Annotation of sys/dev/systrace.h, Revision 1.1
1.1 ! nbrk 1: /* $OpenBSD: systrace.h,v 1.20 2006/10/06 05:47:27 djm Exp $ */
! 2: /*
! 3: * Copyright 2002 Niels Provos <provos@citi.umich.edu>
! 4: * All rights reserved.
! 5: *
! 6: * Redistribution and use in source and binary forms, with or without
! 7: * modification, are permitted provided that the following conditions
! 8: * are met:
! 9: * 1. Redistributions of source code must retain the above copyright
! 10: * notice, this list of conditions and the following disclaimer.
! 11: * 2. Redistributions in binary form must reproduce the above copyright
! 12: * notice, this list of conditions and the following disclaimer in the
! 13: * documentation and/or other materials provided with the distribution.
! 14: * 3. All advertising materials mentioning features or use of this software
! 15: * must display the following acknowledgement:
! 16: * This product includes software developed by Niels Provos.
! 17: * 4. The name of the author may not be used to endorse or promote products
! 18: * derived from this software without specific prior written permission.
! 19: *
! 20: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 21: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 22: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 23: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
! 24: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
! 25: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
! 26: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
! 27: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
! 28: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
! 29: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 30: */
! 31:
! 32: #ifndef _SYSTRACE_H_
! 33: #define _SYSTRACE_H_
! 34:
! 35: #include <sys/ioccom.h>
! 36: #include <sys/rwlock.h>
! 37:
! 38: #define SYSTR_EMULEN 8 /* sync with sys proc */
! 39:
! 40: struct str_msg_emul {
! 41: char emul[SYSTR_EMULEN];
! 42: };
! 43:
! 44: struct str_msg_ugid {
! 45: uid_t uid;
! 46: gid_t gid;
! 47: };
! 48:
! 49: struct str_msg_execve {
! 50: char path[MAXPATHLEN];
! 51: };
! 52:
! 53: #define SYSTR_MAX_POLICIES 64
! 54: #define SYSTR_MAXARGS 64
! 55: #define SYSTR_MAXFNAME 8
! 56: #define SYSTR_MAXINJECTS 8
! 57: #define SYSTR_MAXREPLEN 2048
! 58:
! 59: struct str_msg_ask {
! 60: int code;
! 61: int argsize;
! 62: register_t args[SYSTR_MAXARGS];
! 63: register_t rval[2];
! 64: int result;
! 65: };
! 66:
! 67: /* Queued on fork or exit of a process */
! 68:
! 69: struct str_msg_child {
! 70: pid_t new_pid;
! 71: };
! 72:
! 73: #define SYSTR_MSG_ASK 1
! 74: #define SYSTR_MSG_RES 2
! 75: #define SYSTR_MSG_EMUL 3
! 76: #define SYSTR_MSG_CHILD 4
! 77: #define SYSTR_MSG_UGID 5
! 78: #define SYSTR_MSG_POLICYFREE 6
! 79: #define SYSTR_MSG_EXECVE 7
! 80:
! 81: #define SYSTR_MSG_NOPROCESS(x) \
! 82: ((x)->msg.msg_type == SYSTR_MSG_CHILD || \
! 83: (x)->msg.msg_type == SYSTR_MSG_POLICYFREE)
! 84:
! 85: struct str_message {
! 86: int msg_type;
! 87: pid_t msg_pid;
! 88: u_int16_t msg_seqnr; /* answer has to match seqnr */
! 89: short msg_policy;
! 90: union {
! 91: struct str_msg_emul msg_emul;
! 92: struct str_msg_ugid msg_ugid;
! 93: struct str_msg_ask msg_ask;
! 94: struct str_msg_child msg_child;
! 95: struct str_msg_execve msg_execve;
! 96: } msg_data;
! 97: };
! 98:
! 99: struct systrace_answer {
! 100: pid_t stra_pid;
! 101: u_int16_t stra_seqnr;
! 102: short reserved;
! 103: uid_t stra_seteuid; /* elevated privileges for system call */
! 104: uid_t stra_setegid;
! 105: int stra_policy;
! 106: int stra_error;
! 107: int stra_flags;
! 108: };
! 109:
! 110: struct systrace_scriptname {
