2 * Copyright (c) 2006 nCircle Network Security, Inc.
5 * This software was developed by Robert N. M. Watson for the TrustedBSD
6 * Project under contract to nCircle Network Security, Inc.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY,
21 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
22 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
23 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
24 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
25 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
26 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 * Privilege checking interface for BSD kernel.
39 * Privilege list. In no particular order.
41 * Think carefully before adding or reusing one of these privileges -- are
42 * there existing instances referring to the same privilege? Third party
43 * vendors may request the assignment of privileges to be used in loadable
44 * modules. Particular numeric privilege assignments are part of the
45 * loadable kernel module ABI, and should not be changed across minor
48 * When adding a new privilege, remember to determine if it's appropriate for
49 * use in jail, and update the privilege switch in kern_jail.c as necessary.
53 * Track beginning of privilege list.
55 #define _PRIV_LOWEST 0
58 * PRIV_ROOT is a catch-all for as yet unnamed privileges. No new
59 * references to this privilege should be added.
61 #define PRIV_ROOT 1 /* Catch-all during development. */
64 * The remaining privileges typically correspond to one or a small
65 * number of specific privilege checks, and have (relatively) precise
66 * meanings. They are loosely sorted into a set of base system
67 * privileges, such as the ability to reboot, and then loosely by
68 * subsystem, indicated by a subsystem name.
70 #define PRIV_ACCT 2 /* Manage process accounting. */
71 #define PRIV_MAXFILES 3 /* Exceed system open files limit. */
72 #define PRIV_MAXPROC 4 /* Exceed system processes limit. */
73 #define PRIV_KTRACE 5 /* Set/clear KTRFAC_ROOT on ktrace. */
74 #define PRIV_SETDUMPER 6 /* Configure dump device. */
75 #define PRIV_REBOOT 8 /* Can reboot system. */
76 #define PRIV_SWAPON 9 /* Can swapon(). */
77 #define PRIV_SWAPOFF 10 /* Can swapoff(). */
78 #define PRIV_MSGBUF 11 /* Can read kernel message buffer. */
79 #define PRIV_IO 12 /* Can perform low-level I/O. */
80 #define PRIV_KEYBOARD 13 /* Reprogram keyboard. */
81 #define PRIV_DRIVER 14 /* Low-level driver privilege. */
82 #define PRIV_ADJTIME 15 /* Set time adjustment. */
83 #define PRIV_NTP_ADJTIME 16 /* Set NTP time adjustment. */
84 #define PRIV_CLOCK_SETTIME 17 /* Can call clock_settime. */
85 #define PRIV_SETTIMEOFDAY 18 /* Can call settimeofday. */
86 #define PRIV_SETHOSTID 19 /* Can call sethostid. */
87 #define PRIV_SETDOMAINNAME 20 /* Can call setdomainname. */
90 * Audit subsystem privileges.
92 #define PRIV_AUDIT_CONTROL 40 /* Can configure audit. */
93 #define PRIV_AUDIT_FAILSTOP 41 /* Can run during audit fail stop. */
94 #define PRIV_AUDIT_GETAUDIT 42 /* Can get proc audit properties. */
95 #define PRIV_AUDIT_SETAUDIT 43 /* Can set proc audit properties. */
96 #define PRIV_AUDIT_SUBMIT 44 /* Can submit an audit record. */
99 * Credential management privileges.
101 #define PRIV_CRED_SETUID 50 /* setuid. */
102 #define PRIV_CRED_SETEUID 51 /* seteuid to !ruid and !svuid. */
103 #define PRIV_CRED_SETGID 52 /* setgid. */
104 #define PRIV_CRED_SETEGID 53 /* setgid to !rgid and !svgid. */
105 #define PRIV_CRED_SETGROUPS 54 /* Set process additional groups. */
106 #define PRIV_CRED_SETREUID 55 /* setreuid. */
107 #define PRIV_CRED_SETREGID 56 /* setregid. */
108 #define PRIV_CRED_SETRESUID 57 /* setresuid. */
109 #define PRIV_CRED_SETRESGID 58 /* setresgid. */
110 #define PRIV_SEEOTHERGIDS 59 /* Exempt bsd.seeothergids. */
111 #define PRIV_SEEOTHERUIDS 60 /* Exempt bsd.seeotheruids. */
114 * Debugging privileges.
