1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2006 nCircle Network Security, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert N. M. Watson for the TrustedBSD
8 * Project under contract to nCircle Network Security, Inc.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY,
23 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
25 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32/*
33 * Privilege checking interface for BSD kernel.
34 */
35#ifndef _SYS_PRIV_H_
36#define _SYS_PRIV_H_
37
38/*
39 * Privilege list, sorted loosely by kernel subsystem.
40 *
41 * Think carefully before adding or reusing one of these privileges -- are
42 * there existing instances referring to the same privilege? Third party
43 * vendors may request the assignment of privileges to be used in loadable
44 * modules. Particular numeric privilege assignments are part of the
45 * loadable kernel module ABI, and should not be changed across minor
46 * releases.
47 *
48 * When adding a new privilege, remember to determine if it's appropriate
49 * for use in jail, and update the privilege switch in prison_priv_check()
50 * in kern_jail.c as necessary.
51 */
52
53/*
54 * Track beginning of privilege list.
55 */
56#define _PRIV_LOWEST 1
57
58/*
59 * The remaining privileges typically correspond to one or a small
60 * number of specific privilege checks, and have (relatively) precise
61 * meanings. They are loosely sorted into a set of base system
62 * privileges, such as the ability to reboot, and then loosely by
63 * subsystem, indicated by a subsystem name.
64 */
65#define _PRIV_ROOT 1 /* Removed. */
66#define PRIV_ACCT 2 /* Manage process accounting. */
67#define PRIV_MAXFILES 3 /* Exceed system open files limit. */
68#define PRIV_MAXPROC 4 /* Exceed system processes limit. */
69#define PRIV_KTRACE 5 /* Set/clear KTRFAC_ROOT on ktrace. */
70#define PRIV_SETDUMPER 6 /* Configure dump device. */
71#define PRIV_REBOOT 8 /* Can reboot system. */
72#define PRIV_SWAPON 9 /* Can swapon(). */
73#define PRIV_SWAPOFF 10 /* Can swapoff(). */
74#define PRIV_MSGBUF 11 /* Can read kernel message buffer. */
75#define PRIV_IO 12 /* Can perform low-level I/O. */
76#define PRIV_KEYBOARD 13 /* Reprogram keyboard. */
77#define PRIV_DRIVER 14 /* Low-level driver privilege. */
78#define PRIV_ADJTIME 15 /* Set time adjustment. */
79#define PRIV_NTP_ADJTIME 16 /* Set NTP time adjustment. */
80#define PRIV_CLOCK_SETTIME 17 /* Can call clock_settime. */
81#define PRIV_SETTIMEOFDAY 18 /* Can call settimeofday. */
82#define _PRIV_SETHOSTID 19 /* Removed. */
83#define _PRIV_SETDOMAINNAME 20 /* Removed. */
84
85/*
86 * Audit subsystem privileges.
87 */
88#define PRIV_AUDIT_CONTROL 40 /* Can configure audit. */
89#define PRIV_AUDIT_FAILSTOP 41 /* Can run during audit fail stop. */
90#define PRIV_AUDIT_GETAUDIT 42 /* Can get proc audit properties. */
91#define PRIV_AUDIT_SETAUDIT 43 /* Can set proc audit properties. */
92#define PRIV_AUDIT_SUBMIT 44 /* Can submit an audit record. */
93
94/*
95 * Credential management privileges.
96 */
97#define PRIV_CRED_SETUID 50 /* setuid. */
98#define PRIV_CRED_SETEUID 51 /* seteuid to !ruid and !svuid. */
99#define PRIV_CRED_SETGID 52 /* setgid. */
100#define PRIV_CRED_SETEGID 53 /* setgid to !rgid and !svgid. */
101#define PRIV_CRED_SETGROUPS 54 /* Set process additional groups. */
102#define PRIV_CRED_SETREUID 55 /* setreuid. */
103#define PRIV_CRED_SETREGID 56 /* setregid. */
104#define PRIV_CRED_SETRESUID 57 /* setresuid. */
105#define PRIV_CRED_SETRESGID 58 /* setresgid. */
106#define PRIV_SEEOTHERGIDS 59 /* Exempt bsd.seeothergids. */
107#define PRIV_SEEOTHERUIDS 60 /* Exempt bsd.seeotheruids. */
108#define PRIV_SEEJAILPROC 61 /* Exempt from bsd.see_jail_proc. */
109#define PRIV_CRED_SETCRED 62 /* setcred. */
110
111/*
112 * Debugging privileges.
