Print this page
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/sys/priv_impl.h
+++ new/usr/src/uts/common/sys/priv_impl.h
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License, Version 1.0 only
6 6 * (the "License"). You may not use this file except in compliance
7 7 * with the License.
8 8 *
9 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 10 * or http://www.opensolaris.org/os/licensing.
11 11 * See the License for the specific language governing permissions
12 12 * and limitations under the License.
13 13 *
14 14 * When distributing Covered Code, include this CDDL HEADER in each
15 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 16 * If applicable, add the following below this CDDL HEADER, with the
17 17 * fields enclosed by brackets "[]" replaced with your own identifying
18 18 * information: Portions Copyright [yyyy] [name of copyright owner]
19 19 *
|
↓ open down ↓ |
19 lines elided |
↑ open up ↑ |
20 20 * CDDL HEADER END
21 21 */
22 22 /*
23 23 * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
24 24 * Use is subject to license terms.
25 25 */
26 26
27 27 #ifndef _SYS_PRIV_IMPL_H
28 28 #define _SYS_PRIV_IMPL_H
29 29
30 -#pragma ident "%Z%%M% %I% %E% SMI"
31 -
32 30 #include <sys/priv_const.h>
33 31 #include <sys/priv.h>
34 32
35 33 #ifdef __cplusplus
36 34 extern "C" {
37 35 #endif
38 36
39 37 #if defined(_KERNEL) || defined(_KMEMUSER)
40 38 /*
41 39 * priv_set_t is a structure holding a set of privileges
42 40 */
43 41
44 42 struct priv_set {
45 43 priv_chunk_t pbits[PRIV_SETSIZE];
46 44 };
47 45
48 46 typedef struct cred_priv_s {
49 47 priv_set_t crprivs[PRIV_NSET]; /* Priv sets */
50 48 uint_t crpriv_flags; /* Privilege flags */
51 49 } cred_priv_t;
52 50
53 51 #endif
54 52
55 53 #ifdef _KERNEL
56 54
57 55 extern priv_set_t *priv_basic;
58 56 extern priv_set_t priv_unsafe;
59 57 extern priv_set_t priv_fullset;
60 58 extern void priv_init(void);
61 59
62 60 /* The CR_PRIVS macro is defined in <sys/cred_impl.h> */
63 61 #define CR_EPRIV(c) (CR_PRIVS(c)->crprivs[PRIV_EFFECTIVE])
64 62 #define CR_IPRIV(c) (CR_PRIVS(c)->crprivs[PRIV_INHERITABLE])
65 63 #define CR_PPRIV(c) (CR_PRIVS(c)->crprivs[PRIV_PERMITTED])
66 64 #define CR_LPRIV(c) (CR_PRIVS(c)->crprivs[PRIV_LIMIT])
67 65
68 66 #define CR_FLAGS(c) (CR_PRIVS(c)->crpriv_flags)
69 67
70 68 #define PRIV_SETBYTES (PRIV_NSET * PRIV_SETSIZE * sizeof (priv_chunk_t))
71 69
72 70 #define PRIV_EISAWARE(c) ((CR_FLAGS(c) & PRIV_AWARE) || (c)->cr_uid != 0)
73 71 #define PRIV_PISAWARE(c) ((CR_FLAGS(c) & PRIV_AWARE) || \
74 72 ((c)->cr_uid != 0 && (c)->cr_suid != 0 && \
75 73 (c)->cr_ruid != 0))
76 74
77 75 #define CR_OEPRIV(c) (*(PRIV_EISAWARE(c) ? &CR_EPRIV(c) : &CR_LPRIV(c)))
78 76 #define CR_OPPRIV(c) (*(PRIV_PISAWARE(c) ? &CR_PPRIV(c) : &CR_LPRIV(c)))
79 77
80 78 #define PRIV_VALIDSET(s) ((s) >= 0 && (s) < PRIV_NSET)
81 79 #define PRIV_VALIDOP(op) ((op) >= PRIV_ON && (op) <= PRIV_SET)
82 80
83 81 #define PRIV_FULLSET &priv_fullset /* Require full set */
84 82
85 83 /*
86 84 * Privilege macros bits manipulation macros; DEBUG kernels will
87 85 * ASSERT() that privileges are not out of range.
88 86 */
|
↓ open down ↓ |
47 lines elided |
↑ open up ↑ |
89 87 #ifndef NBBY
90 88 #define NBBY 8
91 89 #endif
92 90
93 91 #define __NBWRD (NBBY * sizeof (priv_chunk_t))
94 92
95 93 #define privmask(n) (1U << ((__NBWRD - 1) - ((n) % __NBWRD)))
96 94 #define privword(n) ((n)/__NBWRD)
97 95
98 96 /*
99 - * PRIV_ASSERT(a, b) sets privilege "b" in privilege set "a".
100 - * PRIV_CLEAR(a,b) clears privilege "b" in privilege set "a".
101 - * PRIV_ISASSERT tests if privilege 'b' is asserted in privilege set 'a'.
97 + * PRIV_ADDSET(a, b) sets privilege "b" in privilege set "a".
98 + * PRIV_DELSET(a, b) clears privilege "b" in privilege set "a".
99 + * PRIV_ISMEMBER(a, b) tests if privilege 'b' is asserted in privilege set 'a'.
102 100 */
103 101
104 -#define __PRIV_ASSERT(a, b) ((a)->pbits[privword(b)] |= privmask(b))
105 -#define __PRIV_CLEAR(a, b) ((a)->pbits[privword(b)] &= ~privmask(b))
106 -#define __PRIV_ISASSERT(a, b) ((a)->pbits[privword(b)] & privmask(b))
102 +#define __PRIV_ADDSET(a, b) ((a)->pbits[privword(b)] |= privmask(b))
103 +#define __PRIV_DELSET(a, b) ((a)->pbits[privword(b)] &= ~privmask(b))
104 +#define __PRIV_ISMEMBER(a, b) ((a)->pbits[privword(b)] & privmask(b))
107 105
108 106 #ifdef DEBUG
109 -#define PRIV_CLEAR(a, b) priv_delset((a), (b))
110 -#define PRIV_ASSERT(a, b) priv_addset((a), (b))
111 -#define PRIV_ISASSERT(a, b) priv_ismember((a), (b))
107 +#define PRIV_DELSET(a, b) priv_delset((a), (b))
108 +#define PRIV_ADDSET(a, b) priv_addset((a), (b))
109 +#define PRIV_ISMEMBER(a, b) priv_ismember((a), (b))
112 110 #else
113 -#define PRIV_CLEAR(a, b) __PRIV_CLEAR((a), (b))
114 -#define PRIV_ASSERT(a, b) __PRIV_ASSERT((a), (b))
115 -#define PRIV_ISASSERT(a, b) __PRIV_ISASSERT((a), (b))
111 +#define PRIV_DELSET(a, b) __PRIV_DELSET((a), (b))
112 +#define PRIV_ADDSET(a, b) __PRIV_ADDSET((a), (b))
113 +#define PRIV_ISMEMBER(a, b) __PRIV_ISMEMBER((a), (b))
116 114 #endif
117 115
118 116 #endif /* _KERNEL */
119 117
120 118 #ifdef __cplusplus
121 119 }
122 120 #endif
123 121
124 122 #endif /* _SYS_PRIV_IMPL_H */
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX