| 1 | /*- |
| 2 | * SPDX-License-Identifier: BSD-2-Clause |
| 3 | * |
| 4 | * Copyright (c) 2006 nCircle Network Security, Inc. |
| 5 | * All rights reserved. |
| 6 | * |
| 7 | * This software was developed by Robert N. M. Watson for the TrustedBSD |
| 8 | * Project under contract to nCircle Network Security, Inc. |
| 9 | * |
| 10 | * Redistribution and use in source and binary forms, with or without |
| 11 | * modification, are permitted provided that the following conditions |
| 12 | * are met: |
| 13 | * 1. Redistributions of source code must retain the above copyright |
| 14 | * notice, this list of conditions and the following disclaimer. |
| 15 | * 2. Redistributions in binary form must reproduce the above copyright |
| 16 | * notice, this list of conditions and the following disclaimer in the |
| 17 | * documentation and/or other materials provided with the distribution. |
| 18 | * |
| 19 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND |
| 20 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 21 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 22 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY, |
| 23 | * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 24 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED |
| 25 | * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
| 26 | * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 27 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
| 28 | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
| 29 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 30 | */ |
| 31 | |
| 32 | /* |
| 33 | * Privilege checking interface for BSD kernel. |
| 34 | */ |
| 35 | #ifndef _SYS_PRIV_H_ |
| 36 | #define	_SYS_PRIV_H_ |
| 37 | |
| 38 | /* |
| 39 | * Privilege list, sorted loosely by kernel subsystem. |
| 40 | * |
| 41 | * Think carefully before adding or reusing one of these privileges -- are |
| 42 | * there existing instances referring to the same privilege? Third party |
| 43 | * vendors may request the assignment of privileges to be used in loadable |
| 44 | * modules. Particular numeric privilege assignments are part of the |
| 45 | * loadable kernel module ABI, and should not be changed across minor |
| 46 | * releases. |
| 47 | * |
| 48 | * When adding a new privilege, remember to determine if it's appropriate |
| 49 | * for use in jail, and update the privilege switch in prison_priv_check() |
| 50 | * in kern_jail.c as necessary. |
| 51 | */ |
| 52 | |
| 53 | /* |
| 54 | * Track beginning of privilege list. |
| 55 | */ |
| 56 | #define	_PRIV_LOWEST	1 |
| 57 | |
| 58 | /* |
| 59 | * The remaining privileges typically correspond to one or a small |
| 60 | * number of specific privilege checks, and have (relatively) precise |
| 61 | * meanings. They are loosely sorted into a set of base system |
| 62 | * privileges, such as the ability to reboot, and then loosely by |
| 63 | * subsystem, indicated by a subsystem name. |
| 64 | */ |
| 65 | #define	_PRIV_ROOT		1	/* Removed. */ |
| 66 | #define	PRIV_ACCT		2	/* Manage process accounting. */ |
| 67 | #define	PRIV_MAXFILES		3	/* Exceed system open files limit. */ |
| 68 | #define	PRIV_MAXPROC		4	/* Exceed system processes limit. */ |
| 69 | #define	PRIV_KTRACE		5	/* Set/clear KTRFAC_ROOT on ktrace. */ |
