonic-gate eset = &CR_OEPRIV(scr); 604*0Sstevel@tonic-gate 605*0Sstevel@tonic-gate if (!priv_issubset(&CR_IPRIV(tcr), eset) || 606*0Sstevel@tonic-gate !priv_issubset(&CR_OPPRIV(tcr), eset) || 607*0Sstevel@tonic-gate !priv_issubset(&CR_LPRIV(tcr), &CR_LPRIV(scr)) || 608*0Sstevel@tonic-gate !idsmatch && secpolicy_proc_owner(scr, tcr, mode) != 0) 609*0Sstevel@tonic-gate res = EACCES; 610*0Sstevel@tonic-gate 611*0Sstevel@tonic-gate out: 612*0Sstevel@tonic-gate if (res == 0 && pcr != NULL) 613*0Sstevel@tonic-gate *pcr = tcr; 614*0Sstevel@tonic-gate else 615*0Sstevel@tonic-gate crfree(tcr); 616*0Sstevel@tonic-gate return (res); 617*0Sstevel@tonic-gate } 618*0Sstevel@tonic-gate 619*0Sstevel@tonic-gate /* 620*0Sstevel@tonic-gate * Set the privilege aware bit, adding L to E/P if 621*0Sstevel@tonic-gate * necessasry. 622*0Sstevel@tonic-gate */ 623*0Sstevel@tonic-gate void 624*0Sstevel@tonic-gate priv_set_PA(cred_t *cr) 625*0Sstevel@tonic-gate { 626*0Sstevel@tonic-gate ASSERT(cr->cr_ref <= 2); 627*0Sstevel@tonic-gate 628*0Sstevel@tonic-gate if (CR_FLAGS(cr) & PRIV_AWARE) 629*0Sstevel@tonic-gate return; 630*0Sstevel@tonic-gate 631*0Sstevel@tonic-gate CR_FLAGS(cr) |= PRIV_AWARE; 632*0Sstevel@tonic-gate 633*0Sstevel@tonic-gate if (cr->cr_uid == 0) 634*0Sstevel@tonic-gate priv_union(&CR_LPRIV(cr), &CR_EPRIV(cr)); 635*0Sstevel@tonic-gate 636*0Sstevel@tonic-gate if (cr->cr_uid == 0 || cr->cr_suid == 0 || cr->cr_ruid == 0) 637*0Sstevel@tonic-gate priv_union(&CR_LPRIV(cr), &CR_PPRIV(cr)); 638*0Sstevel@tonic-gate } 639*0Sstevel@tonic-gate 640*0Sstevel@tonic-gate boolean_t 641*0Sstevel@tonic-gate priv_can_clear_PA(const cred_t *cr) 642*0Sstevel@tonic-gate { 643*0Sstevel@tonic-gate /* 644*0Sstevel@tonic-gate * We can clear PA in the following cases: 645*0Sstevel@tonic-gate * 646*0Sstevel@tonic-gate * None of the uids are 0. 647*0Sstevel@tonic-gate * Any uid == 0 and P == L and (Euid != 0 or E == L) 648*0Sstevel@tonic-gate */ 649*0Sstevel@tonic-gate return ((cr->cr_suid != 0 && cr->cr_ruid != 0 && cr->cr_uid != 0) || 650*0Sstevel@tonic-gate priv_isequalset(&CR_PPRIV(cr), &CR_LPRIV(cr)) && 651*0Sstevel@tonic-gate (cr->cr_uid != 0 || priv_isequalset(&CR_EPRIV(cr), &CR_LPRIV(cr)))); 652*0Sstevel@tonic-gate } 653*0Sstevel@tonic-gate 654*0Sstevel@tonic-gate /* 655*0Sstevel@tonic-gate * Clear privilege aware bit if it is an idempotent operation and by 656*0Sstevel@tonic-gate * clearing it the process cannot get to uid 0 and all privileges. 657*0Sstevel@tonic-gate * 658*0Sstevel@tonic-gate * This function should be called with caution as it may cause "E" to be 659*0Sstevel@tonic-gate * lost once a processes assumes euid 0 again. 660*0Sstevel@tonic-gate */ 661*0Sstevel@tonic-gate void 662*0Sstevel@tonic-gate priv_adjust_PA(cred_t *cr) 663*0Sstevel@tonic-gate { 664*0Sstevel@tonic-gate ASSERT(cr->cr_ref <= 2); 665*0Sstevel@tonic-gate 666*0Sstevel@tonic-gate if (!(CR_FLAGS(cr) & PRIV_AWARE) || 667*0Sstevel@tonic-gate !priv_can_clear_PA(cr)) 668*0Sstevel@tonic-gate return; 669*0Sstevel@tonic-gate 670*0Sstevel@tonic-gate if (CR_FLAGS(cr) & PRIV_AWARE_INHERIT) 671*0Sstevel@tonic-gate return; 672*0Sstevel@tonic-gate 673*0Sstevel@tonic-gate /* 674*0Sstevel@tonic-gate * We now need to adjust P/E in those cases when uids 675*0Sstevel@tonic-gate * are zero; the rules are P' = I & L, E' = I & L; 676*0Sstevel@tonic-gate * but since P = L and E = L, we can use P &= I, E &= I, 677*0Sstevel@tonic-gate * depending on which uids are 0. 678*0Sstevel@tonic-gate */ 679*0Sstevel@tonic-gate if (cr->cr_suid == 0 || cr->cr_ruid == 0 || cr->cr_uid == 0) { 680*0Sstevel@tonic-gate if (cr->cr_uid == 0) 681*0Sstevel@tonic-gate priv_intersect(&CR_IPRIV(cr), &CR_EPRIV(cr)); 682*0Sstevel@tonic-gate priv_intersect(&CR_IPRIV(cr), &CR_PPRIV(cr)); 683*0Sstevel@tonic-gate } 684*0Sstevel@tonic-gate 685*0Sstevel@tonic-gate CR_FLAGS(cr) &= ~PRIV_AWARE; 686*0Sstevel@tonic-gate } 687