113 */
114#define PRIV_DEBUG_DIFFCRED 80 /* Exempt debugging other users. */
115#define PRIV_DEBUG_SUGID 81 /* Exempt debugging setuid proc. */
116#define PRIV_DEBUG_UNPRIV 82 /* Exempt unprivileged debug limit. */
117#define PRIV_DEBUG_DENIED 83 /* Exempt P2_NOTRACE. */
118#define PRIV_DEBUG_DIFFJAIL 84 /* Exempt debugging other jails. */
119
120/*
121 * Dtrace privileges.
122 */
123#define PRIV_DTRACE_KERNEL 90 /* Allow use of DTrace on the kernel. */
124#define PRIV_DTRACE_PROC 91 /* Allow attaching DTrace to process. */
125#define PRIV_DTRACE_USER 92 /* Process may submit DTrace events. */
126
127/*
128 * Firmware privilegs.
129 */
130#define PRIV_FIRMWARE_LOAD 100 /* Can load firmware. */
131
132/*
133 * Jail privileges.
134 */
135#define PRIV_JAIL_ATTACH 110 /* Attach to a jail. */
136#define PRIV_JAIL_SET 111 /* Set jail parameters. */
137#define PRIV_JAIL_REMOVE 112 /* Remove a jail. */
138
139/*
140 * Kernel environment privileges.
141 */
142#define PRIV_KENV_SET 120 /* Set kernel env. variables. */
143#define PRIV_KENV_UNSET 121 /* Unset kernel env. variables. */
144
145/*
146 * Loadable kernel module privileges.
147 */
148#define PRIV_KLD_LOAD 130 /* Load a kernel module. */
149#define PRIV_KLD_UNLOAD 131 /* Unload a kernel module. */
150
151/*
152 * Privileges associated with the MAC Framework and specific MAC policy
153 * modules.
154 */
155#define PRIV_MAC_PARTITION 140 /* Privilege in mac_partition policy. */
156#define PRIV_MAC_PRIVS 141 /* Privilege in the mac_privs policy. */
157
158/*
159 * Process-related privileges.
160 */
161#define PRIV_PROC_LIMIT 160 /* Exceed user process limit. */
162#define PRIV_PROC_SETLOGIN 161 /* Can call setlogin. */
163#define PRIV_PROC_SETRLIMIT 162 /* Can raise resources limits. */
164#define PRIV_PROC_SETLOGINCLASS 163 /* Can call setloginclass(2). */
165
166/*
167 * System V IPC privileges.
168 */
169#define PRIV_IPC_READ 170 /* Can override IPC read perm. */
170#define PRIV_IPC_WRITE 171 /* Can override IPC write perm. */
171#define PRIV_IPC_ADMIN 172 /* Can override IPC owner-only perm. */
172#define PRIV_IPC_MSGSIZE 173 /* Exempt IPC message queue limit. */
173
174/*
175 * POSIX message queue privileges.
176 */
177#define PRIV_MQ_ADMIN 180 /* Can override msgq owner-only perm. */
178
179/*
180 * Performance monitoring counter privileges.
181 */
182#define PRIV_PMC_MANAGE 190 /* Can administer PMC. */
183#define PRIV_PMC_SYSTEM 191 /* Can allocate a system-wide PMC. */
184
185/*
186 * Scheduling privileges.
