master
  1/*
  2 * Copyright (c) 2004-2010 Apple Inc. All rights reserved.
  3 *
  4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  5 *
  6 * This file contains Original Code and/or Modifications of Original Code
  7 * as defined in and that are subject to the Apple Public Source License
  8 * Version 2.0 (the 'License'). You may not use this file except in
  9 * compliance with the License. The rights granted to you under the License
 10 * may not be used to create, or enable the creation or redistribution of,
 11 * unlawful or unlicensed copies of an Apple operating system, or to
 12 * circumvent, violate, or enable the circumvention or violation of, any
 13 * terms of an Apple operating system software license agreement.
 14 *
 15 * Please obtain a copy of the License at
 16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 17 *
 18 * The Original Code and all software distributed under the License are
 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 23 * Please see the License for the specific language governing rights and
 24 * limitations under the License.
 25 *
 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 27 */
 28/*
 29 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
 30 * support for mandatory and extensible security protections.  This notice
 31 * is included in support of clause 2.2 (b) of the Apple Public License,
 32 * Version 2.0.
 33 */
 34
 35#ifndef _SYS_KAUTH_H
 36#define _SYS_KAUTH_H
 37
 38#include <sys/appleapiopts.h>
 39#include <sys/cdefs.h>
 40#include <mach/boolean.h>
 41#include <machine/types.h>      /* u_int8_t, etc. */
 42#include <sys/_types.h>         /* __offsetof() */
 43#include <sys/_types/_uid_t.h>  /* uid_t */
 44#include <sys/_types/_gid_t.h>     /* gid_t */
 45#include <sys/_types/_guid_t.h>
 46#include <sys/syslimits.h>      /* NGROUPS_MAX */
 47
 48__BEGIN_DECLS
 49
 50#ifdef __APPLE_API_EVOLVING
 51
 52/*
 53 * Identities.
 54 */
 55
 56#define KAUTH_UID_NONE  (~(uid_t)0 - 100)       /* not a valid UID */
 57#define KAUTH_GID_NONE  (~(gid_t)0 - 100)       /* not a valid GID */
 58
 59/* NT Security Identifier, structure as defined by Microsoft */
 60#pragma pack(1)    /* push packing of 1 byte */
 61typedef struct {
 62	u_int8_t                sid_kind;
 63	u_int8_t                sid_authcount;
 64	u_int8_t                sid_authority[6];
 65#define KAUTH_NTSID_MAX_AUTHORITIES 16
 66	u_int32_t       sid_authorities[KAUTH_NTSID_MAX_AUTHORITIES];
 67} ntsid_t;
 68#pragma pack()    /* pop packing to previous packing level */
 69#define _NTSID_T
 70
 71/* valid byte count inside a SID structure */
 72#define KAUTH_NTSID_HDRSIZE     (8)
 73#define KAUTH_NTSID_SIZE(_s)    (KAUTH_NTSID_HDRSIZE + ((_s)->sid_authcount * sizeof(u_int32_t)))
 74
 75/*
 76 * External lookup message payload; this structure is shared between the
 77 * kernel group membership resolver, and the user space group membership
 78 * resolver daemon, and is use to communicate resolution requests from the
 79 * kernel to user space, and the result of that request from user space to
 80 * the kernel.
