/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/sysmacros.h>
#include <sys/systm.h>
#include <sys/cred_impl.h>
#include <sys/errno.h>
#include <sys/klpd.h>
#include <sys/proc.h>
#include <sys/priv_impl.h>
#include <sys/policy.h>
#include <sys/ddi.h>
#include <sys/thread.h>
#include <sys/cmn_err.h>
#include <c2/audit.h>

/*
 * System call support for manipulating privileges.
 *
 *
 * setppriv(2) - set process privilege set
 * getppriv(2) - get process privilege set
 * getprivimplinfo(2) - get process privilege implementation information
 * setpflags(2) - set process (privilege) flags
 * getpflags(2) - get process (privilege) flags
 */

/*
 * setppriv (priv_op_t, priv_ptype_t, priv_set_t)
 */
static int
setppriv(priv_op_t op, priv_ptype_t type, priv_set_t *in_pset)
{
        priv_set_t      pset, *target;
        cred_t          *cr, *pcr;
        proc_t          *p;
        boolean_t       donocd = B_FALSE;

        if (!PRIV_VALIDSET(type) || !PRIV_VALIDOP(op))
                return (set_errno(EINVAL));

        if (copyin(in_pset, &pset, sizeof (priv_set_t)))
                return (set_errno(EFAULT));

        p = ttoproc(curthread);
        cr = cralloc();
        mutex_enter(&p->p_crlock);

retry:
        pcr = p->p_cred;

        if (AU_AUDITING())
                audit_setppriv(op, type, &pset, pcr);

        /*
         * Filter out unallowed request (bad op and bad type)
         */
        switch (op) {
        case PRIV_ON:
        case PRIV_SET:
                /*
                 * Turning on privileges; the limit set cannot grow,
                 * other sets can but only as long as they remain subsets
                 * of P.  Only immediately after exec holds that P <= L.
                 */
                if (type == PRIV_LIMIT &&
                    !priv_issubset(&pset, &CR_LPRIV(pcr))) {
                        mutex_exit(&p->p_crlock);
                        crfree(cr);
                        return (set_errno(EPERM));
                }
                if (!priv_issubset(&pset, &CR_OPPRIV(pcr)) &&
                    !priv_issubset(&pset, priv_getset(pcr, type))) {
                        mutex_exit(&p->p_crlock);
                        /* Policy override should not grow beyond L either */
                        if (type != PRIV_INHERITABLE ||
                            !priv_issubset(&pset, &CR_LPRIV(pcr)) ||
                            secpolicy_require_privs(CRED(), &pset) != 0) {
                                crfree(cr);
                                return (set_errno(EPERM));
                        }
                        mutex_enter(&p->p_crlock);
                        if (pcr != p->p_cred)
                                goto retry;
                        donocd = B_TRUE;
                }
                break;

        case PRIV_OFF:
                /* PRIV_OFF is always allowed */
                break;
        }

        /*
         * OK! everything is cool.
         * Do cred COW.
         */
        crcopy_to(pcr, cr);

        /*
         * If we change the effective, permitted or limit set, we attain
         * "privilege awareness".
         */
        if (type != PRIV_INHERITABLE)
                priv_set_PA(cr);

        target = &(CR_PRIVS(cr)->crprivs[type]);

        switch (op) {
        case PRIV_ON:
                priv_union(&pset, target);
                break;
        case PRIV_OFF:
                priv_inverse(&pset);
                priv_intersect(target, &pset);

                /*
                 * Fall-thru to set target and change other process
                 * privilege sets.
                 */
                /*FALLTHRU*/

        case PRIV_SET:
                *target = pset;

                /*
                 * Take privileges no longer permitted out
                 * of other effective sets as well.
                 * Limit set is enforced at exec() time.
                 */
                if (type == PRIV_PERMITTED)
                        priv_intersect(&pset, &CR_EPRIV(cr));
                break;
        }

        /*
         * When we give up privileges not in the inheritable set,
         * set SNOCD if not already set; first we compute the
         * privileges removed from P using Diff = (~P') & P
         * and then we check whether the removed privileges are
         * a subset of I.  If we retain uid 0, all privileges
         * are required anyway so don't set SNOCD.
         */
        if (type == PRIV_PERMITTED && (p->p_flag & SNOCD) == 0 &&
            cr->cr_uid != 0 && cr->cr_ruid != 0 && cr->cr_suid != 0) {
                priv_set_t diff = CR_OPPRIV(cr);
                priv_inverse(&diff);
                priv_intersect(&CR_OPPRIV(pcr), &diff);
                donocd = !priv_issubset(&diff, &CR_IPRIV(cr));
        }

        p->p_cred = cr;
        mutex_exit(&p->p_crlock);

        if (donocd) {
                mutex_enter(&p->p_lock);
                p->p_flag |= SNOCD;
                mutex_exit(&p->p_lock);
        }

        /*
         * The basic_test privilege should not be removed from E;
         * if that has happened, then some programmer typically set the E/P to
         * empty. That is not portable.
         */
        if ((type == PRIV_EFFECTIVE || type == PRIV_PERMITTED) &&
            priv_basic_test >= 0 && !PRIV_ISASSERT(target, priv_basic_test)) {
                proc_t *p = curproc;
                pid_t pid = p->p_pid;
                char *fn = PTOU(p)->u_comm;

                cmn_err(CE_WARN, "%s[%d]: setppriv: basic_test privilege "
                    "removed from E/P", fn, pid);
        }

        crset(p, cr);           /* broadcast to process threads */

        return (0);
}

/*
 * getppriv (priv_ptype_t, priv_set_t *)
 */
static int
getppriv(priv_ptype_t type, priv_set_t *pset)
{
        if (!PRIV_VALIDSET(type))
                return (set_errno(EINVAL));

        if (copyout(priv_getset(CRED(), type), pset, sizeof (priv_set_t)) != 0)
                return (set_errno(EFAULT));

        return (0);
}

static int
getprivimplinfo(void *buf, size_t bufsize)
{
        int err;

        err = copyout(priv_hold_implinfo(), buf, min(bufsize, privinfosize));

        priv_release_implinfo();

        if (err)
                return (set_errno(EFAULT));

        return (0);
}

/*
 * Set process flags in the given target cred.  If NULL is specified, then
 * CRED() is used; otherwise the cred is assumed to be modifiable (i.e. newly
 * crdup'ed, or equivalent).  Some flags are set in the proc rather than cred;
 * for these, curproc is always used.
 *
 * For now we cheat: the flags are actually bit masks so we can simplify
 * some; we do make sure that the arguments are valid, though.
 */

int
setpflags(uint_t flag, uint_t val, cred_t *tcr)
{
        cred_t *cr, *pcr;
        proc_t *p = curproc;
        uint_t newflags;
        boolean_t use_curcred = (tcr == NULL);

        if (val > 1 || (flag != PRIV_DEBUG && flag != PRIV_AWARE &&
            flag != NET_MAC_AWARE && flag != NET_MAC_AWARE_INHERIT &&
            flag != __PROC_PROTECT && flag != PRIV_XPOLICY &&
            flag != PRIV_AWARE_RESET && flag != PRIV_PFEXEC)) {
                return (EINVAL);
        }

        if (flag == __PROC_PROTECT) {
                mutex_enter(&p->p_lock);
                if (val == 0)
                        p->p_flag &= ~SNOCD;
                else
                        p->p_flag |= SNOCD;
                mutex_exit(&p->p_lock);
                return (0);
        }

        if (use_curcred) {
                cr = cralloc();
                mutex_enter(&p->p_crlock);
                pcr = p->p_cred;
        } else {
                cr = pcr = tcr;
        }

        newflags = CR_FLAGS(pcr);

        if (val != 0) {
                if (flag == PRIV_AWARE)
                        newflags &= ~PRIV_AWARE_RESET;
                newflags |= flag;
        } else {
                newflags &= ~flag;
        }

        /* No change */
        if (CR_FLAGS(pcr) == newflags) {
                if (use_curcred) {
                        mutex_exit(&p->p_crlock);
                        crfree(cr);
                }
                return (0);
        }