187 */
188#define PRIV_SCHED_DIFFCRED 200 /* Exempt scheduling other users. */
189#define PRIV_SCHED_SETPRIORITY 201 /* Can set lower nice value for proc. */
190#define PRIV_SCHED_RTPRIO 202 /* Can set real time scheduling. */
191#define PRIV_SCHED_SETPOLICY 203 /* Can set scheduler policy. */
192#define PRIV_SCHED_SET 204 /* Can set thread scheduler. */
193#define PRIV_SCHED_SETPARAM 205 /* Can set thread scheduler params. */
194#define PRIV_SCHED_CPUSET 206 /* Can manipulate cpusets. */
195#define PRIV_SCHED_CPUSET_INTR 207 /* Can adjust IRQ to CPU binding. */
196#define PRIV_SCHED_IDPRIO 208 /* Can set idle time scheduling. */
197#define PRIV_SCHED_DIFFJAIL 209 /* Exempt scheduling other jails. */
198
199/*
200 * POSIX semaphore privileges.
201 */
202#define PRIV_SEM_WRITE 220 /* Can override sem write perm. */
203
204/*
205 * Signal privileges.
206 */
207#define PRIV_SIGNAL_DIFFCRED 230 /* Exempt signalling other users. */
208#define PRIV_SIGNAL_SUGID 231 /* Non-conserv signal setuid proc. */
209#define PRIV_SIGNAL_DIFFJAIL 232 /* Exempt signalling other jails. */
210
211/*
212 * Sysctl privileges.
213 */
214#define PRIV_SYSCTL_DEBUG 240 /* Can invoke sysctl.debug. */
215#define PRIV_SYSCTL_WRITE 241 /* Can write sysctls. */
216#define PRIV_SYSCTL_WRITEJAIL 242 /* Can write sysctls, jail permitted. */
217#define PRIV_SYSCTL_MEMLOCK 243 /* Large requests are not serialized. */
218
219/*
220 * TTY privileges.
221 */
222#define PRIV_TTY_CONSOLE 250 /* Set console to tty. */
223#define PRIV_TTY_DRAINWAIT 251 /* Set tty drain wait time. */
224#define PRIV_TTY_DTRWAIT 252 /* Set DTR wait on tty. */
225#define PRIV_TTY_EXCLUSIVE 253 /* Override tty exclusive flag. */
226#define _PRIV_TTY_PRISON 254 /* Removed. */
227#define PRIV_TTY_STI 255 /* Simulate input on another tty. */
228#define PRIV_TTY_SETA 256 /* Set tty termios structure. */
229
230/*
231 * UFS-specific privileges.
232 */
233#define PRIV_UFS_EXTATTRCTL 270 /* Can configure EAs on UFS1. */
234#define PRIV_UFS_QUOTAOFF 271 /* quotaoff(). */
235#define PRIV_UFS_QUOTAON 272 /* quotaon(). */
236#define PRIV_UFS_SETUSE 273 /* setuse(). */
237
238/*
239 * ZFS-specific privileges.
240 */
241#define PRIV_ZFS_POOL_CONFIG 280 /* Can configure ZFS pools. */
242#define PRIV_ZFS_INJECT 281 /* Can inject faults in the ZFS fault
243 injection framework. */
244#define PRIV_ZFS_JAIL 282 /* Can attach/detach ZFS file systems
245 to/from jails. */
246
247/*
248 * NFS-specific privileges.
249 */
250#define PRIV_NFS_DAEMON 290 /* Can become the NFS daemon. */
251#define PRIV_NFS_LOCKD 291 /* Can become NFS lock daemon. */
252
253/*
254 * VFS privileges.