 81 */
 82struct kauth_identity_extlookup {
 83	u_int32_t       el_seqno;       /* request sequence number */
 84	u_int32_t       el_result;      /* lookup result */
 85#define KAUTH_EXTLOOKUP_SUCCESS         0       /* results here are good */
 86#define KAUTH_EXTLOOKUP_BADRQ           1       /* request badly formatted */
 87#define KAUTH_EXTLOOKUP_FAILURE         2       /* transient failure during lookup */
 88#define KAUTH_EXTLOOKUP_FATAL           3       /* permanent failure during lookup */
 89#define KAUTH_EXTLOOKUP_INPROG          100     /* request in progress */
 90	u_int32_t       el_flags;
 91#define KAUTH_EXTLOOKUP_VALID_UID       (1<<0)
 92#define KAUTH_EXTLOOKUP_VALID_UGUID     (1<<1)
 93#define KAUTH_EXTLOOKUP_VALID_USID      (1<<2)
 94#define KAUTH_EXTLOOKUP_VALID_GID       (1<<3)
 95#define KAUTH_EXTLOOKUP_VALID_GGUID     (1<<4)
 96#define KAUTH_EXTLOOKUP_VALID_GSID      (1<<5)
 97#define KAUTH_EXTLOOKUP_WANT_UID        (1<<6)
 98#define KAUTH_EXTLOOKUP_WANT_UGUID      (1<<7)
 99#define KAUTH_EXTLOOKUP_WANT_USID       (1<<8)
100#define KAUTH_EXTLOOKUP_WANT_GID        (1<<9)
101#define KAUTH_EXTLOOKUP_WANT_GGUID      (1<<10)
102#define KAUTH_EXTLOOKUP_WANT_GSID       (1<<11)
103#define KAUTH_EXTLOOKUP_WANT_MEMBERSHIP (1<<12)
104#define KAUTH_EXTLOOKUP_VALID_MEMBERSHIP (1<<13)
105#define KAUTH_EXTLOOKUP_ISMEMBER        (1<<14)
106#define KAUTH_EXTLOOKUP_VALID_PWNAM     (1<<15)
107#define KAUTH_EXTLOOKUP_WANT_PWNAM      (1<<16)
108#define KAUTH_EXTLOOKUP_VALID_GRNAM     (1<<17)
109#define KAUTH_EXTLOOKUP_WANT_GRNAM      (1<<18)
110#define KAUTH_EXTLOOKUP_VALID_SUPGRPS   (1<<19)
111#define KAUTH_EXTLOOKUP_WANT_SUPGRPS    (1<<20)
112
113	__darwin_pid_t  el_info_pid;            /* request on behalf of PID */
114	u_int64_t       el_extend;              /* extension field */
115	u_int32_t       el_info_reserved_1;     /* reserved (APPLE) */
116
117	uid_t           el_uid;         /* user ID */
118	guid_t          el_uguid;       /* user GUID */
119	u_int32_t       el_uguid_valid; /* TTL on translation result (seconds) */
120	ntsid_t         el_usid;        /* user NT SID */
121	u_int32_t       el_usid_valid;  /* TTL on translation result (seconds) */
122	gid_t           el_gid;         /* group ID */
123	guid_t          el_gguid;       /* group GUID */
124	u_int32_t       el_gguid_valid; /* TTL on translation result (seconds) */
125	ntsid_t         el_gsid;        /* group SID */
126	u_int32_t       el_gsid_valid;  /* TTL on translation result (seconds) */
127	u_int32_t       el_member_valid; /* TTL on group lookup result */
128	u_int32_t       el_sup_grp_cnt;  /* count of supplemental groups up to NGROUPS */
129	gid_t           el_sup_groups[NGROUPS_MAX];     /* supplemental group list */
130};
131
132struct kauth_cache_sizes {
133	u_int32_t kcs_group_size;
134	u_int32_t kcs_id_size;
135};
136
137#define KAUTH_EXTLOOKUP_REGISTER        (0)
138#define KAUTH_EXTLOOKUP_RESULT          (1<<0)
139#define KAUTH_EXTLOOKUP_WORKER          (1<<1)
140#define KAUTH_EXTLOOKUP_DEREGISTER      (1<<2)
141#define KAUTH_GET_CACHE_SIZES           (1<<3)
142#define KAUTH_SET_CACHE_SIZES           (1<<4)
143#define KAUTH_CLEAR_CACHES              (1<<5)
144
145#define IDENTITYSVC_ENTITLEMENT         "com.apple.private.identitysvc"
146
147#if defined(KERNEL) || defined (_SYS_ACL_H)
148#pragma mark - kauth
149#pragma mark kauth: Generic Access Control Lists.
