/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.

 */

#include <sys/types.h>

#include <sys/sysmacros.h>

#include <sys/param.h>

#include <sys/systm.h>

#include <sys/cred_impl.h>

#include <sys/vnode.h>

#include <sys/vfs.h>

#include <sys/stat.h>

#include <sys/errno.h>

#include <sys/kmem.h>

#include <sys/user.h>

#include <sys/proc.h>

#include <sys/acct.h>

#include <sys/ipc_impl.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>

#include <sys/policy.h>

#include <sys/kobj.h>

#include <sys/msg.h>

#include <sys/devpolicy.h>

#include <c2/audit.h>

#include <sys/varargs.h>

#include <sys/klpd.h>

#include <sys/modctl.h>

#include <sys/disp.h>

#include <sys/zone.h>

#include <inet/optcom.h>

#include <sys/sdt.h>

#include <sys/vfs.h>

#include <sys/mntent.h>

#include <sys/contract_impl.h>

#include <sys/dld_ioc.h>

/*

 * There are two possible layers of privilege routines and two possible

 * levels of secpolicy.  Plus one other we may not be interested in, so

 * we may need as many as 6 but no more.

 */

#define	MAXPRIVSTACK		6

int priv_debug = 0;

int priv_basic_test = -1;

/*

 * This file contains the majority of the policy routines.

 * Since the policy routines are defined by function and not

 * by privilege, there is quite a bit of duplication of

 * functions.

 *

 * The secpolicy functions must not make assumptions about

 * locks held or not held as any lock can be held while they're

 * being called.

 *

 * Credentials are read-only so no special precautions need to

 * be taken while locking them.

 *

 * When a new policy check needs to be added to the system the

 * following procedure should be followed:

 *

 *		Pick an appropriate secpolicy_*() function

 *			-> done if one exists.

 *		Create a new secpolicy function, preferably with

 *		a descriptive name using the standard template.

 *		Pick an appropriate privilege for the policy.

 *		If no appropraite privilege exists, define new one

 *		(this should be done with extreme care; in most cases

 *		little is gained by adding another privilege)

 *

 * WHY ROOT IS STILL SPECIAL.

 *

 * In a number of the policy functions, there are still explicit

 * checks for uid 0.  The rationale behind these is that many root

 * owned files/objects hold configuration information which can give full

 * privileges to the user once written to.  To prevent escalation

 * of privilege by allowing just a single privilege to modify root owned

 * objects, we've added these root specific checks where we considered

 * them necessary: modifying root owned files, changing uids to 0, etc.

 *

 * PRIVILEGE ESCALATION AND ZONES.

 *

 * A number of operations potentially allow the caller to achieve

 * privileges beyond the ones normally required to perform the operation.

 * For example, if allowed to create a setuid 0 executable, a process can

 * gain privileges beyond PRIV_FILE_SETID.  Zones, however, place

 * restrictions on the ability to gain privileges beyond those available

 * within the zone through file and process manipulation.  Hence, such

 * operations require that the caller have an effective set that includes

 * all privileges available within the current zone, or all privileges

 * if executing in the global zone.

 *

 * This is indicated in the priv_policy* policy checking functions

 * through a combination of parameters.  The "priv" parameter indicates

 * the privilege that is required, and the "allzone" parameter indicates

 * whether or not all privileges in the zone are required.  In addition,

 * priv can be set to PRIV_ALL to indicate that all privileges are

 * required (regardless of zone).  There are three scenarios of interest:

 * (1) operation requires a specific privilege

 * (2) operation requires a specific privilege, and requires all

 *     privileges available within the zone (or all privileges if in

 *     the global zone)

 * (3) operation requires all privileges, regardless of zone

 *

 * For (1), priv should be set to the specific privilege, and allzone

 * should be set to B_FALSE.

 * For (2), priv should be set to the specific privilege, and allzone

 * should be set to B_TRUE.