255 */
256#define PRIV_VFS_READ 310 /* Override vnode DAC read perm. */
257#define PRIV_VFS_WRITE 311 /* Override vnode DAC write perm. */
258#define PRIV_VFS_ADMIN 312 /* Override vnode DAC admin perm. */
259#define PRIV_VFS_EXEC 313 /* Override vnode DAC exec perm. */
260#define PRIV_VFS_LOOKUP 314 /* Override vnode DAC lookup perm. */
261#define PRIV_VFS_BLOCKRESERVE 315 /* Can use free block reserve. */
262#define PRIV_VFS_CHFLAGS_DEV 316 /* Can chflags() a device node. */
263#define PRIV_VFS_CHOWN 317 /* Can set user; group to non-member. */
264#define PRIV_VFS_CHROOT 318 /* chroot(). */
265#define PRIV_VFS_RETAINSUGID 319 /* Can retain sugid bits on change. */
266#define PRIV_VFS_EXCEEDQUOTA 320 /* Exempt from quota restrictions. */
267#define PRIV_VFS_EXTATTR_SYSTEM 321 /* Operate on system EA namespace. */
268#define PRIV_VFS_FCHROOT 322 /* fchroot(). */
269#define PRIV_VFS_FHOPEN 323 /* Can fhopen(). */
270#define PRIV_VFS_FHSTAT 324 /* Can fhstat(). */
271#define PRIV_VFS_FHSTATFS 325 /* Can fhstatfs(). */
272#define PRIV_VFS_GENERATION 326 /* stat() returns generation number. */
273#define PRIV_VFS_GETFH 327 /* Can retrieve file handles. */
274#define PRIV_VFS_GETQUOTA 328 /* getquota(). */
275#define PRIV_VFS_LINK 329 /* bsd.hardlink_check_uid */
276#define PRIV_VFS_MKNOD_BAD 330 /* Was: mknod() can mark bad inodes. */
277#define PRIV_VFS_MKNOD_DEV 331 /* Can mknod() to create dev nodes. */
278#define PRIV_VFS_MKNOD_WHT 332 /* Can mknod() to create whiteout. */
279#define PRIV_VFS_MOUNT 333 /* Can mount(). */
280#define PRIV_VFS_MOUNT_OWNER 334 /* Can manage other users' file systems. */
281#define PRIV_VFS_MOUNT_EXPORTED 335 /* Can set MNT_EXPORTED on mount. */
282#define PRIV_VFS_MOUNT_PERM 336 /* Override dev node perms at mount. */
283#define PRIV_VFS_MOUNT_SUIDDIR 337 /* Can set MNT_SUIDDIR on mount. */
284#define PRIV_VFS_MOUNT_NONUSER 338 /* Can perform a non-user mount. */
285#define PRIV_VFS_SETGID 339 /* Can setgid if not in group. */
286#define PRIV_VFS_SETQUOTA 340 /* setquota(). */
287#define PRIV_VFS_STICKYFILE 341 /* Can set sticky bit on file. */
288#define PRIV_VFS_SYSFLAGS 342 /* Can modify system flags. */
289#define PRIV_VFS_UNMOUNT 343 /* Can unmount(). */
290#define PRIV_VFS_STAT 344 /* Override vnode MAC stat perm. */
291#define PRIV_VFS_READ_DIR 345 /* Can read(2) a dirfd, needs sysctl. */
292
293/*
294 * Virtual memory privileges.
295 */
296#define PRIV_VM_MADV_PROTECT 360 /* Can set MADV_PROTECT. */
297#define PRIV_VM_MLOCK 361 /* Can mlock(), mlockall(). */
298#define PRIV_VM_MUNLOCK 362 /* Can munlock(), munlockall(). */
299#define PRIV_VM_SWAP_NOQUOTA 363 /*
300 * Can override the global
301 * swap reservation limits.
302 */
303#define PRIV_VM_SWAP_NORLIMIT 364 /*
304 * Can override the per-uid
305 * swap reservation limits.
306 */
307
308/*
309 * Device file system privileges.
310 */
311#define PRIV_DEVFS_RULE 370 /* Can manage devfs rules. */
312#define PRIV_DEVFS_SYMLINK 371 /* Can create symlinks in devfs. */
313
314/*
315 * Random number generator privileges.
316 */
317#define PRIV_RANDOM_RESEED 380 /* Closing /dev/random reseeds. */
318
319/*
320 * Network stack privileges.