| 70 | #define	PRIV_SETDUMPER		6	/* Configure dump device. */ |
| 71 | #define	PRIV_REBOOT		8	/* Can reboot system. */ |
| 72 | #define	PRIV_SWAPON		9	/* Can swapon(). */ |
| 73 | #define	PRIV_SWAPOFF		10	/* Can swapoff(). */ |
| 74 | #define	PRIV_MSGBUF		11	/* Can read kernel message buffer. */ |
| 75 | #define	PRIV_IO			12	/* Can perform low-level I/O. */ |
| 76 | #define	PRIV_KEYBOARD		13	/* Reprogram keyboard. */ |
| 77 | #define	PRIV_DRIVER		14	/* Low-level driver privilege. */ |
| 78 | #define	PRIV_ADJTIME		15	/* Set time adjustment. */ |
| 79 | #define	PRIV_NTP_ADJTIME	16	/* Set NTP time adjustment. */ |
| 80 | #define	PRIV_CLOCK_SETTIME	17	/* Can call clock_settime. */ |
| 81 | #define	PRIV_SETTIMEOFDAY	18	/* Can call settimeofday. */ |
| 82 | #define	_PRIV_SETHOSTID		19	/* Removed. */ |
| 83 | #define	_PRIV_SETDOMAINNAME	20	/* Removed. */ |
| 84 | |
| 85 | /* |
| 86 | * Audit subsystem privileges. |
| 87 | */ |
| 88 | #define	PRIV_AUDIT_CONTROL	40	/* Can configure audit. */ |
| 89 | #define	PRIV_AUDIT_FAILSTOP	41	/* Can run during audit fail stop. */ |
| 90 | #define	PRIV_AUDIT_GETAUDIT	42	/* Can get proc audit properties. */ |
| 91 | #define	PRIV_AUDIT_SETAUDIT	43	/* Can set proc audit properties. */ |
| 92 | #define	PRIV_AUDIT_SUBMIT	44	/* Can submit an audit record. */ |
| 93 | |
| 94 | /* |
| 95 | * Credential management privileges. |
| 96 | */ |
| 97 | #define	PRIV_CRED_SETUID	50	/* setuid. */ |
| 98 | #define	PRIV_CRED_SETEUID	51	/* seteuid to !ruid and !svuid. */ |
| 99 | #define	PRIV_CRED_SETGID	52	/* setgid. */ |
| 100 | #define	PRIV_CRED_SETEGID	53	/* setgid to !rgid and !svgid. */ |
| 101 | #define	PRIV_CRED_SETGROUPS	54	/* Set process additional groups. */ |
| 102 | #define	PRIV_CRED_SETREUID	55	/* setreuid. */ |
| 103 | #define	PRIV_CRED_SETREGID	56	/* setregid. */ |
| 104 | #define	PRIV_CRED_SETRESUID	57	/* setresuid. */ |
| 105 | #define	PRIV_CRED_SETRESGID	58	/* setresgid. */ |
| 106 | #define	PRIV_SEEOTHERGIDS	59	/* Exempt bsd.seeothergids. */ |
| 107 | #define	PRIV_SEEOTHERUIDS	60	/* Exempt bsd.seeotheruids. */ |
| 108 | #define	PRIV_SEEJAILPROC	61	/* Exempt from bsd.see_jail_proc. */ |
| 109 | #define	PRIV_CRED_SETCRED	62	/* setcred. */ |
| 110 | |
| 111 | /* |
| 112 | * Debugging privileges. |
| 113 | */ |
| 114 | #define	PRIV_DEBUG_DIFFCRED	80	/* Exempt debugging other users. */ |
| 115 | #define	PRIV_DEBUG_SUGID	81	/* Exempt debugging setuid proc. */ |
| 116 | #define	PRIV_DEBUG_UNPRIV	82	/* Exempt unprivileged debug limit. */ |
| 117 | #define	PRIV_DEBUG_DENIED	83	/* Exempt P2_NOTRACE. */ |
| 118 | #define	PRIV_DEBUG_DIFFJAIL	84	/* Exempt debugging other jails. */ |
| 119 | |
| 120 | /* |
| 121 | * Dtrace privileges. |
| 122 | */ |
| 123 | #define	PRIV_DTRACE_KERNEL	90	/* Allow use of DTrace on the kernel. */ |
| 124 | #define	PRIV_DTRACE_PROC	91	/* Allow attaching DTrace to process. */ |
| 125 | #define	PRIV_DTRACE_USER	92	/* Process may submit DTrace events. */ |
| 126 | |
| 127 | /* |
| 128 | * Firmware privilegs. |
| 129 | */ |
| 130 | #define	PRIV_FIRMWARE_LOAD	100	/* Can load firmware. */ |
| 131 | |
| 132 | /* |
| 133 | * Jail privileges. |
| 134 | */ |
| 135 | #define	PRIV_JAIL_ATTACH	110	/* Attach to a jail. */ |
| 136 | #define	PRIV_JAIL_SET		111	/* Set jail parameters. */ |
| 137 | #define	PRIV_JAIL_REMOVE	112	/* Remove a jail. */ |
