/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Use is subject to license terms.

 */

#define	_STRUCTURED_PROC	1

#include "priv_private.h"

#include "mtlib.h"

#include "libc.h"

#include <errno.h>

#include <stdarg.h>

#include <stdlib.h>

#include <unistd.h>

#include <strings.h>

#include <synch.h>

#include <alloca.h>

#include <atomic.h>

#include <sys/ucred.h>

#include <sys/procfs.h>

#include <sys/param.h>

#include <sys/corectl.h>

#include <priv_utils.h>

#include <zone.h>

/* Include each string only once - until the compiler/linker are fixed */

static const char *permitted	= PRIV_PERMITTED;

static const char *effective	= PRIV_EFFECTIVE;

static const char *limit	= PRIV_LIMIT;

static const char *inheritable	= PRIV_INHERITABLE;

/*

 * Data independent privilege set operations.

 *

 * Only a few functions are provided that do not default to

 * the system implementation of privileges.  A limited set of

 * interfaces is provided that accepts a priv_data_t *

 * argument; this set of interfaces is a private interface between libc

 * and libproc.  It is delivered in order to interpret privilege sets

 * in debuggers in a implementation independent way.  As such, we

 * don't need to provide the bulk of the interfaces, only a few

 * boolean tests (isfull, isempty) the name<->num mappings and

 * set pretty print functions.   The boolean tests are only needed for

 * the latter, so those aren't provided externally.

 *

 * Additionally, we provide the function that maps the kernel implementation

 * structure into a libc private data structure.

 */

priv_data_t *privdata;

static mutex_t pd_lock = DEFAULTMUTEX;

static int

parseninfo(priv_info_names_t *na, char ***buf, int *cp)

{

	char *q;

	int i;

	*buf = libc_malloc(sizeof (char *) * na->cnt);

	if (*buf == NULL)

		return (-1);

	q = na->names;

	for (i = 0; i < na->cnt; i++) {

		int l = strlen(q);

		(*buf)[i] = q;

		q += l + 1;

	}

	*cp = na->cnt;

	return (0);

}

struct strint {

	char *name;

	int rank;

};

static int

strintcmp(const void *a, const void *b)

{

	const struct strint *ap = a;

	const struct strint *bp = b;

	return (strcasecmp(ap->name, bp->name));

}

priv_data_t *

__priv_parse_info(priv_impl_info_t *ip)

{

	priv_data_t *tmp;

	char *x;

	size_t size = PRIV_IMPL_INFO_SIZE(ip);

	int i;

	tmp = libc_malloc(sizeof (*tmp));

	if (tmp == NULL)

		return (NULL);

	(void) memset(tmp, 0, sizeof (*tmp));

	tmp->pd_pinfo = ip;

	tmp->pd_setsize = sizeof (priv_chunk_t) * ip->priv_setsize;

	tmp->pd_ucredsize = UCRED_SIZE(ip);

	x = (char *)ip;

	x += ip->priv_headersize;

	while (x < ((char *)ip) + size) {

		/* LINTED: alignment */

		priv_info_names_t *na = (priv_info_names_t *)x;

		/* LINTED: alignment */

		priv_info_set_t *st = (priv_info_set_t *)x;

		struct strint *tmparr;

		switch (na->info.priv_info_type) {

		case PRIV_INFO_SETNAMES:

			if (parseninfo(na, &tmp->pd_setnames, &tmp->pd_nsets))

				goto out;

			break;

		case PRIV_INFO_PRIVNAMES:

			if (parseninfo(na, &tmp->pd_privnames, &tmp->pd_nprivs))

				goto out;

			/*

			 * We compute a sorted index which allows us

			 * to present a sorted list of privileges

			 * without actually having to sort it each time.