321 */
322#define PRIV_NET_BRIDGE 390 /* Administer bridge. */
323#define PRIV_NET_GRE 391 /* Administer GRE. */
324#define _PRIV_NET_PPP 392 /* Removed. */
325#define _PRIV_NET_SLIP 393 /* Removed. */
326#define PRIV_NET_BPF 394 /* Monitor BPF. */
327#define PRIV_NET_RAW 395 /* Open raw socket. */
328#define PRIV_NET_ROUTE 396 /* Administer routing. */
329#define PRIV_NET_TAP 397 /* Can open tap device. */
330#define PRIV_NET_SETIFMTU 398 /* Set interface MTU. */
331#define PRIV_NET_SETIFFLAGS 399 /* Set interface flags. */
332#define PRIV_NET_SETIFCAP 400 /* Set interface capabilities. */
333#define PRIV_NET_SETIFNAME 401 /* Set interface name. */
334#define PRIV_NET_SETIFMETRIC 402 /* Set interface metrics. */
335#define PRIV_NET_SETIFPHYS 403 /* Set interface physical layer prop. */
336#define PRIV_NET_SETIFMAC 404 /* Set interface MAC label. */
337#define PRIV_NET_ADDMULTI 405 /* Add multicast addr. to ifnet. */
338#define PRIV_NET_DELMULTI 406 /* Delete multicast addr. from ifnet. */
339#define PRIV_NET_HWIOCTL 407 /* Issue hardware ioctl on ifnet. */
340#define PRIV_NET_SETLLADDR 408 /* Set interface link-level address. */
341#define PRIV_NET_ADDIFGROUP 409 /* Add new interface group. */
342#define PRIV_NET_DELIFGROUP 410 /* Delete interface group. */
343#define PRIV_NET_IFCREATE 411 /* Create cloned interface. */
344#define PRIV_NET_IFDESTROY 412 /* Destroy cloned interface. */
345#define PRIV_NET_ADDIFADDR 413 /* Add protocol addr to interface. */
346#define PRIV_NET_DELIFADDR 414 /* Delete protocol addr on interface. */
347#define PRIV_NET_LAGG 415 /* Administer lagg interface. */
348#define PRIV_NET_GIF 416 /* Administer gif interface. */
349#define PRIV_NET_SETIFVNET 417 /* Move interface to vnet. */
350#define PRIV_NET_SETIFDESCR 418 /* Set interface description. */
351#define PRIV_NET_SETIFFIB 419 /* Set interface fib. */
352#define PRIV_NET_VXLAN 420 /* Administer vxlan. */
353#define PRIV_NET_SETLANPCP 421 /* Set LAN priority. */
354#define PRIV_NET_SETVLANPCP PRIV_NET_SETLANPCP /* Alias Set VLAN priority */
355#define PRIV_NET_OVPN 422 /* Administer OpenVPN DCO. */
356#define PRIV_NET_ME 423 /* Administer ME interface. */
357#define PRIV_NET_WG 424 /* Administer WireGuard interface. */
358
359/*
360 * 802.11-related privileges.
361 */
362#define PRIV_NET80211_VAP_GETKEY 440 /* Query VAP 802.11 keys. */
363#define PRIV_NET80211_VAP_MANAGE 441 /* Administer 802.11 VAP */
364#define PRIV_NET80211_VAP_SETMAC 442 /* Set VAP MAC address */
365#define PRIV_NET80211_CREATE_VAP 443 /* Create a new VAP */
366
367/*
368 * Placeholder for AppleTalk privileges, not supported anymore.
369 */
370#define _PRIV_NETATALK_RESERVEDPORT 450 /* Bind low port number. */
371
372/*
373 * ATM privileges.
374 */
375#define PRIV_NETATM_CFG 460
376#define PRIV_NETATM_ADD 461
377#define PRIV_NETATM_DEL 462
378#define PRIV_NETATM_SET 463
379
380/*
381 * Bluetooth privileges.
382 */
383#define PRIV_NETBLUETOOTH_RAW 470 /* Open raw bluetooth socket. */
384
385/*
386 * Netgraph and netgraph module privileges.