150
151typedef u_int32_t kauth_ace_rights_t;
152
153/* Access Control List Entry (ACE) */
154struct kauth_ace {
155	guid_t          ace_applicable;
156	u_int32_t       ace_flags;
157#define KAUTH_ACE_KINDMASK              0xf
158#define KAUTH_ACE_PERMIT                1
159#define KAUTH_ACE_DENY                  2
160#define KAUTH_ACE_AUDIT                 3       /* not implemented */
161#define KAUTH_ACE_ALARM                 4       /* not implemented */
162#define KAUTH_ACE_INHERITED             (1<<4)
163#define KAUTH_ACE_FILE_INHERIT          (1<<5)
164#define KAUTH_ACE_DIRECTORY_INHERIT     (1<<6)
165#define KAUTH_ACE_LIMIT_INHERIT         (1<<7)
166#define KAUTH_ACE_ONLY_INHERIT          (1<<8)
167#define KAUTH_ACE_SUCCESS               (1<<9)  /* not implemented (AUDIT/ALARM) */
168#define KAUTH_ACE_FAILURE               (1<<10) /* not implemented (AUDIT/ALARM) */
169/* All flag bits controlling ACE inheritance */
170#define KAUTH_ACE_INHERIT_CONTROL_FLAGS         \
171	        (KAUTH_ACE_FILE_INHERIT |       \
172	         KAUTH_ACE_DIRECTORY_INHERIT |  \
173	         KAUTH_ACE_LIMIT_INHERIT |      \
174	         KAUTH_ACE_ONLY_INHERIT)
175	kauth_ace_rights_t ace_rights;          /* scope specific */
176	/* These rights are never tested, but may be present in an ACL */
177#define KAUTH_ACE_GENERIC_ALL           (1<<21)
178#define KAUTH_ACE_GENERIC_EXECUTE       (1<<22)
179#define KAUTH_ACE_GENERIC_WRITE         (1<<23)
180#define KAUTH_ACE_GENERIC_READ          (1<<24)
181};
182
183#ifndef _KAUTH_ACE
184#define _KAUTH_ACE
185typedef struct kauth_ace *kauth_ace_t;
186#endif
187
188
189/* Access Control List */
190struct kauth_acl {
191	u_int32_t       acl_entrycount;
192	u_int32_t       acl_flags;
193
194	struct kauth_ace acl_ace[1];
195};
196
197/*
198 * XXX this value needs to be raised - 3893388
199 */
200#define KAUTH_ACL_MAX_ENTRIES           128
201
202/*
203 * The low 16 bits of the flags field are reserved for filesystem
204 * internal use and must be preserved by all APIs.  This includes
205 * round-tripping flags through user-space interfaces.
206 */
207#define KAUTH_ACL_FLAGS_PRIVATE (0xffff)
208
209/*
210 * The high 16 bits of the flags are used to store attributes and
211 * to request specific handling of the ACL.
212 */
213
214/* inheritance will be deferred until the first rename operation */
215#define KAUTH_ACL_DEFER_INHERIT (1<<16)
216/* this ACL must not be overwritten as part of an inheritance operation */
217#define KAUTH_ACL_NO_INHERIT    (1<<17)
218
219/* acl_entrycount that tells us the ACL is not valid */
220#define KAUTH_FILESEC_NOACL ((u_int32_t)(-1))
221
222/*
223 * If the acl_entrycount field is KAUTH_FILESEC_NOACL, then the size is the
224 * same as a kauth_acl structure; the intent is to put an actual entrycount of
225 * KAUTH_FILESEC_NOACL on disk to distinguish a kauth_filesec_t with an empty
226 * entry (Windows treats this as "deny all") from one that merely indicates a
227 * file group and/or owner guid values.
228 */
229#define KAUTH_ACL_SIZE(c)       (__offsetof(struct kauth_acl, acl_ace) + ((u_int32_t)(c) != KAUTH_FILESEC_NOACL ? ((c) * sizeof(struct kauth_ace)) : 0))
230#define KAUTH_ACL_COPYSIZE(p)   KAUTH_ACL_SIZE((p)->acl_entrycount)
231
232
233#ifndef _KAUTH_ACL
234#define _KAUTH_ACL
235typedef struct kauth_acl *kauth_acl_t;
236#endif
237
238
239
240/*
241 * Extended File Security.
