kauth.h (16639B) - Raw
1 /* 2 * Copyright (c) 2004-2010 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 /* 29 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce 30 * support for mandatory and extensible security protections. This notice 31 * is included in support of clause 2.2 (b) of the Apple Public License, 32 * Version 2.0. 33 */ 34 35 #ifndef _SYS_KAUTH_H 36 #define _SYS_KAUTH_H 37 38 #include <sys/appleapiopts.h> 39 #include <sys/cdefs.h> 40 #include <mach/boolean.h> 41 #include <machine/types.h> /* u_int8_t, etc. */ 42 #include <sys/_types.h> /* __offsetof() */ 43 #include <sys/_types/_uid_t.h> /* uid_t */ 44 #include <sys/_types/_gid_t.h> /* gid_t */ 45 #include <sys/_types/_guid_t.h> 46 #include <sys/syslimits.h> /* NGROUPS_MAX */ 47 48 __BEGIN_DECLS 49 50 #ifdef __APPLE_API_EVOLVING 51 52 /* 53 * Identities. 54 */ 55 56 #define KAUTH_UID_NONE (~(uid_t)0 - 100) /* not a valid UID */ 57 #define KAUTH_GID_NONE (~(gid_t)0 - 100) /* not a valid GID */ 58 59 /* NT Security Identifier, structure as defined by Microsoft */ 60 #pragma pack(1) /* push packing of 1 byte */ 61 typedef struct { 62 u_int8_t sid_kind; 63 u_int8_t sid_authcount; 64 u_int8_t sid_authority[6]; 65 #define KAUTH_NTSID_MAX_AUTHORITIES 16 66 u_int32_t sid_authorities[KAUTH_NTSID_MAX_AUTHORITIES]; 67 } ntsid_t; 68 #pragma pack() /* pop packing to previous packing level */ 69 #define _NTSID_T 70 71 /* valid byte count inside a SID structure */ 72 #define KAUTH_NTSID_HDRSIZE (8) 73 #define KAUTH_NTSID_SIZE(_s) (KAUTH_NTSID_HDRSIZE + ((_s)->sid_authcount * sizeof(u_int32_t))) 74 75 /* 76 * External lookup message payload; this structure is shared between the 77 * kernel group membership resolver, and the user space group membership 78 * resolver daemon, and is use to communicate resolution requests from the 79 * kernel to user space, and the result of that request from user space to 80 * the kernel. 81 */ 82 struct kauth_identity_extlookup { 83 u_int32_t el_seqno; /* request sequence number */ 84 u_int32_t el_result; /* lookup result */ 85 #define KAUTH_EXTLOOKUP_SUCCESS 0 /* results here are good */ 86 #define KAUTH_EXTLOOKUP_BADRQ 1 /* request badly formatted */ 87 #define KAUTH_EXTLOOKUP_FAILURE 2 /* transient failure during lookup */ 88 #define KAUTH_EXTLOOKUP_FATAL 3 /* permanent failure during lookup */ 89 #define KAUTH_EXTLOOKUP_INPROG 100 /* request in progress */ 90 u_int32_t el_flags; 91 #define KAUTH_EXTLOOKUP_VALID_UID (1<<0) 92 #define KAUTH_EXTLOOKUP_VALID_UGUID (1<<1) 93 #define KAUTH_EXTLOOKUP_VALID_USID (1<<2) 94 #define KAUTH_EXTLOOKUP_VALID_GID (1<<3) 95 #define KAUTH_EXTLOOKUP_VALID_GGUID (1<<4) 96 #define KAUTH_EXTLOOKUP_VALID_GSID (1<<5) 97 #define KAUTH_EXTLOOKUP_WANT_UID (1<<6) 98 #define KAUTH_EXTLOOKUP_WANT_UGUID (1<<7) 99 #define KAUTH_EXTLOOKUP_WANT_USID (1<<8) 100 #define KAUTH_EXTLOOKUP_WANT_GID (1<<9) 101 #define KAUTH_EXTLOOKUP_WANT_GGUID (1<<10) 102 #define KAUTH_EXTLOOKUP_WANT_GSID (1<<11) 103 #define KAUTH_EXTLOOKUP_WANT_MEMBERSHIP (1<<12) 104 #define KAUTH_EXTLOOKUP_VALID_MEMBERSHIP (1<<13) 105 #define KAUTH_EXTLOOKUP_ISMEMBER (1<<14) 106 #define KAUTH_EXTLOOKUP_VALID_PWNAM (1<<15) 107 #define KAUTH_EXTLOOKUP_WANT_PWNAM (1<<16) 108 #define KAUTH_EXTLOOKUP_VALID_GRNAM (1<<17) 109 #define KAUTH_EXTLOOKUP_WANT_GRNAM (1<<18) 110 #define KAUTH_EXTLOOKUP_VALID_SUPGRPS (1<<19) 111 #define KAUTH_EXTLOOKUP_WANT_SUPGRPS (1<<20) 112 113 __darwin_pid_t el_info_pid; /* request on behalf of PID */ 114 u_int64_t el_extend; /* extension field */ 115 u_int32_t el_info_reserved_1; /* reserved (APPLE) */ 116 117 uid_t el_uid; /* user ID */ 118 guid_t el_uguid; /* user GUID */ 119 u_int32_t el_uguid_valid; /* TTL on translation result (seconds) */ 120 ntsid_t el_usid; /* user NT SID */ 121 u_int32_t el_usid_valid; /* TTL on translation result (seconds) */ 122 gid_t el_gid; /* group ID */ 123 guid_t el_gguid; /* group GUID */ 124 u_int32_t el_gguid_valid; /* TTL on translation result (seconds) */ 125 ntsid_t el_gsid; /* group SID */ 126 u_int32_t el_gsid_valid; /* TTL on translation result (seconds) */ 127 u_int32_t el_member_valid; /* TTL on group lookup result */ 128 u_int32_t el_sup_grp_cnt; /* count of supplemental groups up to NGROUPS */ 129 gid_t el_sup_groups[NGROUPS_MAX]; /* supplemental group list */ 130 }; 131 132 struct kauth_cache_sizes { 133 u_int32_t kcs_group_size; 134 u_int32_t kcs_id_size; 135 }; 136 137 #define KAUTH_EXTLOOKUP_REGISTER (0) 138 #define KAUTH_EXTLOOKUP_RESULT (1<<0) 139 #define KAUTH_EXTLOOKUP_WORKER (1<<1) 140 #define KAUTH_EXTLOOKUP_DEREGISTER (1<<2) 141 #define KAUTH_GET_CACHE_SIZES (1<<3) 142 #define KAUTH_SET_CACHE_SIZES (1<<4) 143 #define KAUTH_CLEAR_CACHES (1<<5) 144 145 #define IDENTITYSVC_ENTITLEMENT "com.apple.private.identitysvc" 146 147 #if defined(KERNEL) || defined (_SYS_ACL_H) 148 #pragma mark - kauth 149 #pragma mark kauth: Generic Access Control Lists. 150 151 typedef u_int32_t kauth_ace_rights_t; 152 153 /* Access Control List Entry (ACE) */ 154 struct kauth_ace { 155 guid_t ace_applicable; 156 u_int32_t ace_flags; 157 #define KAUTH_ACE_KINDMASK 0xf 158 #define KAUTH_ACE_PERMIT 1 159 #define KAUTH_ACE_DENY 2 160 #define KAUTH_ACE_AUDIT 3 /* not implemented */ 161 #define KAUTH_ACE_ALARM 4 /* not implemented */ 162 #define KAUTH_ACE_INHERITED (1<<4) 163 #define KAUTH_ACE_FILE_INHERIT (1<<5) 164 #define KAUTH_ACE_DIRECTORY_INHERIT (1<<6) 165 #define KAUTH_ACE_LIMIT_INHERIT (1<<7) 166 #define KAUTH_ACE_ONLY_INHERIT (1<<8) 167 #define KAUTH_ACE_SUCCESS (1<<9) /* not implemented (AUDIT/ALARM) */ 168 #define KAUTH_ACE_FAILURE (1<<10) /* not implemented (AUDIT/ALARM) */ 169 /* All flag bits controlling ACE inheritance */ 170 #define KAUTH_ACE_INHERIT_CONTROL_FLAGS \ 171 (KAUTH_ACE_FILE_INHERIT | \ 172 KAUTH_ACE_DIRECTORY_INHERIT | \ 173 KAUTH_ACE_LIMIT_INHERIT | \ 174 KAUTH_ACE_ONLY_INHERIT) 175 kauth_ace_rights_t ace_rights; /* scope specific */ 176 /* These rights are never tested, but may be present in an ACL */ 177 #define KAUTH_ACE_GENERIC_ALL (1<<21) 178 #define KAUTH_ACE_GENERIC_EXECUTE (1<<22) 179 #define KAUTH_ACE_GENERIC_WRITE (1<<23) 180 #define KAUTH_ACE_GENERIC_READ (1<<24) 181 }; 182 183 #ifndef _KAUTH_ACE 184 #define _KAUTH_ACE 185 typedef struct kauth_ace *kauth_ace_t; 186 #endif 187 188 189 /* Access Control List */ 190 struct kauth_acl { 191 u_int32_t acl_entrycount; 192 u_int32_t acl_flags; 193 194 struct kauth_ace acl_ace[1]; 195 }; 196 197 /* 198 * XXX this value needs to be raised - 3893388 199 */ 200 #define KAUTH_ACL_MAX_ENTRIES 128 201 202 /* 203 * The low 16 bits of the flags field are reserved for filesystem 204 * internal use and must be preserved by all APIs. This includes 205 * round-tripping flags through user-space interfaces. 206 */ 207 #define KAUTH_ACL_FLAGS_PRIVATE (0xffff) 208 209 /* 210 * The high 16 bits of the flags are used to store attributes and 211 * to request specific handling of the ACL. 212 */ 213 214 /* inheritance will be deferred until the first rename operation */ 215 #define KAUTH_ACL_DEFER_INHERIT (1<<16) 216 /* this ACL must not be overwritten as part of an inheritance operation */ 217 #define KAUTH_ACL_NO_INHERIT (1<<17) 218 219 /* acl_entrycount that tells us the ACL is not valid */ 220 #define KAUTH_FILESEC_NOACL ((u_int32_t)(-1)) 221 222 /* 223 * If the acl_entrycount field is KAUTH_FILESEC_NOACL, then the size is the 224 * same as a kauth_acl structure; the intent is to put an actual entrycount of 225 * KAUTH_FILESEC_NOACL on disk to distinguish a kauth_filesec_t with an empty 226 * entry (Windows treats this as "deny all") from one that merely indicates a 227 * file group and/or owner guid values. 228 */ 229 #define KAUTH_ACL_SIZE(c) (__offsetof(struct kauth_acl, acl_ace) + ((u_int32_t)(c) != KAUTH_FILESEC_NOACL ? ((c) * sizeof(struct kauth_ace)) : 0)) 230 #define KAUTH_ACL_COPYSIZE(p) KAUTH_ACL_SIZE((p)->acl_entrycount) 231 232 233 #ifndef _KAUTH_ACL 234 #define _KAUTH_ACL 235 typedef struct kauth_acl *kauth_acl_t; 236 #endif 237 238 239 240 /* 241 * Extended File Security. 242 */ 243 244 /* File Security information */ 245 struct kauth_filesec { 246 u_int32_t fsec_magic; 247 #define KAUTH_FILESEC_MAGIC 0x012cc16d 248 guid_t fsec_owner; 249 guid_t fsec_group; 250 251 struct kauth_acl fsec_acl; 252 }; 253 254 /* backwards compatibility */ 255 #define fsec_entrycount fsec_acl.acl_entrycount 256 #define fsec_flags fsec_acl.acl_flags 257 #define fsec_ace fsec_acl.acl_ace 258 #define KAUTH_FILESEC_FLAGS_PRIVATE KAUTH_ACL_FLAGS_PRIVATE 259 #define KAUTH_FILESEC_DEFER_INHERIT KAUTH_ACL_DEFER_INHERIT 