| 138 | |
| 139 | /* |
| 140 | * Kernel environment privileges. |
| 141 | */ |
| 142 | #define	PRIV_KENV_SET		120	/* Set kernel env. variables. */ |
| 143 | #define	PRIV_KENV_UNSET		121	/* Unset kernel env. variables. */ |
| 144 | |
| 145 | /* |
| 146 | * Loadable kernel module privileges. |
| 147 | */ |
| 148 | #define	PRIV_KLD_LOAD		130	/* Load a kernel module. */ |
| 149 | #define	PRIV_KLD_UNLOAD		131	/* Unload a kernel module. */ |
| 150 | |
| 151 | /* |
| 152 | * Privileges associated with the MAC Framework and specific MAC policy |
| 153 | * modules. |
| 154 | */ |
| 155 | #define	PRIV_MAC_PARTITION	140	/* Privilege in mac_partition policy. */ |
| 156 | #define	PRIV_MAC_PRIVS		141	/* Privilege in the mac_privs policy. */ |
| 157 | |
| 158 | /* |
| 159 | * Process-related privileges. |
| 160 | */ |
| 161 | #define	PRIV_PROC_LIMIT		160	/* Exceed user process limit. */ |
| 162 | #define	PRIV_PROC_SETLOGIN	161	/* Can call setlogin. */ |
| 163 | #define	PRIV_PROC_SETRLIMIT	162	/* Can raise resources limits. */ |
| 164 | #define	PRIV_PROC_SETLOGINCLASS	163	/* Can call setloginclass(2). */ |
| 165 | |
| 166 | /* |
| 167 | * System V IPC privileges. |
| 168 | */ |
| 169 | #define	PRIV_IPC_READ		170	/* Can override IPC read perm. */ |
| 170 | #define	PRIV_IPC_WRITE		171	/* Can override IPC write perm. */ |
| 171 | #define	PRIV_IPC_ADMIN		172	/* Can override IPC owner-only perm. */ |
| 172 | #define	PRIV_IPC_MSGSIZE	173	/* Exempt IPC message queue limit. */ |
| 173 | |
| 174 | /* |
| 175 | * POSIX message queue privileges. |
| 176 | */ |
| 177 | #define	PRIV_MQ_ADMIN		180	/* Can override msgq owner-only perm. */ |
| 178 | |
| 179 | /* |
| 180 | * Performance monitoring counter privileges. |
| 181 | */ |
| 182 | #define	PRIV_PMC_MANAGE		190	/* Can administer PMC. */ |
| 183 | #define	PRIV_PMC_SYSTEM		191	/* Can allocate a system-wide PMC. */ |
| 184 | |
| 185 | /* |
| 186 | * Scheduling privileges. |
| 187 | */ |
| 188 | #define	PRIV_SCHED_DIFFCRED	200	/* Exempt scheduling other users. */ |
| 189 | #define	PRIV_SCHED_SETPRIORITY	201	/* Can set lower nice value for proc. */ |
| 190 | #define	PRIV_SCHED_RTPRIO	202	/* Can set real time scheduling. */ |
| 191 | #define	PRIV_SCHED_SETPOLICY	203	/* Can set scheduler policy. */ |
| 192 | #define	PRIV_SCHED_SET		204	/* Can set thread scheduler. */ |
| 193 | #define	PRIV_SCHED_SETPARAM	205	/* Can set thread scheduler params. */ |
| 194 | #define	PRIV_SCHED_CPUSET	206	/* Can manipulate cpusets. */ |
| 195 | #define	PRIV_SCHED_CPUSET_INTR	207	/* Can adjust IRQ to CPU binding. */ |
| 196 | #define	PRIV_SCHED_IDPRIO	208	/* Can set idle time scheduling. */ |
| 197 | #define	PRIV_SCHED_DIFFJAIL	209	/* Exempt scheduling other jails. */ |
| 198 | |
| 199 | /* |
| 200 | * POSIX semaphore privileges. |
| 201 | */ |
| 202 | #define	PRIV_SEM_WRITE		220	/* Can override sem write perm. */ |
| 203 | |
| 204 | /* |
| 205 | * Signal privileges. |
| 206 | */ |
| 207 | #define	PRIV_SIGNAL_DIFFCRED	230	/* Exempt signalling other users. */ |
| 208 | #define	PRIV_SIGNAL_SUGID	231	/* Non-conserv signal setuid proc. */ |
| 209 | #define	PRIV_SIGNAL_DIFFJAIL	232	/* Exempt signalling other jails. */ |
| 210 | |
| 211 | /* |
| 212 | * Sysctl privileges. |
| 213 | */ |
| 214 | #define	PRIV_SYSCTL_DEBUG	240	/* Can invoke sysctl.debug. */ |
| 215 | #define	PRIV_SYSCTL_WRITE	241	/* Can write sysctls. */ |
| 216 | #define	PRIV_SYSCTL_WRITEJAIL	242	/* Can write sysctls, jail permitted. */ |
| 217 | #define	PRIV_SYSCTL_MEMLOCK	243	/* Large requests are not serialized. */ |
| 218 | |
| 219 | /* |
| 220 | * TTY privileges. |
| 221 | */ |
| 222 | #define	PRIV_TTY_CONSOLE	250	/* Set console to tty. */ |
| 223 | #define	PRIV_TTY_DRAINWAIT	251	/* Set tty drain wait time. */ |
| 224 | #define	PRIV_TTY_DTRWAIT	252	/* Set DTR wait on tty. */ |
| 225 | #define	PRIV_TTY_EXCLUSIVE	253	/* Override tty exclusive flag. */ |
| 226 | #define	_PRIV_TTY_PRISON	254	/* Removed. */ |
| 227 | #define	PRIV_TTY_STI		255	/* Simulate input on another tty. */ |
| 228 | #define	PRIV_TTY_SETA		256	/* Set tty termios structure. */ |
| 229 | |
| 230 | /* |
| 231 | * UFS-specific privileges. |
| 232 | */ |
| 233 | #define	PRIV_UFS_EXTATTRCTL	270	/* Can configure EAs on UFS1. */ |
| 234 | #define	PRIV_UFS_QUOTAOFF	271	/* quotaoff(). */ |
| 235 | #define	PRIV_UFS_QUOTAON	272	/* quotaon(). */ |
| 236 | #define	PRIV_UFS_SETUSE		273	/* setuse(). */ |
| 237 | |
| 238 | /* |
| 239 | * ZFS-specific privileges. |
| 240 | */ |
| 241 | #define	PRIV_ZFS_POOL_CONFIG	280	/* Can configure ZFS pools. */ |
| 242 | #define	PRIV_ZFS_INJECT		281	/* Can inject faults in the ZFS fault |
| 243 | 					 injection framework. */ |
| 244 | #define	PRIV_ZFS_JAIL		282	/* Can attach/detach ZFS file systems |
| 245 | 					 to/from jails. */ |
| 246 | |
| 247 | /* |
| 248 | * NFS-specific privileges. |
| 249 | */ |
| 250 | #define	PRIV_NFS_DAEMON		290	/* Can become the NFS daemon. */ |
| 251 | #define	PRIV_NFS_LOCKD		291	/* Can become NFS lock daemon. */ |
| 252 | |
| 253 | /* |
| 254 | * VFS privileges. |
| 255 | */ |
| 256 | #define	PRIV_VFS_READ		310	/* Override vnode DAC read perm. */ |
| 257 | #define	PRIV_VFS_WRITE		311	/* Override vnode DAC write perm. */ |
| 258 | #define	PRIV_VFS_ADMIN		312	/* Override vnode DAC admin perm. */ |
| 259 | #define	PRIV_VFS_EXEC		313	/* Override vnode DAC exec perm. */ |
| 260 | #define	PRIV_VFS_LOOKUP		314	/* Override vnode DAC lookup perm. */ |
| 261 | #define	PRIV_VFS_BLOCKRESERVE	315	/* Can use free block reserve. */ |
| 262 | #define	PRIV_VFS_CHFLAGS_DEV	316	/* Can chflags() a device node. */ |
| 263 | #define	PRIV_VFS_CHOWN		317	/* Can set user; group to non-member. */ |
| 264 | #define	PRIV_VFS_CHROOT		318	/* chroot(). */ |
| 265 | #define	PRIV_VFS_RETAINSUGID	319	/* Can retain sugid bits on change. */ |
| 266 | #define	PRIV_VFS_EXCEEDQUOTA	320	/* Exempt from quota restrictions. */ |
| 267 | #define	PRIV_VFS_EXTATTR_SYSTEM	321	/* Operate on system EA namespace. */ |
| 268 | #define	PRIV_VFS_FCHROOT	322	/* fchroot(). */ |
| 269 | #define	PRIV_VFS_FHOPEN		323	/* Can fhopen(). */ |
| 270 | #define	PRIV_VFS_FHSTAT		324	/* Can fhstat(). */ |
| 271 | #define	PRIV_VFS_FHSTATFS	325	/* Can fhstatfs(). */ |
| 272 | #define	PRIV_VFS_GENERATION	326	/* stat() returns generation number. */ |
| 273 | #define	PRIV_VFS_GETFH		327	/* Can retrieve file handles. */ |
| 274 | #define	PRIV_VFS_GETQUOTA	328	/* getquota(). */ |
| 275 | #define	PRIV_VFS_LINK		329	/* bsd.hardlink_check_uid */ |
| 276 | #define	PRIV_VFS_MKNOD_BAD	330	/* Was: mknod() can mark bad inodes. */ |