116 #define PRIV_DEBUG_DIFFCRED 80 /* Exempt debugging other users. */
117 #define PRIV_DEBUG_SUGID 81 /* Exempt debugging setuid proc. */
118 #define PRIV_DEBUG_UNPRIV 82 /* Exempt unprivileged debug limit. */
123 #define PRIV_DTRACE_KERNEL 90 /* Allow use of DTrace on the kernel. */
124 #define PRIV_DTRACE_PROC 91 /* Allow attaching DTrace to process. */
125 #define PRIV_DTRACE_USER 92 /* Process may submit DTrace events. */
128 * Firmware privilegs.
130 #define PRIV_FIRMWARE_LOAD 100 /* Can load firmware. */
135 #define PRIV_JAIL_ATTACH 110 /* Attach to a jail. */
138 * Kernel environment priveleges.
140 #define PRIV_KENV_SET 120 /* Set kernel env. variables. */
141 #define PRIV_KENV_UNSET 121 /* Unset kernel env. variables. */
144 * Loadable kernel module privileges.
146 #define PRIV_KLD_LOAD 130 /* Load a kernel module. */
147 #define PRIV_KLD_UNLOAD 131 /* Unload a kernel module. */
150 * Privileges associated with the MAC Framework and specific MAC policy
153 #define PRIV_MAC_PARTITION 140 /* Privilege in mac_partition policy. */
154 #define PRIV_MAC_PRIVS 141 /* Privilege in the mac_privs policy. */
157 * Process-related privileges.
159 #define PRIV_PROC_LIMIT 160 /* Exceed user process limit. */
160 #define PRIV_PROC_SETLOGIN 161 /* Can call setlogin. */
161 #define PRIV_PROC_SETRLIMIT 162 /* Can raise resources limits. */
163 /* System V IPC privileges.
165 #define PRIV_IPC_READ 170 /* Can override IPC read perm. */
166 #define PRIV_IPC_WRITE 171 /* Can override IPC write perm. */
167 #define PRIV_IPC_ADMIN 172 /* Can override IPC owner-only perm. */
168 #define PRIV_IPC_MSGSIZE 173 /* Exempt IPC message queue limit. */
171 * POSIX message queue privileges.
173 #define PRIV_MQ_ADMIN 180 /* Can override msgq owner-only perm. */
176 * Performance monitoring counter privileges.
178 #define PRIV_PMC_MANAGE 190 /* Can administer PMC. */
179 #define PRIV_PMC_SYSTEM 191 /* Can allocate a system-wide PMC. */
182 * Scheduling privileges.
184 #define PRIV_SCHED_DIFFCRED 200 /* Exempt scheduling other users. */
185 #define PRIV_SCHED_SETPRIORITY 201 /* Can set lower nice value for proc. */
186 #define PRIV_SCHED_RTPRIO 202 /* Can set real time scheduling. */
187 #define PRIV_SCHED_SETPOLICY 203 /* Can set scheduler policy. */
188 #define PRIV_SCHED_SET 204 /* Can set thread scheduler. */
189 #define PRIV_SCHED_SETPARAM 205 /* Can set thread scheduler params. */
192 * POSIX semaphore privileges.
194 #define PRIV_SEM_WRITE 220 /* Can override sem write perm. */
199 #define PRIV_SIGNAL_DIFFCRED 230 /* Exempt signalling other users. */
200 #define PRIV_SIGNAL_SUGID 231 /* Non-conserv signal setuid proc. */
205 #define PRIV_SYSCTL_DEBUG 240 /* Can invoke sysctl.debug. */
206 #define PRIV_SYSCTL_WRITE 241 /* Can write sysctls. */
207 #define PRIV_SYSCTL_WRITEJAIL 242 /* Can write sysctls, jail permitted. */
212 #define PRIV_TTY_CONSOLE 250 /* Set console to tty. */
213 #define PRIV_TTY_DRAINWAIT 251 /* Set tty drain wait time. */
214 #define PRIV_TTY_DTRWAIT 252 /* Set DTR wait on tty. */
215 #define PRIV_TTY_EXCLUSIVE 253 /* Override tty exclusive flag. */
216 #define PRIV_TTY_PRISON 254 /* Can open pts across jails. */
217 #define PRIV_TTY_STI 255 /* Simulate input on another tty. */
218 #define PRIV_TTY_SETA 256 /* Set tty termios structure. */
221 * UFS-specific privileges.