260 #define KAUTH_FILESEC_NO_INHERIT KAUTH_ACL_NO_INHERIT 261 #define KAUTH_FILESEC_NONE ((kauth_filesec_t)0) 262 #define KAUTH_FILESEC_WANTED ((kauth_filesec_t)1) 263 264 #ifndef _KAUTH_FILESEC 265 #define _KAUTH_FILESEC 266 typedef struct kauth_filesec *kauth_filesec_t; 267 #endif 268 269 #define KAUTH_FILESEC_SIZE(c) (__offsetof(struct kauth_filesec, fsec_acl) + __offsetof(struct kauth_acl, acl_ace) + (c) * sizeof(struct kauth_ace)) 270 #define KAUTH_FILESEC_COPYSIZE(p) KAUTH_FILESEC_SIZE(((p)->fsec_entrycount == KAUTH_FILESEC_NOACL) ? 0 : (p)->fsec_entrycount) 271 #define KAUTH_FILESEC_COUNT(s) (((s) - KAUTH_FILESEC_SIZE(0)) / sizeof(struct kauth_ace)) 272 #define KAUTH_FILESEC_VALID(s) ((s) >= KAUTH_FILESEC_SIZE(0) && (((s) - KAUTH_FILESEC_SIZE(0)) % sizeof(struct kauth_ace)) == 0) 273 274 #define KAUTH_FILESEC_XATTR "com.apple.system.Security" 275 276 /* Allowable first arguments to kauth_filesec_acl_setendian() */ 277 #define KAUTH_ENDIAN_HOST 0x00000001 /* set host endianness */ 278 #define KAUTH_ENDIAN_DISK 0x00000002 /* set disk endianness */ 279 280 #endif /* KERNEL || <sys/acl.h> */ 281 282 /* Actions, also rights bits in an ACE */ 283 284 #if defined(KERNEL) || defined (_SYS_ACL_H) 285 #define KAUTH_VNODE_READ_DATA (1U<<1) 286 #define KAUTH_VNODE_LIST_DIRECTORY KAUTH_VNODE_READ_DATA 287 #define KAUTH_VNODE_WRITE_DATA (1U<<2) 288 #define KAUTH_VNODE_ADD_FILE KAUTH_VNODE_WRITE_DATA 289 #define KAUTH_VNODE_EXECUTE (1U<<3) 290 #define KAUTH_VNODE_SEARCH KAUTH_VNODE_EXECUTE 291 #define KAUTH_VNODE_DELETE (1U<<4) 292 #define KAUTH_VNODE_APPEND_DATA (1U<<5) 293 #define KAUTH_VNODE_ADD_SUBDIRECTORY KAUTH_VNODE_APPEND_DATA 294 #define KAUTH_VNODE_DELETE_CHILD (1U<<6) 295 #define KAUTH_VNODE_READ_ATTRIBUTES (1U<<7) 296 #define KAUTH_VNODE_WRITE_ATTRIBUTES (1U<<8) 297 #define KAUTH_VNODE_READ_EXTATTRIBUTES (1U<<9) 298 #define KAUTH_VNODE_WRITE_EXTATTRIBUTES (1U<<10) 299 #define KAUTH_VNODE_READ_SECURITY (1U<<11) 300 #define KAUTH_VNODE_WRITE_SECURITY (1U<<12) 301 #define KAUTH_VNODE_TAKE_OWNERSHIP (1U<<13) 302 303 /* backwards compatibility only */ 304 #define KAUTH_VNODE_CHANGE_OWNER KAUTH_VNODE_TAKE_OWNERSHIP 305 306 /* For Windows interoperability only */ 307 #define KAUTH_VNODE_SYNCHRONIZE (1U<<20) 308 309 /* (1<<21) - (1<<24) are reserved for generic rights bits */ 310 311 /* Actions not expressed as rights bits */ 312 /* 313 * Authorizes the vnode as the target of a hard link. 314 */ 315 #define KAUTH_VNODE_LINKTARGET (1U<<25) 316 317 /* 318 * Indicates that other steps have been taken to authorise the action, 319 * but authorisation should be denied for immutable objects. 