| 277 | #define	PRIV_VFS_MKNOD_DEV	331	/* Can mknod() to create dev nodes. */ |
| 278 | #define	PRIV_VFS_MKNOD_WHT	332	/* Can mknod() to create whiteout. */ |
| 279 | #define	PRIV_VFS_MOUNT		333	/* Can mount(). */ |
| 280 | #define	PRIV_VFS_MOUNT_OWNER	334	/* Can manage other users' file systems. */ |
| 281 | #define	PRIV_VFS_MOUNT_EXPORTED	335	/* Can set MNT_EXPORTED on mount. */ |
| 282 | #define	PRIV_VFS_MOUNT_PERM	336	/* Override dev node perms at mount. */ |
| 283 | #define	PRIV_VFS_MOUNT_SUIDDIR	337	/* Can set MNT_SUIDDIR on mount. */ |
| 284 | #define	PRIV_VFS_MOUNT_NONUSER	338	/* Can perform a non-user mount. */ |
| 285 | #define	PRIV_VFS_SETGID		339	/* Can setgid if not in group. */ |
| 286 | #define	PRIV_VFS_SETQUOTA	340	/* setquota(). */ |
| 287 | #define	PRIV_VFS_STICKYFILE	341	/* Can set sticky bit on file. */ |
| 288 | #define	PRIV_VFS_SYSFLAGS	342	/* Can modify system flags. */ |
| 289 | #define	PRIV_VFS_UNMOUNT	343	/* Can unmount(). */ |
| 290 | #define	PRIV_VFS_STAT		344	/* Override vnode MAC stat perm. */ |
| 291 | #define	PRIV_VFS_READ_DIR	345	/* Can read(2) a dirfd, needs sysctl. */ |
| 292 | |
| 293 | /* |
| 294 | * Virtual memory privileges. |
| 295 | */ |
| 296 | #define	PRIV_VM_MADV_PROTECT	360	/* Can set MADV_PROTECT. */ |
| 297 | #define	PRIV_VM_MLOCK		361	/* Can mlock(), mlockall(). */ |
| 298 | #define	PRIV_VM_MUNLOCK		362	/* Can munlock(), munlockall(). */ |
| 299 | #define	PRIV_VM_SWAP_NOQUOTA	363	/* |
| 300 | 					 * Can override the global |
| 301 | 					 * swap reservation limits. |
| 302 | 					 */ |
| 303 | #define	PRIV_VM_SWAP_NORLIMIT	364	/* |
| 304 | 					 * Can override the per-uid |
| 305 | 					 * swap reservation limits. |
| 306 | 					 */ |
| 307 | |
| 308 | /* |
| 309 | * Device file system privileges. |
| 310 | */ |
| 311 | #define	PRIV_DEVFS_RULE		370	/* Can manage devfs rules. */ |
| 312 | #define	PRIV_DEVFS_SYMLINK	371	/* Can create symlinks in devfs. */ |
| 313 | |
| 314 | /* |
| 315 | * Random number generator privileges. |
| 316 | */ |
| 317 | #define	PRIV_RANDOM_RESEED	380	/* Closing /dev/random reseeds. */ |
| 318 | |
| 319 | /* |
| 320 | * Network stack privileges. |
| 321 | */ |
| 322 | #define	PRIV_NET_BRIDGE		390	/* Administer bridge. */ |
| 323 | #define	PRIV_NET_GRE		391	/* Administer GRE. */ |
| 324 | #define	_PRIV_NET_PPP		392	/* Removed. */ |
| 325 | #define	_PRIV_NET_SLIP		393	/* Removed. */ |
| 326 | #define	PRIV_NET_BPF		394	/* Monitor BPF. */ |
| 327 | #define	PRIV_NET_RAW		395	/* Open raw socket. */ |
| 328 | #define	PRIV_NET_ROUTE		396	/* Administer routing. */ |
| 329 | #define	PRIV_NET_TAP		397	/* Can open tap device. */ |
| 330 | #define	PRIV_NET_SETIFMTU	398	/* Set interface MTU. */ |
| 331 | #define	PRIV_NET_SETIFFLAGS	399	/* Set interface flags. */ |
| 332 | #define	PRIV_NET_SETIFCAP	400	/* Set interface capabilities. */ |
| 333 | #define	PRIV_NET_SETIFNAME	401	/* Set interface name. */ |
| 334 | #define	PRIV_NET_SETIFMETRIC	402	/* Set interface metrics. */ |
| 335 | #define	PRIV_NET_SETIFPHYS	403	/* Set interface physical layer prop. */ |
| 336 | #define	PRIV_NET_SETIFMAC	404	/* Set interface MAC label. */ |
| 337 | #define	PRIV_NET_ADDMULTI	405	/* Add multicast addr. to ifnet. */ |
| 338 | #define	PRIV_NET_DELMULTI	406	/* Delete multicast addr. from ifnet. */ |
| 339 | #define	PRIV_NET_HWIOCTL	407	/* Issue hardware ioctl on ifnet. */ |