242 */
243
244/* File Security information */
245struct kauth_filesec {
246	u_int32_t       fsec_magic;
247#define KAUTH_FILESEC_MAGIC     0x012cc16d
248	guid_t          fsec_owner;
249	guid_t          fsec_group;
250
251	struct kauth_acl fsec_acl;
252};
253
254/* backwards compatibility */
255#define fsec_entrycount fsec_acl.acl_entrycount
256#define fsec_flags      fsec_acl.acl_flags
257#define fsec_ace        fsec_acl.acl_ace
258#define KAUTH_FILESEC_FLAGS_PRIVATE     KAUTH_ACL_FLAGS_PRIVATE
259#define KAUTH_FILESEC_DEFER_INHERIT     KAUTH_ACL_DEFER_INHERIT
260#define KAUTH_FILESEC_NO_INHERIT        KAUTH_ACL_NO_INHERIT
261#define KAUTH_FILESEC_NONE      ((kauth_filesec_t)0)
262#define KAUTH_FILESEC_WANTED    ((kauth_filesec_t)1)
263
264#ifndef _KAUTH_FILESEC
265#define _KAUTH_FILESEC
266typedef struct kauth_filesec *kauth_filesec_t;
267#endif
268
269#define KAUTH_FILESEC_SIZE(c)           (__offsetof(struct kauth_filesec, fsec_acl) + __offsetof(struct kauth_acl, acl_ace) + (c) * sizeof(struct kauth_ace))
270#define KAUTH_FILESEC_COPYSIZE(p)       KAUTH_FILESEC_SIZE(((p)->fsec_entrycount == KAUTH_FILESEC_NOACL) ? 0 : (p)->fsec_entrycount)
271#define KAUTH_FILESEC_COUNT(s)          (((s)  - KAUTH_FILESEC_SIZE(0)) / sizeof(struct kauth_ace))
272#define KAUTH_FILESEC_VALID(s)          ((s) >= KAUTH_FILESEC_SIZE(0) && (((s) - KAUTH_FILESEC_SIZE(0)) % sizeof(struct kauth_ace)) == 0)
273
274#define KAUTH_FILESEC_XATTR     "com.apple.system.Security"
275
276/* Allowable first arguments to kauth_filesec_acl_setendian() */
277#define KAUTH_ENDIAN_HOST       0x00000001      /* set host endianness */
278#define KAUTH_ENDIAN_DISK       0x00000002      /* set disk endianness */
279
280#endif /* KERNEL || <sys/acl.h> */
281
282/* Actions, also rights bits in an ACE */
283
284#if defined(KERNEL) || defined (_SYS_ACL_H)
285#define KAUTH_VNODE_READ_DATA                   (1U<<1)
286#define KAUTH_VNODE_LIST_DIRECTORY              KAUTH_VNODE_READ_DATA
287#define KAUTH_VNODE_WRITE_DATA                  (1U<<2)
288#define KAUTH_VNODE_ADD_FILE                    KAUTH_VNODE_WRITE_DATA
289#define KAUTH_VNODE_EXECUTE                     (1U<<3)
290#define KAUTH_VNODE_SEARCH                      KAUTH_VNODE_EXECUTE
291#define KAUTH_VNODE_DELETE                      (1U<<4)
292#define KAUTH_VNODE_APPEND_DATA                 (1U<<5)
293#define KAUTH_VNODE_ADD_SUBDIRECTORY            KAUTH_VNODE_APPEND_DATA
294#define KAUTH_VNODE_DELETE_CHILD                (1U<<6)
295#define KAUTH_VNODE_READ_ATTRIBUTES             (1U<<7)
296#define KAUTH_VNODE_WRITE_ATTRIBUTES            (1U<<8)
297#define KAUTH_VNODE_READ_EXTATTRIBUTES          (1U<<9)
298#define KAUTH_VNODE_WRITE_EXTATTRIBUTES         (1U<<10)
299#define KAUTH_VNODE_READ_SECURITY               (1U<<11)
300#define KAUTH_VNODE_WRITE_SECURITY              (1U<<12)
301#define KAUTH_VNODE_TAKE_OWNERSHIP              (1U<<13)
302
303/* backwards compatibility only */
304#define KAUTH_VNODE_CHANGE_OWNER                KAUTH_VNODE_TAKE_OWNERSHIP
305
306/* For Windows interoperability only */
307#define KAUTH_VNODE_SYNCHRONIZE                 (1U<<20)
308
309/* (1<<21) - (1<<24) are reserved for generic rights bits */
310
311/* Actions not expressed as rights bits */
312/*
313 * Authorizes the vnode as the target of a hard link.
314 */
315#define KAUTH_VNODE_LINKTARGET                  (1U<<25)
316
317/*
318 * Indicates that other steps have been taken to authorise the action,
319 * but authorisation should be denied for immutable objects.