320 */ 321 #define KAUTH_VNODE_CHECKIMMUTABLE (1U<<26) 322 323 /* Action modifiers */ 324 /* 325 * The KAUTH_VNODE_ACCESS bit is passed to the callback if the authorisation 326 * request in progress is advisory, rather than authoritative. Listeners 327 * performing consequential work (i.e. not strictly checking authorisation) 328 * may test this flag to avoid performing unnecessary work. 329 * 330 * This bit will never be present in an ACE. 331 */ 332 #define KAUTH_VNODE_ACCESS (1U<<31) 333 334 /* 335 * The KAUTH_VNODE_NOIMMUTABLE bit is passed to the callback along with the 336 * KAUTH_VNODE_WRITE_SECURITY bit (and no others) to indicate that the 337 * caller wishes to change one or more of the immutable flags, and the 338 * state of these flags should not be considered when authorizing the request. 339 * The system immutable flags are only ignored when the system securelevel 340 * is low enough to allow their removal. 341 */ 342 #define KAUTH_VNODE_NOIMMUTABLE (1U<<30) 343 344 345 /* 346 * fake right that is composed by the following... 347 * vnode must have search for owner, group and world allowed 348 * plus there must be no deny modes present for SEARCH... this fake 349 * right is used by the fast lookup path to avoid checking 350 * for an exact match on the last credential to lookup 351 * the component being acted on 352 */ 353 #define KAUTH_VNODE_SEARCHBYANYONE (1U<<29) 354 355 356 /* 357 * when passed as an 'action' to "vnode_uncache_authorized_actions" 358 * it indicates that all of the cached authorizations for that 359 * vnode should be invalidated 360 */ 361 #define KAUTH_INVALIDATE_CACHED_RIGHTS ((kauth_action_t)~0) 362 363 364 365 /* The expansions of the GENERIC bits at evaluation time */ 366 #define KAUTH_VNODE_GENERIC_READ_BITS (KAUTH_VNODE_READ_DATA | \ 367 KAUTH_VNODE_READ_ATTRIBUTES | \ 368 KAUTH_VNODE_READ_EXTATTRIBUTES | \ 369 KAUTH_VNODE_READ_SECURITY) 370 371 #define KAUTH_VNODE_GENERIC_WRITE_BITS (KAUTH_VNODE_WRITE_DATA | \ 372 KAUTH_VNODE_APPEND_DATA | \ 373 KAUTH_VNODE_DELETE | \ 374 KAUTH_VNODE_DELETE_CHILD | \ 375 KAUTH_VNODE_WRITE_ATTRIBUTES | \ 376 KAUTH_VNODE_WRITE_EXTATTRIBUTES | \ 377 KAUTH_VNODE_WRITE_SECURITY) 378 379 #define KAUTH_VNODE_GENERIC_EXECUTE_BITS (KAUTH_VNODE_EXECUTE) 380 381 #define KAUTH_VNODE_GENERIC_ALL_BITS (KAUTH_VNODE_GENERIC_READ_BITS | \ 382 KAUTH_VNODE_GENERIC_WRITE_BITS | \ 383 KAUTH_VNODE_GENERIC_EXECUTE_BITS) 384 385 /* 386 * Some sets of bits, defined here for convenience. 387 */ 388 #define KAUTH_VNODE_WRITE_RIGHTS (KAUTH_VNODE_ADD_FILE | \ 389 KAUTH_VNODE_ADD_SUBDIRECTORY | \ 390 KAUTH_VNODE_DELETE_CHILD | \ 391 KAUTH_VNODE_WRITE_DATA | \ 392 KAUTH_VNODE_APPEND_DATA | \ 393 KAUTH_VNODE_DELETE | \ 394 KAUTH_VNODE_WRITE_ATTRIBUTES | \ 395 KAUTH_VNODE_WRITE_EXTATTRIBUTES | \ 396 KAUTH_VNODE_WRITE_SECURITY | \ 397 KAUTH_VNODE_TAKE_OWNERSHIP | \ 398 KAUTH_VNODE_LINKTARGET | \ 399 KAUTH_VNODE_CHECKIMMUTABLE) 400 401 402 #endif /* KERNEL || <sys/acl.h> */ 403 404 405 #endif /* __APPLE_API_EVOLVING */ 406 407 __END_DECLS 408 409 #endif /* _SYS_KAUTH_H */