| 340 | #define	PRIV_NET_SETLLADDR	408	/* Set interface link-level address. */ |
| 341 | #define	PRIV_NET_ADDIFGROUP	409	/* Add new interface group. */ |
| 342 | #define	PRIV_NET_DELIFGROUP	410	/* Delete interface group. */ |
| 343 | #define	PRIV_NET_IFCREATE	411	/* Create cloned interface. */ |
| 344 | #define	PRIV_NET_IFDESTROY	412	/* Destroy cloned interface. */ |
| 345 | #define	PRIV_NET_ADDIFADDR	413	/* Add protocol addr to interface. */ |
| 346 | #define	PRIV_NET_DELIFADDR	414	/* Delete protocol addr on interface. */ |
| 347 | #define	PRIV_NET_LAGG		415	/* Administer lagg interface. */ |
| 348 | #define	PRIV_NET_GIF		416	/* Administer gif interface. */ |
| 349 | #define	PRIV_NET_SETIFVNET	417	/* Move interface to vnet. */ |
| 350 | #define	PRIV_NET_SETIFDESCR	418	/* Set interface description. */ |
| 351 | #define	PRIV_NET_SETIFFIB	419	/* Set interface fib. */ |
| 352 | #define	PRIV_NET_VXLAN		420	/* Administer vxlan. */ |
| 353 | #define	PRIV_NET_SETLANPCP	421	/* Set LAN priority. */ |
| 354 | #define	PRIV_NET_SETVLANPCP	PRIV_NET_SETLANPCP /* Alias Set VLAN priority */ |
| 355 | #define	PRIV_NET_OVPN		422	/* Administer OpenVPN DCO. */ |
| 356 | #define	PRIV_NET_ME		423	/* Administer ME interface. */ |
| 357 | #define	PRIV_NET_WG		424	/* Administer WireGuard interface. */ |
| 358 | |
| 359 | /* |
| 360 | * 802.11-related privileges. |
| 361 | */ |
| 362 | #define	PRIV_NET80211_VAP_GETKEY	440	/* Query VAP 802.11 keys. */ |
| 363 | #define	PRIV_NET80211_VAP_MANAGE	441	/* Administer 802.11 VAP */ |
| 364 | #define	PRIV_NET80211_VAP_SETMAC	442	/* Set VAP MAC address */ |
| 365 | #define	PRIV_NET80211_CREATE_VAP	443	/* Create a new VAP */ |
| 366 | |
| 367 | /* |
| 368 | * Placeholder for AppleTalk privileges, not supported anymore. |
| 369 | */ |
| 370 | #define	_PRIV_NETATALK_RESERVEDPORT	450	/* Bind low port number. */ |
| 371 | |
| 372 | /* |
| 373 | * ATM privileges. |
| 374 | */ |
| 375 | #define	PRIV_NETATM_CFG		460 |
| 376 | #define	PRIV_NETATM_ADD		461 |
| 377 | #define	PRIV_NETATM_DEL		462 |
| 378 | #define	PRIV_NETATM_SET		463 |
| 379 | |
| 380 | /* |
| 381 | * Bluetooth privileges. |
| 382 | */ |
| 383 | #define	PRIV_NETBLUETOOTH_RAW	470	/* Open raw bluetooth socket. */ |
| 384 | |
| 385 | /* |
| 386 | * Netgraph and netgraph module privileges. |
| 387 | */ |
| 388 | #define	PRIV_NETGRAPH_CONTROL	480	/* Open netgraph control socket. */ |
| 389 | #define	PRIV_NETGRAPH_TTY	481	/* Configure tty for netgraph. */ |
| 390 | |
| 391 | /* |
| 392 | * IPv4 and IPv6 privileges. |
| 393 | */ |
| 394 | #define	PRIV_NETINET_RESERVEDPORT	490	/* Bind low port number. */ |
| 395 | #define	PRIV_NETINET_IPFW	491	/* Administer IPFW firewall. */ |
| 396 | #define	PRIV_NETINET_DIVERT	492	/* Open IP divert socket. */ |
| 397 | #define	PRIV_NETINET_PF		493	/* Administer pf firewall. */ |
| 398 | #define	PRIV_NETINET_DUMMYNET	494	/* Administer DUMMYNET. */ |
| 399 | #define	PRIV_NETINET_CARP	495	/* Administer CARP. */ |
| 400 | #define	PRIV_NETINET_MROUTE	496	/* Administer multicast routing. */ |
| 401 | #define	PRIV_NETINET_RAW	497	/* Open netinet raw socket. */ |
| 402 | #define	PRIV_NETINET_GETCRED	498	/* Query netinet pcb credentials. */ |
| 403 | #define	PRIV_NETINET_ADDRCTRL6	499	/* Administer IPv6 address scopes. */ |