387 */
388#define PRIV_NETGRAPH_CONTROL 480 /* Open netgraph control socket. */
389#define PRIV_NETGRAPH_TTY 481 /* Configure tty for netgraph. */
390
391/*
392 * IPv4 and IPv6 privileges.
393 */
394#define PRIV_NETINET_RESERVEDPORT 490 /* Bind low port number. */
395#define PRIV_NETINET_IPFW 491 /* Administer IPFW firewall. */
396#define PRIV_NETINET_DIVERT 492 /* Open IP divert socket. */
397#define PRIV_NETINET_PF 493 /* Administer pf firewall. */
398#define PRIV_NETINET_DUMMYNET 494 /* Administer DUMMYNET. */
399#define PRIV_NETINET_CARP 495 /* Administer CARP. */
400#define PRIV_NETINET_MROUTE 496 /* Administer multicast routing. */
401#define PRIV_NETINET_RAW 497 /* Open netinet raw socket. */
402#define PRIV_NETINET_GETCRED 498 /* Query netinet pcb credentials. */
403#define PRIV_NETINET_ADDRCTRL6 499 /* Administer IPv6 address scopes. */
404#define PRIV_NETINET_ND6 500 /* Administer IPv6 neighbor disc. */
405#define PRIV_NETINET_SCOPE6 501 /* Administer IPv6 address scopes. */
406#define PRIV_NETINET_ALIFETIME6 502 /* Administer IPv6 address lifetimes. */
407#define PRIV_NETINET_IPSEC 503 /* Administer IPSEC. */
408#define PRIV_NETINET_REUSEPORT 504 /* Allow [rapid] port/address reuse. */
409#define PRIV_NETINET_SETHDROPTS 505 /* Set certain IPv4/6 header options. */
410#define PRIV_NETINET_BINDANY 506 /* Allow bind to any address. */
411#define PRIV_NETINET_HASHKEY 507 /* Get and set hash keys for IPv4/6. */
412#define PRIV_NETINET_KTLSKEYS 508 /* Read ktls session keys. */
413
414/*
415 * Placeholders for IPX/SPX privileges, not supported any more.
416 */
417#define _PRIV_NETIPX_RESERVEDPORT 520 /* Bind low port number. */
418#define _PRIV_NETIPX_RAW 521 /* Open netipx raw socket. */
419
420/*
421 * NCP privileges.
422 */
423#define PRIV_NETNCP 530 /* Use another user's connection. */
424
425/*
426 * SMB privileges.
427 */
428#define PRIV_NETSMB 540 /* Use another user's connection. */
429
430/*
431 * VM86 privileges.
432 */
433#define PRIV_VM86_INTCALL 550 /* Allow invoking vm86 int handlers. */
434
435#define PRIV_PIPEBUF 560 /* Allow to allocate reserved pipebuf
436 space */
437
438/*
439 * Set of reserved privilege values, which will be allocated to code as
440 * needed, in order to avoid renumbering later privileges due to insertion.
441 */
442#define _PRIV_RESERVED1 561
443#define _PRIV_RESERVED2 562
444#define _PRIV_RESERVED3 563
445#define _PRIV_RESERVED4 564
446#define _PRIV_RESERVED5 565
447#define _PRIV_RESERVED6 566
448#define _PRIV_RESERVED7 567
449#define _PRIV_RESERVED8 568
450#define _PRIV_RESERVED9 569
451#define _PRIV_RESERVED10 570
452#define _PRIV_RESERVED11 571
453#define _PRIV_RESERVED12 572
454#define _PRIV_RESERVED13 573
455#define _PRIV_RESERVED14 574
456#define _PRIV_RESERVED15 575
457
458/*
459 * Define a set of valid privilege numbers that can be used by loadable
460 * modules that don't yet have privilege reservations. Ideally, these should
461 * not be used, since their meaning is opaque to any policies that are aware
462 * of specific privileges, such as jail, and as such may be arbitrarily
463 * denied.