 * For (3), priv should be set to PRIV_ALL, and allzone should be set

 * to B_FALSE.

 *

 */

/*

 * The privileges are checked against the Effective set for

 * ordinary processes and checked against the Limit set

 * for euid 0 processes that haven't manipulated their privilege

 * sets.

 */

#define	HAS_ALLPRIVS(cr)	priv_isfullset(&CR_OEPRIV(cr))

#define	ZONEPRIVS(cr)		((cr)->cr_zone->zone_privset)

#define	HAS_ALLZONEPRIVS(cr)	priv_issubset(ZONEPRIVS(cr), &CR_OEPRIV(cr))

#define	HAS_PRIVILEGE(cr, pr)	((pr) == PRIV_ALL ? \

					HAS_ALLPRIVS(cr) : \

					PRIV_ISASSERT(&CR_OEPRIV(cr), pr))

#define	FAST_BASIC_CHECK(cr, priv)	\

	if (PRIV_ISASSERT(&CR_OEPRIV(cr), priv)) { \

		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, B_FALSE); \

		return (0); \

	}

/*

 * Policy checking functions.

 *

 * All of the system's policy should be implemented here.

 */

/*

 * Private functions which take an additional va_list argument to

 * implement an object specific policy override.

 */

static int priv_policy_ap(const cred_t *, int, boolean_t, int,

    const char *, va_list);

static int priv_policy_va(const cred_t *, int, boolean_t, int,

    const char *, ...);

/*

 * Generic policy calls

 *

 * The "bottom" functions of policy control

 */

static char *

mprintf(const char *fmt, ...)

{

	va_list args;

	char *buf;

	size_t len;

	va_start(args, fmt);

	len = vsnprintf(NULL, 0, fmt, args) + 1;

	va_end(args);

	buf = kmem_alloc(len, KM_NOSLEEP);

	if (buf == NULL)

		return (NULL);

	va_start(args, fmt);

	(void) vsnprintf(buf, len, fmt, args);

	va_end(args);

	return (buf);

}

/*

 * priv_policy_errmsg()

 *

 * Generate an error message if privilege debugging is enabled system wide

 * or for this particular process.

 */

#define	FMTHDR	"%s[%d]: missing privilege \"%s\" (euid = %d, syscall = %d)"

#define	FMTMSG	" for \"%s\""

#define	FMTFUN	" needed at %s+0x%lx"

/* The maximum size privilege format: the concatenation of the above */

#define	FMTMAX	FMTHDR FMTMSG FMTFUN "\n"

static void

priv_policy_errmsg(const cred_t *cr, int priv, const char *msg)

{

	struct proc *me;

	pc_t stack[MAXPRIVSTACK];

	int depth;

	int i;

	char *sym;

	ulong_t off;

	const char *pname;

	char *cmd;

	char fmt[sizeof (FMTMAX)];

	if ((me = curproc) == &p0)

		return;

	/* Privileges must be defined  */

	ASSERT(priv == PRIV_ALL || priv == PRIV_MULTIPLE ||

	    priv == PRIV_ALLZONE || priv == PRIV_GLOBAL ||

	    priv_getbynum(priv) != NULL);

	if (priv == PRIV_ALLZONE && INGLOBALZONE(me))

		priv = PRIV_ALL;

	if (curthread->t_pre_sys)

		ttolwp(curthread)->lwp_badpriv = (short)priv;

	if (priv_debug == 0 && (CR_FLAGS(cr) & PRIV_DEBUG) == 0)

		return;

	(void) strcpy(fmt, FMTHDR);

	if (me->p_user.u_comm[0])

		cmd = &me->p_user.u_comm[0];

	else

		cmd = "priv_policy";

	if (msg != NULL && *msg != '\0') {

		(void) strcat(fmt, FMTMSG);

	} else {

		(void) strcat(fmt, "%s");

		msg = "";

	}

	sym = NULL;

	depth = getpcstack(stack, MAXPRIVSTACK);

	/*

	 * Try to find the first interesting function on the stack.