			 */

			tmp->pd_setsort = libc_malloc(tmp->pd_nprivs *

			    sizeof (int));

			if (tmp->pd_setsort == NULL)

				goto out;

			tmparr = libc_malloc(tmp->pd_nprivs *

			    sizeof (struct strint));

			if (tmparr == NULL)

				goto out;

			for (i = 0; i < tmp->pd_nprivs; i++) {

				tmparr[i].rank = i;

				tmparr[i].name = tmp->pd_privnames[i];

			}

			qsort(tmparr, tmp->pd_nprivs, sizeof (struct strint),

			for (i = 0; i < tmp->pd_nprivs; i++)

				tmp->pd_setsort[i] = tmparr[i].rank;

			libc_free(tmparr);

			break;

		case PRIV_INFO_BASICPRIVS:

			tmp->pd_basicset = (priv_set_t *)&st->set[0];

			break;

		default:

			/* unknown, ignore */

			break;

		}

		x += na->info.priv_info_size;

	}

	return (tmp);

out:

	libc_free(tmp->pd_setnames);

	libc_free(tmp->pd_privnames);

	libc_free(tmp->pd_setsort);

	libc_free(tmp);

	return (NULL);

}

/*

 * Caller must have allocated d->pd_pinfo and should free it,

 * if necessary.

 */

void

__priv_free_info(priv_data_t *d)

{

	libc_free(d->pd_setnames);

	libc_free(d->pd_privnames);

	libc_free(d->pd_setsort);

	libc_free(d);

}

/*

 * Return with the pd_lock held and data loaded or indicate failure.

 */

int

lock_data(void)

{

	if (__priv_getdata() == NULL)

		return (-1);

	lmutex_lock(&pd_lock);

	return (0);

}

boolean_t

refresh_data(void)

{

	priv_impl_info_t *ip, ii;

	priv_data_t *tmp;

	char *p0, *q0;

	int oldn, newn;

	int i;

	if (getprivinfo(&ii, sizeof (ii)) != 0 ||

	    ii.priv_max == privdata->pd_nprivs)

		return (B_FALSE);

	ip = alloca(PRIV_IMPL_INFO_SIZE(&ii));

	(void) getprivinfo(ip, PRIV_IMPL_INFO_SIZE(&ii));

	/* Parse the info; then copy the additional bits */

	tmp = __priv_parse_info(ip);

	if (tmp == NULL)

		return (B_FALSE);

	oldn = privdata->pd_nprivs;

	p0 = privdata->pd_privnames[0];

	newn = tmp->pd_nprivs;

	q0 = tmp->pd_privnames[0];

	/* copy the extra information to the old datastructure */

	(void) memcpy((char *)privdata->pd_pinfo + sizeof (priv_impl_info_t),

	/* Copy the first oldn pointers */

	(void) memcpy(tmp->pd_privnames, privdata->pd_privnames,

	    oldn * sizeof (char *));

	/* Adjust the rest */

	for (i = oldn; i < newn; i++)

		tmp->pd_privnames[i] += p0 - q0;

	/* Install the larger arrays */

	libc_free(privdata->pd_privnames);

	privdata->pd_privnames = tmp->pd_privnames;

	tmp->pd_privnames = NULL;

	libc_free(privdata->pd_setsort);

	privdata->pd_setsort = tmp->pd_setsort;

	tmp->pd_setsort = NULL;

	/* Copy the rest of the data */

	*privdata->pd_pinfo = *ip;

	privdata->pd_nprivs = newn;

	__priv_free_info(tmp);

	return (B_TRUE);

}

void

unlock_data(void)

{

	lmutex_unlock(&pd_lock);

}

static priv_set_t *__priv_allocset(priv_data_t *);

priv_data_t *

__priv_getdata(void)

{

	if (privdata == NULL) {

		lmutex_lock(&pd_lock);

		if (privdata == NULL) {

			priv_data_t *tmp;

			priv_impl_info_t *ip;

			size_t size = sizeof (priv_impl_info_t) + 2048;

			size_t realsize;

			priv_impl_info_t *aip = alloca(size);

			if (getprivinfo(aip, size) != 0)

				goto out;

			realsize = PRIV_IMPL_INFO_SIZE(aip);

			ip = libc_malloc(realsize);

			if (ip == NULL)

				goto out;

			if (realsize <= size) {

				(void) memcpy(ip, aip, realsize);

			} else if (getprivinfo(ip, realsize) != 0) {

				libc_free(ip);

				goto out;

