bsd/sys/guarded.h

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #ifndef _SYS_GUARDED_H_
  30 #define _SYS_GUARDED_H_
  31
  32 #include <sys/types.h>
  33 #include <sys/cdefs.h>
  34
  35 #include <sys/_types/_iovec_t.h>
  36 #ifdef PRIVATE
  37
  38 __BEGIN_DECLS
  39
  40 #if !defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE)
  41
  42 #ifndef _GUARDID_T
  43 #define _GUARDID_T
  44 typedef __uint64_t guardid_t;
  45 #endif /* _GUARDID_T */
  46
  47 #if !defined(KERNEL)
  48 extern int guarded_open_np(const char *path,
  49     const guardid_t *guard, u_int guardflags, int flags, ...);
  50 extern int guarded_open_dprotected_np(const char *path,
  51     const guardid_t *guard, u_int guardflags, int flags,
  52     int dpclass, int dpflags, ...);
  53 extern int guarded_kqueue_np(const guardid_t *guard, u_int guardflags);
  54 extern int guarded_close_np(int fd, const guardid_t *guard);
  55 extern int change_fdguard_np(int fd, const guardid_t *guard, u_int guardflags,
  56     const guardid_t *nguard, u_int nguardflags, int *fdflagsp);
  57 extern ssize_t guarded_write_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte);
  58 extern ssize_t guarded_pwrite_np(int fd, const guardid_t *guard, const void *buf, size_t nbyte, off_t offset);
  59 extern ssize_t guarded_writev_np(int fd, const guardid_t *guard, const struct iovec *iovp, int iovcnt);
  60 #endif /* KERNEL */
  61
  62 #ifndef GUARD_TYPE_FD
  63 /* temporary source compat: use <kern/exc_guard.h> instead */
  64 #define GUARD_TYPE_FD           0x2
  65 #endif
  66
  67 /*
  68  * File descriptor guard flavors.
  69  */
  70
  71 /*
  72  * Forbid close(2), and the implicit close() that a dup2(2) may do.
  73  * Forces close-on-fork to be set immutably too.
  74  */
  75 #define GUARD_CLOSE             (1u << 0)
  76
  77 /*
  78  * Forbid dup(2), dup2(2), and fcntl(2) subcodes F_DUPFD, F_DUPFD_CLOEXEC
  79  * on a guarded fd. Also forbids open's of a guarded fd via /dev/fd/
  80  * (an implicit dup.)
  81  */
  82 #define GUARD_DUP               (1u << 1)
  83
  84 /*
  85  * Forbid sending a guarded fd via a socket
  86  */
  87 #define GUARD_SOCKET_IPC        (1u << 2)
  88
  89 /*
  90  * Forbid creating a fileport from a guarded fd
  91  */
  92 #define GUARD_FILEPORT          (1u << 3)
  93
  94 /*
  95  * Forbid writes on a guarded fd
  96  */
  97 #define GUARD_WRITE             (1u << 4)
  98
  99 /*
 100  * Violating a guard results in an error (EPERM), and potentially
 101  * an exception with one or more of the following bits set.
 102  */
 103 enum guard_fd_exception_codes {
 104         kGUARD_EXC_CLOSE        = 1u << 0,      /* close of a guarded fd */
 105         kGUARD_EXC_DUP          = 1u << 1,      /* dup of a guarded fd */
 106         kGUARD_EXC_NOCLOEXEC    = 1u << 2,      /* clear close-on-exec */
 107         kGUARD_EXC_SOCKET_IPC   = 1u << 3,      /* sendmsg of a guarded fd */
 108         kGUARD_EXC_FILEPORT     = 1u << 4,      /* fileport_makeport .. */
 109         kGUARD_EXC_MISMATCH     = 1u << 5,      /* wrong guard for guarded fd */
 110         kGUARD_EXC_WRITE        = 1u << 6       /* write on a guarded fd */
 111 };
 112
 113 /*
 114  * Experimental guarded vnode support
 115  */
 116 #define VNG_RENAME_TO           (1u << 0)
 117 #define VNG_RENAME_FROM         (1u << 1)
 118 #define VNG_UNLINK              (1u << 2)
 119 #define VNG_WRITE_OTHER         (1u << 3)
 120 #define VNG_TRUNC_OTHER         (1u << 4)
 121 #define VNG_LINK                (1u << 5)
 122 #define VNG_EXCHDATA            (1u << 6)
 123
 124 #define VNG_ALL \
 125         (VNG_RENAME_TO | VNG_RENAME_FROM | VNG_UNLINK | VNG_LINK | \
 126          VNG_WRITE_OTHER | VNG_TRUNC_OTHER | VNG_EXCHDATA)
 127
 128 struct vnguard_set {
 129         int vns_fd;
 130         unsigned vns_attrs;
 131         guardid_t vns_guard;
 132 };
 133
 134 struct vnguard_getattr {
 135         int vga_fd;             /* in */
 136         unsigned vga_attrs;     /* out */
 137         guardid_t vga_guard;    /* in */
 138 };
 139
 140 #define VNG_SYSC_PING           0
 141 #define VNG_SYSC_SET_GUARD      1
 142 #define VNG_SYSC_GET_ATTR       2
 143
 144 #define VNG_POLICY_NAME         "vnguard"
 145
 146 /*
 147  * Violating a guard may result in an error (EPERM), and potentially
 148  * an exception with one or more of the following bits set.
 149  */
 150 enum guard_vn_exception_codes {
 151         kGUARD_EXC_RENAME_TO    = VNG_RENAME_TO,
 152         kGUARD_EXC_RENAME_FROM  = VNG_RENAME_FROM,
 153         kGUARD_EXC_UNLINK       = VNG_UNLINK,
 154         kGUARD_EXC_WRITE_OTHER  = VNG_WRITE_OTHER,
 155         kGUARD_EXC_TRUNC_OTHER  = VNG_TRUNC_OTHER,
 156         kGUARD_EXC_LINK         = VNG_LINK,
 157         kGUARD_EXC_EXCHDATA     = VNG_EXCHDATA,
 158 };
 159
 160 /* Guard violation behaviors: not all combinations make sense */
 161
 162 #define kVNG_POLICY_LOGMSG      (1u << 0)
 163 #define kVNG_POLICY_EPERM       (1u << 1)
 164 #define kVNG_POLICY_EXC         (1u << 2)
 165 #define kVNG_POLICY_EXC_CORPSE  (1u << 3)
 166 #define kVNG_POLICY_SIGKILL     (1u << 4)
 167 #define kVNG_POLICY_UPRINTMSG   (1u << 5)
 168
 169 #if defined(KERNEL)
 170 extern int vnguard_exceptions_active(void);
 171 extern void vnguard_policy_init(void);
 172 #endif /* KERNEL */
 173
 174 #endif /* (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */
 175
 176 __END_DECLS
 177
 178 #endif /* PRIVATE */
 179
 180 #endif /* !_SYS_GUARDED_H_ */