	 * priv_policy* that's us, so completely uninteresting.

	 * suser(), drv_priv(), secpolicy_* are also called from

	 * too many locations to convey useful information.

	 */

	for (i = 0; i < depth; i++) {

		sym = kobj_getsymname((uintptr_t)stack[i], &off);

		if (sym != NULL &&

		    strstr(sym, "hasprocperm") == 0 &&

		    strcmp("suser", sym) != 0 &&

		    strcmp("ipcaccess", sym) != 0 &&

		    strcmp("drv_priv", sym) != 0 &&

		    strncmp("secpolicy_", sym, 10) != 0 &&

		    strncmp("priv_policy", sym, 11) != 0)

			break;

	}

	if (sym != NULL)

		(void) strcat(fmt, FMTFUN);

	(void) strcat(fmt, "\n");

	switch (priv) {

	case PRIV_ALL:

		pname = "ALL";

		break;

	case PRIV_MULTIPLE:

		pname = "MULTIPLE";

		break;

	case PRIV_ALLZONE:

		pname = "ZONE";

		break;

	case PRIV_GLOBAL:

		pname = "GLOBAL";

		break;

	default:

		pname = priv_getbynum(priv);

		break;

	}

	if (CR_FLAGS(cr) & PRIV_DEBUG) {

		/* Remember last message, just like lwp_badpriv. */

		if (curthread->t_pdmsg != NULL) {

			kmem_free(curthread->t_pdmsg,

			    strlen(curthread->t_pdmsg) + 1);

		}

		curthread->t_pdmsg = mprintf(fmt, cmd, me->p_pid, pname,

		    cr->cr_uid, curthread->t_sysnum, msg, sym, off);

		curthread->t_post_sys = 1;

	}

	if (priv_debug) {

		cmn_err(CE_NOTE, fmt, cmd, me->p_pid, pname, cr->cr_uid,

		    curthread->t_sysnum, msg, sym, off);

	}

}

/*

 * Override the policy, if appropriate.  Return 0 if the external

 * policy engine approves.

 */

static int

priv_policy_override(const cred_t *cr, int priv, boolean_t allzone, va_list ap)

{

	priv_set_t set;

	int ret;

	if (!(CR_FLAGS(cr) & PRIV_XPOLICY))

		return (-1);

	if (priv == PRIV_ALL) {

		priv_fillset(&set);

	} else if (allzone) {

		set = *ZONEPRIVS(cr);

	} else {

		priv_emptyset(&set);

		priv_addset(&set, priv);

	}

	ret = klpd_call(cr, &set, ap);

	return (ret);

}

static int

priv_policy_override_set(const cred_t *cr, const priv_set_t *req, va_list ap)

{

	if (CR_FLAGS(cr) & PRIV_PFEXEC)

		return (check_user_privs(cr, req));

	if (CR_FLAGS(cr) & PRIV_XPOLICY) {

		return (klpd_call(cr, req, ap));

	}

	return (-1);

}

static int

priv_policy_override_set_va(const cred_t *cr, const priv_set_t *req, ...)

{

	va_list ap;

	int ret;

	va_start(ap, req);

	ret = priv_policy_override_set(cr, req, ap);

	va_end(ap);

	return (ret);

}

/*

 * Audit failure, log error message.

 */

static void

priv_policy_err(const cred_t *cr, int priv, boolean_t allzone, const char *msg)

{

	if (AU_AUDITING())

		audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 0);

	DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone);

	if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) ||

	    curthread->t_pre_sys) {

		if (allzone && !HAS_ALLZONEPRIVS(cr)) {

			priv_policy_errmsg(cr, PRIV_ALLZONE, msg);

		} else {

			ASSERT(!HAS_PRIVILEGE(cr, priv));

			priv_policy_errmsg(cr, priv, msg);

		}

	}

}

/*

 * priv_policy_ap()

 * return 0 or error.