223 #define PRIV_UFS_EXTATTRCTL 270 /* Can configure EAs on UFS1. */
224 #define PRIV_UFS_QUOTAOFF 271 /* quotaoff(). */
225 #define PRIV_UFS_QUOTAON 272 /* quotaon(). */
226 #define PRIV_UFS_SETUSE 273 /* setuse(). */
229 * ZFS-specific privileges.
231 #define PRIV_ZFS_POOL_CONFIG 280 /* Can configure ZFS pools. */
232 #define PRIV_ZFS_INJECT 281 /* Can inject faults in the ZFS fault
233 injection framework. */
234 #define PRIV_ZFS_JAIL 282 /* Can attach/detach ZFS file systems
238 * NFS-specific privileges.
240 #define PRIV_NFS_DAEMON 290 /* Can become the NFS daemon. */
241 #define PRIV_NFS_LOCKD 291 /* Can become NFS lock daemon. */
246 #define PRIV_VFS_READ 310 /* Override vnode DAC read perm. */
247 #define PRIV_VFS_WRITE 311 /* Override vnode DAC write perm. */
248 #define PRIV_VFS_ADMIN 312 /* Override vnode DAC admin perm. */
249 #define PRIV_VFS_EXEC 313 /* Override vnode DAC exec perm. */
250 #define PRIV_VFS_LOOKUP 314 /* Override vnode DAC lookup perm. */
251 #define PRIV_VFS_BLOCKRESERVE 315 /* Can use free block reserve. */
252 #define PRIV_VFS_CHFLAGS_DEV 316 /* Can chflags() a device node. */
253 #define PRIV_VFS_CHOWN 317 /* Can set user; group to non-member. */
254 #define PRIV_VFS_CHROOT 318 /* chroot(). */
255 #define PRIV_VFS_RETAINSUGID 319 /* Can retain sugid bits on change. */
256 #define PRIV_VFS_EXCEEDQUOTA 320 /* Exempt from quota restrictions. */
257 #define PRIV_VFS_EXTATTR_SYSTEM 321 /* Operate on system EA namespace. */
258 #define PRIV_VFS_FCHROOT 322 /* fchroot(). */
259 #define PRIV_VFS_FHOPEN 323 /* Can fhopen(). */
260 #define PRIV_VFS_FHSTAT 324 /* Can fhstat(). */
261 #define PRIV_VFS_FHSTATFS 325 /* Can fhstatfs(). */
262 #define PRIV_VFS_GENERATION 326 /* stat() returns generation number. */
263 #define PRIV_VFS_GETFH 327 /* Can retrieve file handles. */
264 #define PRIV_VFS_GETQUOTA 328 /* getquota(). */
265 #define PRIV_VFS_LINK 329 /* bsd.hardlink_check_uid */
266 #define PRIV_VFS_MKNOD_BAD 330 /* Can mknod() to mark bad inodes. */
267 #define PRIV_VFS_MKNOD_DEV 331 /* Can mknod() to create dev nodes. */
268 #define PRIV_VFS_MKNOD_WHT 332 /* Can mknod() to create whiteout. */
269 #define PRIV_VFS_MOUNT 333 /* Can mount(). */
270 #define PRIV_VFS_MOUNT_OWNER 334 /* Override owner on user mounts. */
271 #define PRIV_VFS_MOUNT_EXPORTED 335 /* Can set MNT_EXPORTED on mount. */
272 #define PRIV_VFS_MOUNT_PERM 336 /* Override dev node perms at mount. */
273 #define PRIV_VFS_MOUNT_SUIDDIR 337 /* Can set MNT_SUIDDIR on mount. */
274 #define PRIV_VFS_MOUNT_NONUSER 338 /* Can perform a non-user mount. */
275 #define PRIV_VFS_SETGID 339 /* Can setgid if not in group. */
276 #define PRIV_VFS_SETQUOTA 340 /* setquota(). */
277 #define PRIV_VFS_STICKYFILE 341 /* Can set sticky bit on file. */
278 #define PRIV_VFS_SYSFLAGS 342 /* Can modify system flags. */
279 #define PRIV_VFS_UNMOUNT 343 /* Can unmount(). */
282 * Virtual memory privileges.
284 #define PRIV_VM_MADV_PROTECT 360 /* Can set MADV_PROTECT. */
285 #define PRIV_VM_MLOCK 361 /* Can mlock(), mlockall(). */
286 #define PRIV_VM_MUNLOCK 362 /* Can munlock(), munlockall(). */
289 * Device file system privileges.
291 #define PRIV_DEVFS_RULE 370 /* Can manage devfs rules. */
292 #define PRIV_DEVFS_SYMLINK 371 /* Can create symlinks in devfs. */
295 * Random number generator privileges.
297 #define PRIV_RANDOM_RESEED 380 /* Closing /dev/random reseeds. */
300 * Network stack privileges.
302 #define PRIV_NET_BRIDGE 390 /* Administer bridge. */
303 #define PRIV_NET_GRE 391 /* Administer GRE. */
304 #define PRIV_NET_PPP 392 /* Administer PPP. */
305 #define PRIV_NET_SLIP 393 /* Administer SLIP. */
306 #define PRIV_NET_BPF 394 /* Monitor BPF. */
307 #define PRIV_NET_RAW 395 /* Open raw socket. */
308 #define PRIV_NET_ROUTE 396 /* Administer routing. */
309 #define PRIV_NET_TAP 397 /* Can open tap device. */
310 #define PRIV_NET_SETIFMTU 398 /* Set interface MTU. */
311 #define PRIV_NET_SETIFFLAGS 399 /* Set interface flags. */
312 #define PRIV_NET_SETIFCAP 400 /* Set interface capabilities. */
313 #define PRIV_NET_SETIFNAME 401 /* Set interface name. */
314 #define PRIV_NET_SETIFMETRIC 402 /* Set interface metrics. */
315 #define PRIV_NET_SETIFPHYS 403 /* Set interface physical layer prop. */
316 #define PRIV_NET_SETIFMAC 404 /* Set interface MAC label. */
317 #define PRIV_NET_ADDMULTI 405 /* Add multicast addr. to ifnet. */
318 #define PRIV_NET_DELMULTI 406 /* Delete multicast addr. from ifnet. */
319 #define PRIV_NET_HWIOCTL 407 /* Issue hardware ioctl on ifnet. */
320 #define PRIV_NET_SETLLADDR 408 /* Set interface link-level address. */
321 #define PRIV_NET_ADDIFGROUP 409 /* Add new interface group. */
322 #define PRIV_NET_DELIFGROUP 410 /* Delete interface group. */
323 #define PRIV_NET_IFCREATE 411 /* Create cloned interface. */
324 #define PRIV_NET_IFDESTROY 412 /* Destroy cloned interface. */
325 #define PRIV_NET_ADDIFADDR 413 /* Add protocol addr to interface. */
326 #define PRIV_NET_DELIFADDR 414 /* Delete protocol addr on interface. */
327 #define PRIV_NET_LAGG 415 /* Administer lagg interface. */
330 * 802.11-related privileges.
332 #define PRIV_NET80211_GETKEY 440 /* Query 802.11 keys. */
333 #define PRIV_NET80211_MANAGE 441 /* Administer 802.11. */
336 * AppleTalk privileges.
338 #define PRIV_NETATALK_RESERVEDPORT 450 /* Bind low port number. */
343 #define PRIV_NETATM_CFG 460
344 #define PRIV_NETATM_ADD 461
345 #define PRIV_NETATM_DEL 462
346 #define PRIV_NETATM_SET 463
349 * Bluetooth privileges.
351 #define PRIV_NETBLUETOOTH_RAW 470 /* Open raw bluetooth socket. */
354 * Netgraph and netgraph module privileges.
356 #define PRIV_NETGRAPH_CONTROL 480 /* Open netgraph control socket. */
357 #define PRIV_NETGRAPH_TTY 481 /* Configure tty for netgraph. */
360 * IPv4 and IPv6 privileges.