| 404 | #define	PRIV_NETINET_ND6	500	/* Administer IPv6 neighbor disc. */ |
| 405 | #define	PRIV_NETINET_SCOPE6	501	/* Administer IPv6 address scopes. */ |
| 406 | #define	PRIV_NETINET_ALIFETIME6	502	/* Administer IPv6 address lifetimes. */ |
| 407 | #define	PRIV_NETINET_IPSEC	503	/* Administer IPSEC. */ |
| 408 | #define	PRIV_NETINET_REUSEPORT	504	/* Allow [rapid] port/address reuse. */ |
| 409 | #define	PRIV_NETINET_SETHDROPTS	505	/* Set certain IPv4/6 header options. */ |
| 410 | #define	PRIV_NETINET_BINDANY	506	/* Allow bind to any address. */ |
| 411 | #define	PRIV_NETINET_HASHKEY	507	/* Get and set hash keys for IPv4/6. */ |
| 412 | #define	PRIV_NETINET_KTLSKEYS	508	/* Read ktls session keys. */ |
| 413 | |
| 414 | /* |
| 415 | * Placeholders for IPX/SPX privileges, not supported any more. |
| 416 | */ |
| 417 | #define	_PRIV_NETIPX_RESERVEDPORT	520	/* Bind low port number. */ |
| 418 | #define	_PRIV_NETIPX_RAW		521	/* Open netipx raw socket. */ |
| 419 | |
| 420 | /* |
| 421 | * NCP privileges. |
| 422 | */ |
| 423 | #define	PRIV_NETNCP		530	/* Use another user's connection. */ |
| 424 | |
| 425 | /* |
| 426 | * SMB privileges. |
| 427 | */ |
| 428 | #define	PRIV_NETSMB		540	/* Use another user's connection. */ |
| 429 | |
| 430 | /* |
| 431 | * VM86 privileges. |
| 432 | */ |
| 433 | #define	PRIV_VM86_INTCALL	550	/* Allow invoking vm86 int handlers. */ |
| 434 | |
| 435 | #define	PRIV_PIPEBUF		560	/* Allow to allocate reserved pipebuf |
| 436 | 					 space */ |
| 437 | |
| 438 | /* |
| 439 | * Set of reserved privilege values, which will be allocated to code as |
| 440 | * needed, in order to avoid renumbering later privileges due to insertion. |
| 441 | */ |
| 442 | #define	_PRIV_RESERVED1		561 |
| 443 | #define	_PRIV_RESERVED2		562 |
| 444 | #define	_PRIV_RESERVED3		563 |
| 445 | #define	_PRIV_RESERVED4		564 |
| 446 | #define	_PRIV_RESERVED5		565 |
| 447 | #define	_PRIV_RESERVED6		566 |
| 448 | #define	_PRIV_RESERVED7		567 |
| 449 | #define	_PRIV_RESERVED8		568 |
| 450 | #define	_PRIV_RESERVED9		569 |
| 451 | #define	_PRIV_RESERVED10	570 |
| 452 | #define	_PRIV_RESERVED11	571 |
| 453 | #define	_PRIV_RESERVED12	572 |
| 454 | #define	_PRIV_RESERVED13	573 |
| 455 | #define	_PRIV_RESERVED14	574 |
| 456 | #define	_PRIV_RESERVED15	575 |
| 457 | |
| 458 | /* |
| 459 | * Define a set of valid privilege numbers that can be used by loadable |
| 460 | * modules that don't yet have privilege reservations. Ideally, these should |
| 461 | * not be used, since their meaning is opaque to any policies that are aware |
| 462 | * of specific privileges, such as jail, and as such may be arbitrarily |
| 463 | * denied. |
| 464 | */ |
| 465 | #define	PRIV_MODULE0		600 |
| 466 | #define	PRIV_MODULE1		601 |
| 467 | #define	PRIV_MODULE2		602 |
| 468 | #define	PRIV_MODULE3		603 |
| 469 | #define	PRIV_MODULE4		604 |
| 470 | #define	PRIV_MODULE5		605 |
| 471 | #define	PRIV_MODULE6		606 |
| 472 | #define	PRIV_MODULE7		607 |
| 473 | #define	PRIV_MODULE8		608 |
| 474 | #define	PRIV_MODULE9		609 |
| 475 | #define	PRIV_MODULE10		610 |
| 476 | #define	PRIV_MODULE11		611 |
| 477 | #define	PRIV_MODULE12		612 |
| 478 | #define	PRIV_MODULE13		613 |
| 479 | #define	PRIV_MODULE14		614 |
| 480 | #define	PRIV_MODULE15		615 |
| 481 | |
| 482 | /* |
| 483 | * DDB(4) privileges. |