 * See block comment above for a description of "priv" and "allzone" usage.

 */

static int

priv_policy_ap(const cred_t *cr, int priv, boolean_t allzone, int err,

    const char *msg, va_list ap)

{

	if ((HAS_PRIVILEGE(cr, priv) && (!allzone || HAS_ALLZONEPRIVS(cr))) ||

	    (!servicing_interrupt() &&

	    priv_policy_override(cr, priv, allzone, ap) == 0)) {

		if ((allzone || priv == PRIV_ALL ||

		    !PRIV_ISASSERT(priv_basic, priv)) &&

		    !servicing_interrupt()) {

			PTOU(curproc)->u_acflag |= ASU; /* Needed for SVVS */

			if (AU_AUDITING())

				audit_priv(priv,

				    allzone ? ZONEPRIVS(cr) : NULL, 1);

		}

		err = 0;

		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone);

	} else if (!servicing_interrupt()) {

		/* Failure audited in this procedure */

		priv_policy_err(cr, priv, allzone, msg);

	}

	return (err);

}

int

priv_policy_va(const cred_t *cr, int priv, boolean_t allzone, int err,

    const char *msg, ...)

{

	int ret;

	va_list ap;

	va_start(ap, msg);

	ret = priv_policy_ap(cr, priv, allzone, err, msg, ap);

	va_end(ap);

	return (ret);

}

int

priv_policy(const cred_t *cr, int priv, boolean_t allzone, int err,

    const char *msg)

{

	return (priv_policy_va(cr, priv, allzone, err, msg, KLPDARG_NONE));

}

/*

 * Return B_TRUE for sufficient privileges, B_FALSE for insufficient privileges.

 */

boolean_t

priv_policy_choice(const cred_t *cr, int priv, boolean_t allzone)

{

	boolean_t res = HAS_PRIVILEGE(cr, priv) &&

	    (!allzone || HAS_ALLZONEPRIVS(cr));

	/* Audit success only */

	if (res && AU_AUDITING() &&

	    (allzone || priv == PRIV_ALL || !PRIV_ISASSERT(priv_basic, priv)) &&

	    !servicing_interrupt()) {

		audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 1);

	}

	if (res) {

		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone);

	} else {

		DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone);

	}

	return (res);

}

/*

 * Non-auditing variant of priv_policy_choice().

 */

boolean_t

priv_policy_only(const cred_t *cr, int priv, boolean_t allzone)

{

	boolean_t res = HAS_PRIVILEGE(cr, priv) &&

	    (!allzone || HAS_ALLZONEPRIVS(cr));

	if (res) {

		DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone);

	} else {

		DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone);

	}

	return (res);

}

/*

 * Check whether all privileges in the required set are present.

 */

static int

secpolicy_require_set(const cred_t *cr, const priv_set_t *req,

    const char *msg, ...)

{

	int priv;

	int pfound = -1;

	priv_set_t pset;

	va_list ap;

	int ret;

	if (req == PRIV_FULLSET ? HAS_ALLPRIVS(cr) : priv_issubset(req,

	    &CR_OEPRIV(cr))) {

		return (0);

	}

	va_start(ap, msg);

	ret = priv_policy_override_set(cr, req, ap);

	va_end(ap);

	if (ret == 0)

		return (0);

	if (req == PRIV_FULLSET || priv_isfullset(req)) {

		priv_policy_err(cr, PRIV_ALL, B_FALSE, msg);

		return (EACCES);

	}

	pset = CR_OEPRIV(cr);		/* present privileges */

	priv_inverse(&pset);		/* all non present privileges */

	priv_intersect(req, &pset);	/* the actual missing privs */

	if (AU_AUDITING())

		audit_priv(PRIV_NONE, &pset, 0);

	/*

	 * Privilege debugging; special case "one privilege in set".