			}

			if ((tmp = __priv_parse_info(ip)) == NULL) {

				libc_free(ip);

				goto out;

			}

			/* Allocate the zoneset just once, here */

			tmp->pd_zoneset = __priv_allocset(tmp);

			if (tmp->pd_zoneset == NULL)

				goto clean;

			if (zone_getattr(getzoneid(), ZONE_ATTR_PRIVSET,

			    tmp->pd_zoneset, tmp->pd_setsize)

			    == tmp->pd_setsize) {

				membar_producer();

				privdata = tmp;

				goto out;

			}

			priv_freeset(tmp->pd_zoneset);

clean:

			__priv_free_info(tmp);

			libc_free(ip);

		}

out:

		lmutex_unlock(&pd_lock);

	}

	membar_consumer();

	return (privdata);

}

const priv_impl_info_t *

{

	priv_data_t *d;

	LOADPRIVDATA(d);

	return (d->pd_pinfo);

}

static priv_set_t *

priv_vlist(va_list ap)

{

	priv_set_t *pset = priv_allocset();

	const char *priv;

	if (pset == NULL)

		return (NULL);

	priv_emptyset(pset);

	while ((priv = va_arg(ap, const char *)) != NULL) {

		if (priv_addset(pset, priv) < 0) {

			priv_freeset(pset);

			return (NULL);

		}

	}

	return (pset);

}

/*

 * priv_set(op, set, priv_id1, priv_id2, ..., NULL)

 *

 * Library routine to enable a user process to set a specific

 * privilege set appropriately using a single call.  User is

 * required to terminate the list of privileges with NULL.

 */

int

priv_set(priv_op_t op, priv_ptype_t setname, ...)

{

	va_list ap;

	priv_set_t *pset;

	int ret;

	va_start(ap, setname);

	pset = priv_vlist(ap);

	va_end(ap);

	if (pset == NULL)

		return (-1);

	/* All sets */

	if (setname == NULL) {

		priv_data_t *d;

		int set;

		LOADPRIVDATA(d);

		for (set = 0; set < d->pd_nsets; set++)

			if ((ret = syscall(SYS_privsys, PRIVSYS_SETPPRIV, op,

				break;

	} else {

		ret = setppriv(op, setname, pset);

	}

	priv_freeset(pset);

	return (ret);

}

/*

 * priv_ineffect(privilege).

 * tests the existence of a privilege against the effective set.

 */

boolean_t

priv_ineffect(const char *priv)

{

	priv_set_t *curset;

	boolean_t res;

	curset = priv_allocset();

	if (curset == NULL)

		return (B_FALSE);

	if (getppriv(effective, curset) != 0 ||

	    !priv_ismember(curset, priv))

		res = B_FALSE;

	else

		res = B_TRUE;

	priv_freeset(curset);

	return (res);

}

/*

 * The routine __init_daemon_priv() is private to Solaris and is

 * used by daemons to limit the privileges they can use and

 * to set the uid they run under.

 */

static const char root_cp[] = "/core.%f.%t";

static const char daemon_cp[] = "/var/tmp/core.%f.%t";

int

__init_daemon_priv(int flags, uid_t uid, gid_t gid, ...)

{

	priv_set_t *nset;

	priv_set_t *perm = NULL;

	va_list pa;

	priv_data_t *d;

	int ret = -1;

	char buf[1024];

	LOADPRIVDATA(d);

	va_start(pa, gid);

	nset = priv_vlist(pa);

	va_end(pa);

	if (nset == NULL)

		return (-1);

	/* Always add the basic set */

	if (d->pd_basicset != NULL)

		priv_union(d->pd_basicset, nset);

	/*

	 * This is not a significant failure: it allows us to start programs

	 * with sufficient privileges and with the proper uid.   We don't

	 * care enough about the extra groups in that case.

	 */

	if (flags & PU_RESETGROUPS)

		(void) setgroups(0, NULL);

	if (gid != (gid_t)-1 && setgid(gid) != 0)

		goto end;

	perm = priv_allocset();

	if (perm == NULL)

		goto end;

	/* E = P */

	(void) getppriv(permitted, perm);