| 484 | */ |
| 485 | #define	PRIV_DDB_CAPTURE	620	/* Allow reading of DDB capture log. */ |
| 486 | |
| 487 | /* |
| 488 | * Arla/nnpfs privileges. |
| 489 | */ |
| 490 | #define	PRIV_NNPFS_DEBUG	630	/* Perforn ARLA_VIOC_NNPFSDEBUG. */ |
| 491 | |
| 492 | /* |
| 493 | * cpuctl(4) privileges. |
| 494 | */ |
| 495 | #define PRIV_CPUCTL_WRMSR	640	/* Write model-specific register. */ |
| 496 | #define PRIV_CPUCTL_UPDATE	641	/* Update cpu microcode. */ |
| 497 | |
| 498 | /* |
| 499 | * Capi4BSD privileges. |
| 500 | */ |
| 501 | #define	PRIV_C4B_RESET_CTLR	650	/* Load firmware, reset controller. */ |
| 502 | #define	PRIV_C4B_TRACE		651	/* Unrestricted CAPI message tracing. */ |
| 503 | |
| 504 | /* |
| 505 | * OpenAFS privileges. |
| 506 | */ |
| 507 | #define	PRIV_AFS_ADMIN		660	/* Can change AFS client settings. */ |
| 508 | #define	PRIV_AFS_DAEMON		661	/* Can become the AFS daemon. */ |
| 509 | |
| 510 | /* |
| 511 | * Resource Limits privileges. |
| 512 | */ |
| 513 | #define	PRIV_RCTL_GET_RACCT	670 |
| 514 | #define	PRIV_RCTL_GET_RULES	671 |
| 515 | #define	PRIV_RCTL_GET_LIMITS	672 |
| 516 | #define	PRIV_RCTL_ADD_RULE	673 |
| 517 | #define	PRIV_RCTL_REMOVE_RULE	674 |
| 518 | |
| 519 | /* |
| 520 | * mem(4) privileges. |
| 521 | */ |
| 522 | #define	PRIV_KMEM_READ		680	/* Open mem/kmem for reading. */ |
| 523 | #define	PRIV_KMEM_WRITE		681	/* Open mem/kmem for writing. */ |
| 524 | #define	PRIV_PROC_MEM_WRITE	682	/* Writes via proc_rwmem */ |
| 525 | |
| 526 | /* |
| 527 | * Kernel debugger privileges. |
| 528 | */ |
| 529 | #define	PRIV_KDB_SET_BACKEND	690	/* Allow setting KDB backend. */ |
| 530 | |
| 531 | /* |
| 532 | * veriexec override privileges - very rare! |
| 533 | */ |
| 534 | #define	PRIV_VERIEXEC_DIRECT	700	/* Can override 'indirect' */ |
| 535 | #define	PRIV_VERIEXEC_NOVERIFY	701	/* Can override O_VERIFY */ |
| 536 | #define	PRIV_VERIEXEC_CONTROL	702	/* Can configure veriexec */ |
| 537 | |
| 538 | /* |
| 539 | * Track end of privilege list. |
| 540 | */ |
| 541 | #define	_PRIV_HIGHEST		703 |
| 542 | |
| 543 | /* |
| 544 | * Validate that a named privilege is known by the privilege system. Invalid |
| 545 | * privileges presented to the privilege system by a priv_check interface |
| 546 | * will result in a panic. This is only approximate due to sparse allocation |
| 547 | * of the privilege space. |
| 548 | */ |
| 549 | #define	PRIV_VALID(x)	((x) > _PRIV_LOWEST && (x) < _PRIV_HIGHEST) |
| 550 | |
| 551 | #ifdef _KERNEL |
| 552 | /* |
| 553 | * Privilege check interfaces, modeled after historic suser() interfaces, but |
| 554 | * with the addition of a specific privilege name. No flags are currently |
| 555 | * defined for the API. Historically, flags specified using the real uid |
| 556 | * instead of the effective uid, and whether or not the check should be |
| 557 | * allowed in jail. |
| 558 | */ |
| 559 | struct thread; |
| 560 | struct ucred; |
| 561 | int	priv_check(struct thread *td, int priv); |
| 562 | int	priv_check_cred(struct ucred *cred, int priv); |
| 563 | int	priv_check_cred_vfs_lookup(struct ucred *cred); |
| 564 | int	priv_check_cred_vfs_lookup_nomac(struct ucred *cred); |
| 565 | int	priv_check_cred_vfs_generation(struct ucred *cred); |
| 566 | #endif |
| 567 | |
| 568 | #endif /* !_SYS_PRIV_H_ */ |