464 */
465#define PRIV_MODULE0 600
466#define PRIV_MODULE1 601
467#define PRIV_MODULE2 602
468#define PRIV_MODULE3 603
469#define PRIV_MODULE4 604
470#define PRIV_MODULE5 605
471#define PRIV_MODULE6 606
472#define PRIV_MODULE7 607
473#define PRIV_MODULE8 608
474#define PRIV_MODULE9 609
475#define PRIV_MODULE10 610
476#define PRIV_MODULE11 611
477#define PRIV_MODULE12 612
478#define PRIV_MODULE13 613
479#define PRIV_MODULE14 614
480#define PRIV_MODULE15 615
481
482/*
483 * DDB(4) privileges.
484 */
485#define PRIV_DDB_CAPTURE 620 /* Allow reading of DDB capture log. */
486
487/*
488 * Arla/nnpfs privileges.
489 */
490#define PRIV_NNPFS_DEBUG 630 /* Perforn ARLA_VIOC_NNPFSDEBUG. */
491
492/*
493 * cpuctl(4) privileges.
494 */
495#define PRIV_CPUCTL_WRMSR 640 /* Write model-specific register. */
496#define PRIV_CPUCTL_UPDATE 641 /* Update cpu microcode. */
497
498/*
499 * Capi4BSD privileges.
500 */
501#define PRIV_C4B_RESET_CTLR 650 /* Load firmware, reset controller. */
502#define PRIV_C4B_TRACE 651 /* Unrestricted CAPI message tracing. */
503
504/*
505 * OpenAFS privileges.
506 */
507#define PRIV_AFS_ADMIN 660 /* Can change AFS client settings. */
508#define PRIV_AFS_DAEMON 661 /* Can become the AFS daemon. */
509
510/*
511 * Resource Limits privileges.
512 */
513#define PRIV_RCTL_GET_RACCT 670
514#define PRIV_RCTL_GET_RULES 671
515#define PRIV_RCTL_GET_LIMITS 672
516#define PRIV_RCTL_ADD_RULE 673
517#define PRIV_RCTL_REMOVE_RULE 674
518
519/*
520 * mem(4) privileges.
521 */
522#define PRIV_KMEM_READ 680 /* Open mem/kmem for reading. */
523#define PRIV_KMEM_WRITE 681 /* Open mem/kmem for writing. */
524#define PRIV_PROC_MEM_WRITE 682 /* Writes via proc_rwmem */
525
526/*
527 * Kernel debugger privileges.
528 */
529#define PRIV_KDB_SET_BACKEND 690 /* Allow setting KDB backend. */
530
531/*
532 * veriexec override privileges - very rare!
533 */
534#define PRIV_VERIEXEC_DIRECT 700 /* Can override 'indirect' */
535#define PRIV_VERIEXEC_NOVERIFY 701 /* Can override O_VERIFY */
536#define PRIV_VERIEXEC_CONTROL 702 /* Can configure veriexec */
537
538/*
539 * Track end of privilege list.
540 */
541#define _PRIV_HIGHEST 703
542
543/*
544 * Validate that a named privilege is known by the privilege system. Invalid
545 * privileges presented to the privilege system by a priv_check interface
546 * will result in a panic. This is only approximate due to sparse allocation
547 * of the privilege space.
548 */
549#define PRIV_VALID(x) ((x) > _PRIV_LOWEST && (x) < _PRIV_HIGHEST)
550
551#ifdef _KERNEL
552/*
553 * Privilege check interfaces, modeled after historic suser() interfaces, but
554 * with the addition of a specific privilege name. No flags are currently
555 * defined for the API. Historically, flags specified using the real uid
556 * instead of the effective uid, and whether or not the check should be
557 * allowed in jail.
558 */
559struct thread;
560struct ucred;
561int priv_check(struct thread *td, int priv);
562int priv_check_cred(struct ucred *cred, int priv);
563int priv_check_cred_vfs_lookup(struct ucred *cred);
564int priv_check_cred_vfs_lookup_nomac(struct ucred *cred);
565int priv_check_cred_vfs_generation(struct ucred *cred);
566#endif
567
568#endif /* !_SYS_PRIV_H_ */