320 */
321#define KAUTH_VNODE_CHECKIMMUTABLE              (1U<<26)
322
323/* Action modifiers */
324/*
325 * The KAUTH_VNODE_ACCESS bit is passed to the callback if the authorisation
326 * request in progress is advisory, rather than authoritative.  Listeners
327 * performing consequential work (i.e. not strictly checking authorisation)
328 * may test this flag to avoid performing unnecessary work.
329 *
330 * This bit will never be present in an ACE.
331 */
332#define KAUTH_VNODE_ACCESS                      (1U<<31)
333
334/*
335 * The KAUTH_VNODE_NOIMMUTABLE bit is passed to the callback along with the
336 * KAUTH_VNODE_WRITE_SECURITY bit (and no others) to indicate that the
337 * caller wishes to change one or more of the immutable flags, and the
338 * state of these flags should not be considered when authorizing the request.
339 * The system immutable flags are only ignored when the system securelevel
340 * is low enough to allow their removal.
341 */
342#define KAUTH_VNODE_NOIMMUTABLE                 (1U<<30)
343
344
345/*
346 * fake right that is composed by the following...
347 * vnode must have search for owner, group and world allowed
348 * plus there must be no deny modes present for SEARCH... this fake
349 * right is used by the fast lookup path to avoid checking
350 * for an exact match on the last credential to lookup
351 * the component being acted on
352 */
353#define KAUTH_VNODE_SEARCHBYANYONE              (1U<<29)
354
355
356/*
357 * when passed as an 'action' to "vnode_uncache_authorized_actions"
358 * it indicates that all of the cached authorizations for that
359 * vnode should be invalidated
360 */
361#define KAUTH_INVALIDATE_CACHED_RIGHTS          ((kauth_action_t)~0)
362
363
364
365/* The expansions of the GENERIC bits at evaluation time */
366#define KAUTH_VNODE_GENERIC_READ_BITS   (KAUTH_VNODE_READ_DATA |                \
367	                                KAUTH_VNODE_READ_ATTRIBUTES |           \
368	                                KAUTH_VNODE_READ_EXTATTRIBUTES |        \
369	                                KAUTH_VNODE_READ_SECURITY)
370
371#define KAUTH_VNODE_GENERIC_WRITE_BITS  (KAUTH_VNODE_WRITE_DATA |               \
372	                                KAUTH_VNODE_APPEND_DATA |               \
373	                                KAUTH_VNODE_DELETE |                    \
374	                                KAUTH_VNODE_DELETE_CHILD |              \
375	                                KAUTH_VNODE_WRITE_ATTRIBUTES |          \
376	                                KAUTH_VNODE_WRITE_EXTATTRIBUTES |       \
377	                                KAUTH_VNODE_WRITE_SECURITY)
378
379#define KAUTH_VNODE_GENERIC_EXECUTE_BITS (KAUTH_VNODE_EXECUTE)
380
381#define KAUTH_VNODE_GENERIC_ALL_BITS    (KAUTH_VNODE_GENERIC_READ_BITS |        \
382	                                KAUTH_VNODE_GENERIC_WRITE_BITS |        \
383	                                KAUTH_VNODE_GENERIC_EXECUTE_BITS)
384
385/*
386 * Some sets of bits, defined here for convenience.
387 */
388#define KAUTH_VNODE_WRITE_RIGHTS        (KAUTH_VNODE_ADD_FILE |                         \
389	                                KAUTH_VNODE_ADD_SUBDIRECTORY |                  \
390	                                KAUTH_VNODE_DELETE_CHILD |                      \
391	                                KAUTH_VNODE_WRITE_DATA |                        \
392	                                KAUTH_VNODE_APPEND_DATA |                       \
393	                                KAUTH_VNODE_DELETE |                            \
394	                                KAUTH_VNODE_WRITE_ATTRIBUTES |                  \
395	                                KAUTH_VNODE_WRITE_EXTATTRIBUTES |               \
396	                                KAUTH_VNODE_WRITE_SECURITY |                    \
397	                                KAUTH_VNODE_TAKE_OWNERSHIP |                    \
398	                                KAUTH_VNODE_LINKTARGET |                        \
399	                                KAUTH_VNODE_CHECKIMMUTABLE)
400
401
402#endif /* KERNEL || <sys/acl.h> */
403
404
405#endif /* __APPLE_API_EVOLVING */
406
407__END_DECLS
408
409#endif /* _SYS_KAUTH_H */