1 /* $OpenBSD: systrace.h,v 1.20 2006/10/06 05:47:27 djm Exp $ */ 2 /* 3 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. All advertising materials mentioning features or use of this software 15 * must display the following acknowledgement: 16 * This product includes software developed by Niels Provos. 17 * 4. The name of the author may not be used to endorse or promote products 18 * derived from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #ifndef _SYSTRACE_H_ 33 #define _SYSTRACE_H_ 34 35 #include <sys/ioccom.h> 36 37 #define SYSTR_EMULEN 8 /* sync with sys proc */ 38 39 struct str_msg_emul { 40 char emul[SYSTR_EMULEN]; 41 }; 42 43 struct str_msg_ugid { 44 uid_t uid; 45 gid_t gid; 46 }; 47 48 struct str_msg_execve { 49 char path[MAXPATHLEN]; 50 }; 51 52 #define SYSTR_MAX_POLICIES 64 53 #define SYSTR_MAXARGS 64 54 #define SYSTR_MAXFNAME 8 55 #define SYSTR_MAXINJECTS 8 56 #define SYSTR_MAXREPLEN 2048 57 58 struct str_msg_ask { 59 int code; 60 int argsize; 61 register_t args[SYSTR_MAXARGS]; 62 register_t rval[2]; 63 int result; 64 }; 65 66 /* Queued on fork or exit of a process */ 67 68 struct str_msg_child { 69 pid_t new_pid; 70 }; 71 72 #define SYSTR_MSG_ASK 1 73 #define SYSTR_MSG_RES 2 74 #define SYSTR_MSG_EMUL 3 75 #define SYSTR_MSG_CHILD 4 76 #define SYSTR_MSG_UGID 5 77 #define SYSTR_MSG_POLICYFREE 6 78 #define SYSTR_MSG_EXECVE 7 79 80 #define SYSTR_MSG_NOPROCESS(x) \ 81 ((x)->msg.msg_type == SYSTR_MSG_CHILD || \ 82 (x)->msg.msg_type == SYSTR_MSG_POLICYFREE) 83 84 struct str_message { 85 int msg_type; 86 pid_t msg_pid; 87 u_int16_t msg_seqnr; /* answer has to match seqnr */ 88 short msg_policy; 89 union { 90 struct str_msg_emul msg_emul; 91 struct str_msg_ugid msg_ugid; 92 struct str_msg_ask msg_ask; 93 struct str_msg_child msg_child; 94 struct str_msg_execve msg_execve; 95 } msg_data; 96 }; 97 98 struct systrace_answer { 99 pid_t stra_pid; 100 u_int16_t stra_seqnr; 101 short reserved; 102 uid_t stra_seteuid; /* elevated privileges for system call */ 103 uid_t stra_setegid; 104 int stra_policy; 105 int stra_error; 106 int stra_flags; 107 }; 108 109 struct systrace_scriptname { 110 pid_t sn_pid; 111 char sn_scriptname[MAXPATHLEN]; 112 }; 113 114 #define SYSTR_READ 1 115 #define SYSTR_WRITE 2 116 117 struct systrace_io { 118 pid_t strio_pid; 119 int strio_op; 120 void *strio_offs; 121 void *strio_addr; 122 size_t strio_len; 123 }; 124 125 #define SYSTR_POLICY_NEW 1 126 #define SYSTR_POLICY_ASSIGN 2 127 #define SYSTR_POLICY_MODIFY 3 128 129 struct systrace_policy { 130 int strp_op; 131 int strp_num; 132 union { 133 struct { 134 short code; 135 short policy; 136 } assign; 137 pid_t pid; 138 int maxents; 139 } strp_data; 140 }; 141 142 #define strp_pid strp_data.pid 143 #define strp_maxents strp_data.maxents 144 #define strp_code strp_data.assign.code 145 #define strp_policy strp_data.assign.policy 146 147 #define SYSTR_NOLINKS 1 148 149 struct systrace_replace { 150 pid_t strr_pid; 151 u_int16_t strr_seqnr; 152 int16_t reserved; 153 int strr_nrepl; 154 caddr_t strr_base; /* Base memory */ 155 size_t strr_len; /* Length of memory */ 156 int strr_argind[SYSTR_MAXARGS]; 157 size_t strr_off[SYSTR_MAXARGS]; 158 size_t strr_offlen[SYSTR_MAXARGS]; 159 int32_t strr_flags[SYSTR_MAXARGS]; 160 }; 161 162 struct systrace_inject { 163 /* On return, this contains the stackgap address. */ 164 caddr_t stri_addr; 165 size_t stri_len; 166 pid_t stri_pid; 167 }; 168 169 #define STRIOCCLONE _IOR('s', 100, int) 170 #define SYSTR_CLONE STRIOCCLONE 171 #define STRIOCATTACH _IOW('s', 101, pid_t) 172 #define STRIOCDETACH _IOW('s', 102, pid_t) 173 #define STRIOCANSWER _IOW('s', 103, struct systrace_answer) 174 #define STRIOCIO _IOWR('s', 104, struct systrace_io) 175 #define STRIOCPOLICY _IOWR('s', 105, struct systrace_policy) 176 #define STRIOCGETCWD _IOW('s', 106, pid_t) 177 #define STRIOCRESCWD _IO('s', 107) 178 #define STRIOCREPORT _IOW('s', 108, pid_t) 179 #define STRIOCREPLACE _IOW('s', 109, struct systrace_replace) 180 #define STRIOCSCRIPTNAME _IOW('s', 110, struct systrace_scriptname) 181 #define STRIOCINJECT _IOWR('s', 111, struct systrace_inject) 182 183 #define SYSTR_POLICY_ASK 0 184 #define SYSTR_POLICY_PERMIT 1 185 #define SYSTR_POLICY_NEVER 2 186 187 #define SYSTR_FLAGS_RESULT 0x001 188 #define SYSTR_FLAGS_SETEUID 0x002 189 #define SYSTR_FLAGS_SETEGID 0x004 190 191 #ifdef _KERNEL 192 #include <sys/namei.h> 193 194 struct str_process; 195 struct fsystrace { 196 struct lock lock; 197 struct selinfo si; 198 199 TAILQ_HEAD(strprocessq, str_process) processes; 200 int nprocesses; 201 202 TAILQ_HEAD(strpolicyq, str_policy) policies; 203 204 struct strprocessq messages; 205 206 int npolicynr; 207 int npolicies; 208 209 int issuser; 210 uid_t p_ruid; 211 gid_t p_rgid; 212 213 /* cwd magic */ 214 pid_t fd_pid; 215 struct vnode *fd_cdir; 216 struct vnode *fd_rdir; 217 }; 218 219 /* Internal prototypes */ 220 221 void systrace_namei(struct nameidata *); 222 int systrace_redirect(int, struct proc *, void *, register_t *); 223 void systrace_exit(struct proc *); 224 void systrace_fork(struct proc *, struct proc *); 225 void systrace_execve0(struct proc *); 226 void systrace_execve1(char *, struct proc *); 227 int systrace_scriptname(struct proc *, char *); 228 229 #endif /* _KERNEL */ 230 #endif /* _SYSTRACE_H_ */ 231