362 #define PRIV_NETINET_RESERVEDPORT 490 /* Bind low port number. */
363 #define PRIV_NETINET_IPFW 491 /* Administer IPFW firewall. */
364 #define PRIV_NETINET_DIVERT 492 /* Open IP divert socket. */
365 #define PRIV_NETINET_PF 493 /* Administer pf firewall. */
366 #define PRIV_NETINET_DUMMYNET 494 /* Administer DUMMYNET. */
367 #define PRIV_NETINET_CARP 495 /* Administer CARP. */
368 #define PRIV_NETINET_MROUTE 496 /* Administer multicast routing. */
369 #define PRIV_NETINET_RAW 497 /* Open netinet raw socket. */
370 #define PRIV_NETINET_GETCRED 498 /* Query netinet pcb credentials. */
371 #define PRIV_NETINET_ADDRCTRL6 499 /* Administer IPv6 address scopes. */
372 #define PRIV_NETINET_ND6 500 /* Administer IPv6 neighbor disc. */
373 #define PRIV_NETINET_SCOPE6 501 /* Administer IPv6 address scopes. */
374 #define PRIV_NETINET_ALIFETIME6 502 /* Administer IPv6 address lifetimes. */
375 #define PRIV_NETINET_IPSEC 503 /* Administer IPSEC. */
376 #define PRIV_NETINET_REUSEPORT 504 /* Allow [rapid] port/address reuse. */
379 * IPX/SPX privileges.
381 #define PRIV_NETIPX_RESERVEDPORT 520 /* Bind low port number. */
382 #define PRIV_NETIPX_RAW 521 /* Open netipx raw socket. */
387 #define PRIV_NETNCP 530 /* Use another user's connection. */
392 #define PRIV_NETSMB 540 /* Use another user's connection. */
397 #define PRIV_VM86_INTCALL 550 /* Allow invoking vm86 int handlers. */
400 * Set of reserved privilege values, which will be allocated to code as
401 * needed, in order to avoid renumbering later privileges due to insertion.
403 #define _PRIV_RESERVED0 560
404 #define _PRIV_RESERVED1 561
405 #define _PRIV_RESERVED2 562
406 #define _PRIV_RESERVED3 563
407 #define _PRIV_RESERVED4 564
408 #define _PRIV_RESERVED5 565
409 #define _PRIV_RESERVED6 566
410 #define _PRIV_RESERVED7 567
411 #define _PRIV_RESERVED8 568
412 #define _PRIV_RESERVED9 569
413 #define _PRIV_RESERVED10 570
414 #define _PRIV_RESERVED11 571
415 #define _PRIV_RESERVED12 572
416 #define _PRIV_RESERVED13 573
417 #define _PRIV_RESERVED14 574
418 #define _PRIV_RESERVED15 575
421 * Define a set of valid privilege numbers that can be used by loadable
422 * modules that don't yet have privilege reservations. Ideally, these should
423 * not be used, since their meaning is opaque to any policies that are aware
424 * of specific privileges, such as jail, and as such may be arbitrarily
427 #define PRIV_MODULE0 600
428 #define PRIV_MODULE1 601
429 #define PRIV_MODULE2 602
430 #define PRIV_MODULE3 603
431 #define PRIV_MODULE4 604
432 #define PRIV_MODULE5 605
433 #define PRIV_MODULE6 606
434 #define PRIV_MODULE7 607
435 #define PRIV_MODULE8 608
436 #define PRIV_MODULE9 609
437 #define PRIV_MODULE10 610
438 #define PRIV_MODULE11 611
439 #define PRIV_MODULE12 612
440 #define PRIV_MODULE13 613
441 #define PRIV_MODULE14 614
442 #define PRIV_MODULE15 615
445 * Track end of privilege list.
447 #define _PRIV_HIGHEST 616
450 * Validate that a named privilege is known by the privilege system. Invalid
451 * privileges presented to the privilege system by a priv_check interface
452 * will result in a panic. This is only approximate due to sparse allocation
453 * of the privilege space.
455 #define PRIV_VALID(x) ((x) > _PRIV_LOWEST && (x) < _PRIV_HIGHEST)
459 * Privilege check interfaces, modeled after historic suser() interfacs, but
460 * with the addition of a specific privilege name. No flags are currently
461 * defined for the API. Historically, flags specified using the real uid
462 * instead of the effective uid, and whether or not the check should be
467 int priv_check(struct thread *td, int priv);
468 int priv_check_cred(struct ucred *cred, int priv, int flags);
471 * Continue to support external modules that rely on suser(9) -- for now.
473 int suser(struct thread *td);
474 int suser_cred(struct ucred *cred, int flags);
477 #endif /* !_SYS_PRIV_H_ */