        /*
         * Setting either the NET_MAC_AWARE or NET_MAC_AWARE_INHERIT
         * flags is a restricted operation.
         *
         * When invoked via the PRIVSYS_SETPFLAGS syscall
         * we require that the current cred has the net_mac_aware
         * privilege in its effective set.
         *
         * When called from within the kernel by label-aware
         * services such as NFS, we don't require a privilege check.
         *
         */
        if ((flag == NET_MAC_AWARE || flag == NET_MAC_AWARE_INHERIT) &&
            (val == 1) && use_curcred) {
                if (secpolicy_net_mac_aware(pcr) != 0) {
                        mutex_exit(&p->p_crlock);
                        crfree(cr);
                        return (EPERM);
                }
        }

        /* Trying to unset PA; if we can't, return an error */
        if (flag == PRIV_AWARE && val == 0 && !priv_can_clear_PA(pcr)) {
                if (use_curcred) {
                        mutex_exit(&p->p_crlock);
                        crfree(cr);
                }
                return (EPERM);
        }

        /* Committed to changing the flag */
        if (use_curcred)
                crcopy_to(pcr, cr);
        if (flag == PRIV_AWARE) {
                if (val != 0)
                        priv_set_PA(cr);
                else
                        priv_adjust_PA(cr);
        } else {
                CR_FLAGS(cr) = newflags;
        }

        /*
         * Unsetting the flag has as side effect getting rid of
         * the per-credential policy.
         */
        if (flag == PRIV_XPOLICY && val == 0)
                crsetcrklpd(cr, NULL);

        if (use_curcred) {
                p->p_cred = cr;
                mutex_exit(&p->p_crlock);
                crset(p, cr);
        }

        return (0);
}

/*
 * Getpflags.  Currently only implements single bit flags.
 */
uint_t
getpflags(uint_t flag, const cred_t *cr)
{
        if (flag != PRIV_DEBUG && flag != PRIV_AWARE &&
            flag != NET_MAC_AWARE && flag != NET_MAC_AWARE_INHERIT &&
            flag != PRIV_XPOLICY && flag != PRIV_PFEXEC &&
            flag != PRIV_AWARE_RESET)
                return ((uint_t)-1);

        return ((CR_FLAGS(cr) & flag) != 0);
}

/*
 * Privilege system call entry point
 */
int
privsys(int code, priv_op_t op, priv_ptype_t type, void *buf, size_t bufsize,
    int itype)
{
        int retv;
        extern int issetugid(void);

        switch (code) {
        case PRIVSYS_SETPPRIV:
                if (bufsize < sizeof (priv_set_t))
                        return (set_errno(ENOMEM));
                return (setppriv(op, type, buf));
        case PRIVSYS_GETPPRIV:
                if (bufsize < sizeof (priv_set_t))
                        return (set_errno(ENOMEM));
                return (getppriv(type, buf));
        case PRIVSYS_GETIMPLINFO:
                return (getprivimplinfo(buf, bufsize));
        case PRIVSYS_SETPFLAGS:
                retv = setpflags((uint_t)op, (uint_t)type, NULL);
                return (retv != 0 ? set_errno(retv) : 0);
        case PRIVSYS_GETPFLAGS:
                retv = (int)getpflags((uint_t)op, CRED());
                return (retv == -1 ? set_errno(EINVAL) : retv);
        case PRIVSYS_ISSETUGID:
                return (issetugid());
        case PRIVSYS_KLPD_REG:
                if (bufsize < sizeof (priv_set_t))
                        return (set_errno(ENOMEM));
                return ((int)klpd_reg((int)op, (idtype_t)itype, (id_t)type,
                    buf));
        case PRIVSYS_KLPD_UNREG:
                return ((int)klpd_unreg((int)op, (idtype_t)itype, (id_t)type));
        case PRIVSYS_PFEXEC_REG:
                return ((int)pfexec_reg((int)op));
        case PRIVSYS_PFEXEC_UNREG:
                return ((int)pfexec_unreg((int)op));
        }
        return (set_errno(EINVAL));
}

#ifdef _SYSCALL32_IMPL
int
privsys32(int code, priv_op_t op, priv_ptype_t type, caddr32_t buf,
    size32_t bufsize, int itype)
{
        return (privsys(code, op, type, (void *)(uintptr_t)buf,
            (size_t)bufsize, itype));
}
#endif