45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk/*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * CDDL HEADER START
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * The contents of this file are subject to the terms of the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Common Development and Distribution License (the "License").
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * You may not use this file except in compliance with the License.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * or http://www.opensolaris.org/os/licensing.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * See the License for the specific language governing permissions
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * and limitations under the License.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * When distributing Covered Code, include this CDDL HEADER in each
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If applicable, add the following below this CDDL HEADER, with the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * fields enclosed by brackets "[]" replaced with your own identifying
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * information: Portions Copyright [yyyy] [name of copyright owner]
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * CDDL HEADER END
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk/*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Copyright 2006 Sun Microsystems, Inc. All rights reserved.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Use is subject to license terms.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk#pragma ident "%Z%%M% %I% %E% SMI"
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk#include <errno.h>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk#include <priv.h>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk#include <sys/tsol/priv.h>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk#include <sys/varargs.h>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk/*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * set_effective_priv(op, num_priv, priv_id1, priv_id2, ... )
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Library routine to enable a user process to set its effective
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * privilege set appropriately using a single call. User is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * required to specify the number of privilege ids that follow as
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * arguments, rather than depending on the compiler to terminate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the argument list with a NULL, which may be compiler-dependent.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpkint
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpkset_effective_priv(priv_op_t op, int num_priv, ...)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk{
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_set_t *priv_set;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_t priv_id;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_list ap;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk int status;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_set = priv_allocset();
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk PRIV_EMPTY(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_start(ap, num_priv);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (num_priv--) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk char *priv_name;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Do sanity checking on priv_id's here to assure
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * valid inputs to privilege macros. This checks
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * num_priv argument as well.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_id = va_arg(ap, priv_t);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_name = (char *)priv_getbynum((int)(uintptr_t)priv_id);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if (priv_name == NULL) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk errno = EINVAL;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_freeset(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk }
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (void) priv_addset(priv_set, priv_name);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk }
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_end(ap);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Depend on system call to do sanity checking on "op"
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk status = setppriv(op, PRIV_EFFECTIVE, priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_freeset(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (status);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk} /* set_effective_priv() */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk/*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * set_inheritable_priv(op, num_priv, priv_id1, priv_id2, ... )
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Library routine to enable a user process to set its inheritable
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * privilege set appropriately using a single call. User is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * required to specify the number of privilege ids that follow as
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * arguments, rather than depending on the compiler to terminate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the argument list with a NULL, which may be compiler-dependent.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpkint
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpkset_inheritable_priv(priv_op_t op, int num_priv, ...)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk{
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_set_t *priv_set;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_t priv_id;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_list ap;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk int status;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_set = priv_allocset();
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk PRIV_EMPTY(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_start(ap, num_priv);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (num_priv--) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Do sanity checking on priv_id's here to assure
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * valid inputs to privilege macros. This checks
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * num_priv argument as well.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_id = va_arg(ap, priv_t);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if ((char *)priv_getbynum((int)(uintptr_t)priv_id) == NULL) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk errno = EINVAL;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_freeset(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk }
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (void) PRIV_ASSERT(priv_set, priv_id);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk }
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_end(ap);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Depend on system call to do sanity checking on "op"
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk status = setppriv(op, PRIV_INHERITABLE, priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_freeset(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (status);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk} /* set_inheritable_priv() */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk/*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * set_permitted_priv(op, num_priv, priv_id1, priv_id2, ... )
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk *
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Library routine to enable a user process to set its permitted
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * privilege set appropriately using a single call. User is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * required to specify the number of privilege ids that follow as
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * arguments, rather than depending on the compiler to terminate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the argument list with a NULL, which may be compiler-dependent.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpkint
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpkset_permitted_priv(priv_op_t op, int num_priv, ...)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk{
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_set_t *priv_set;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_t priv_id;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_list ap;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk int status;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_set = priv_allocset();
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk PRIV_EMPTY(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_start(ap, num_priv);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (num_priv--) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Do sanity checking on priv_id's here to assure
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * valid inputs to privilege macros. This checks
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * num_priv argument as well.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_id = va_arg(ap, priv_t);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if ((char *)priv_getbynum((int)(uintptr_t)priv_id) == NULL) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk errno = EINVAL;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_freeset(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk }
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (void) PRIV_ASSERT(priv_set, priv_id);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk }
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk va_end(ap);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /*
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Depend on system call to do sanity checking on "op"
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk status = setppriv(op, PRIV_PERMITTED, priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk priv_freeset(priv_set);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (status);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk} /* set_permitted_priv() */