! 111: pid_t sn_pid;
! 112: char sn_scriptname[MAXPATHLEN];
! 113: };
! 114:
! 115: #define SYSTR_READ 1
! 116: #define SYSTR_WRITE 2
! 117:
! 118: struct systrace_io {
! 119: pid_t strio_pid;
! 120: int strio_op;
! 121: void *strio_offs;
! 122: void *strio_addr;
! 123: size_t strio_len;
! 124: };
! 125:
! 126: #define SYSTR_POLICY_NEW 1
! 127: #define SYSTR_POLICY_ASSIGN 2
! 128: #define SYSTR_POLICY_MODIFY 3
! 129:
! 130: struct systrace_policy {
! 131: int strp_op;
! 132: int strp_num;
! 133: union {
! 134: struct {
! 135: short code;
! 136: short policy;
! 137: } assign;
! 138: pid_t pid;
! 139: int maxents;
! 140: } strp_data;
! 141: };
! 142:
! 143: #define strp_pid strp_data.pid
! 144: #define strp_maxents strp_data.maxents
! 145: #define strp_code strp_data.assign.code
! 146: #define strp_policy strp_data.assign.policy
! 147:
! 148: #define SYSTR_NOLINKS 1
! 149:
! 150: struct systrace_replace {
! 151: pid_t strr_pid;
! 152: u_int16_t strr_seqnr;
! 153: int16_t reserved;
! 154: int strr_nrepl;
! 155: caddr_t strr_base; /* Base memory */
! 156: size_t strr_len; /* Length of memory */
! 157: int strr_argind[SYSTR_MAXARGS];
! 158: size_t strr_off[SYSTR_MAXARGS];
! 159: size_t strr_offlen[SYSTR_MAXARGS];
! 160: int32_t strr_flags[SYSTR_MAXARGS];
! 161: };
! 162:
! 163: struct systrace_inject {
! 164: /* On return, this contains the stackgap address. */
! 165: caddr_t stri_addr;
! 166: size_t stri_len;
! 167: pid_t stri_pid;
! 168: };
! 169:
! 170: #define STRIOCCLONE _IOR('s', 100, int)
! 171: #define SYSTR_CLONE STRIOCCLONE
! 172: #define STRIOCATTACH _IOW('s', 101, pid_t)
! 173: #define STRIOCDETACH _IOW('s', 102, pid_t)
! 174: #define STRIOCANSWER _IOW('s', 103, struct systrace_answer)
! 175: #define STRIOCIO _IOWR('s', 104, struct systrace_io)
! 176: #define STRIOCPOLICY _IOWR('s', 105, struct systrace_policy)
! 177: #define STRIOCGETCWD _IOW('s', 106, pid_t)
! 178: #define STRIOCRESCWD _IO('s', 107)
! 179: #define STRIOCREPORT _IOW('s', 108, pid_t)
! 180: #define STRIOCREPLACE _IOW('s', 109, struct systrace_replace)
! 181: #define STRIOCSCRIPTNAME _IOW('s', 110, struct systrace_scriptname)
! 182: #define STRIOCINJECT _IOWR('s', 111, struct systrace_inject)
! 183:
! 184: #define SYSTR_POLICY_ASK 0
! 185: #define SYSTR_POLICY_PERMIT 1
! 186: #define SYSTR_POLICY_NEVER 2
! 187:
! 188: #define SYSTR_FLAGS_RESULT 0x001
! 189: #define SYSTR_FLAGS_SETEUID 0x002
! 190: #define SYSTR_FLAGS_SETEGID 0x004
! 191:
! 192: #ifdef _KERNEL
! 193: #include <sys/namei.h>
! 194:
! 195: struct str_process;
! 196: struct fsystrace {
! 197: struct rwlock lock;
! 198: struct selinfo si;
! 199:
! 200: TAILQ_HEAD(strprocessq, str_process) processes;
! 201: int nprocesses;
! 202:
! 203: TAILQ_HEAD(strpolicyq, str_policy) policies;
! 204:
! 205: struct strprocessq messages;
! 206:
! 207: int npolicynr;
! 208: int npolicies;
! 209:
! 210: int issuser;
! 211: uid_t p_ruid;
! 212: gid_t p_rgid;
! 213:
! 214: /* cwd magic */
! 215: pid_t fd_pid;
! 216: struct vnode *fd_cdir;
! 217: struct vnode *fd_rdir;
! 218: };
! 219:
! 220: /* Internal prototypes */
! 221:
! 222: void systrace_namei(struct nameidata *);
! 223: int systrace_redirect(int, struct proc *, void *, register_t *);
! 224: void systrace_exit(struct proc *);
! 225: void systrace_fork(struct proc *, struct proc *);
! 226: void systrace_execve0(struct proc *);
! 227: void systrace_execve1(char *, struct proc *);
! 228: int systrace_scriptname(struct proc *, char *);
! 229:
! 230: #endif /* _KERNEL */
! 231: #endif /* _SYSTRACE_H_ */
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to systrace.h CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / dev