1/* 2 * Copyright (c) 2010-2014 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/*- 29 * Copyright (c) 2006 nCircle Network Security, Inc. 30 * All rights reserved. 31 * 32 * This software was developed by Robert N. M. Watson for the TrustedBSD 33 * Project under contract to nCircle Network Security, Inc. 34 * 35 * Redistribution and use in source and binary forms, with or without 36 * modification, are permitted provided that the following conditions 37 * are met: 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 44 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 45 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 47 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY, 48 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 49 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 50 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 51 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 52 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 53 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 54 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 55 * 56 * $FreeBSD: src/sys/sys/priv.h,v 1.38.2.1.2.1 2009/10/25 01:10:29 kensmith Exp $ 57 */ 58 59/* 60 * Kernel privilege checking interface. 61 */ 62#ifndef _SYS_PRIV_H_ 63#define _SYS_PRIV_H_ 64 65/* 66 * Privilege list, sorted loosely by kernel subsystem. 67 * 68 * Think carefully before adding or reusing one of these privileges -- are 69 * there existing instances referring to the same privilege? Particular 70 * numeric privilege assignments are part of the kernel extension ABI. 71 */ 72 73/* 74 * The remaining privileges typically correspond to one or a small 75 * number of specific privilege checks, and have (relatively) precise 76 * meanings. They are loosely sorted into a set of base system 77 * privileges, such as the ability to reboot, and then loosely by 78 * subsystem, indicated by a subsystem name. 79 */ 80#define PRIV_ADJTIME 1000 /* Set time adjustment. */ 81#define PRIV_PROC_UUID_POLICY 1001 /* Change process uuid policy table. */ 82#define PRIV_GLOBAL_PROC_INFO 1002 /* Query information for processes owned by other users */ 83#define PRIV_SYSTEM_OVERRIDE 1003 /* Override global system settings for various subsystems for a limited duration/system-mode */ 84#define PRIV_HW_DEBUG_DATA 1004 /* Extract hw-specific debug data (e.g. ECC data) */ 85#define PRIV_SELECTIVE_FORCED_IDLE 1005 /* Configure and control Selective Forced Idle (SFI) subsystem */ 86#define PRIV_PROC_TRACE_INSPECT 1006 /* Request trace memory of arbitrary process to be inspected */ 87 88/* 89 * Virtual memory privileges. 90 */ 91#define PRIV_VM_PRESSURE 6000 /* Check VM pressure. */ 92#define PRIV_VM_JETSAM 6001 /* Adjust jetsam configuration. */ 93#define PRIV_VM_FOOTPRINT_LIMIT 6002 /* Adjust physical footprint limit. */ 94 95/* 96 * Network stack privileges. 97 */ 98#define PRIV_NET_PRIVILEGED_TRAFFIC_CLASS 10000 /* Set SO_PRIVILEGED_TRAFFIC_CLASS. */ 99#define PRIV_NET_PRIVILEGED_SOCKET_DELEGATE 10001 /* Set delegate on a socket */ 100#define PRIV_NET_INTERFACE_CONTROL 10002 /* Enable interface debug logging. */ 101#define PRIV_NET_PRIVILEGED_NETWORK_STATISTICS 10003 /* Access to all sockets */ 102#define PRIV_NET_PRIVILEGED_NECP_POLICIES 10004 /* Access to privileged Network Extension policies */ 103#define PRIV_NET_RESTRICTED_AWDL 10005 /* Access to restricted AWDL mode */ 104#define PRIV_NET_PRIVILEGED_NECP_MATCH 10006 /* Privilege verified by Network Extension policies */ 105 106/* 107 * IPv4 and IPv6 privileges. 108 */ 109#define PRIV_NETINET_RESERVEDPORT 11000 /* Bind low port number. */ 110 111/* 112 * VFS privileges 113 */ 114#define PRIV_VFS_OPEN_BY_ID 14000 /*Allow calling openbyid_np()*/ 115 116#ifdef KERNEL 117/* 118 * Privilege check interface. No flags are currently defined for the API. 119 */ 120#include <sys/kauth.h> 121int priv_check_cred(kauth_cred_t cred, int priv, int flags); 122#endif 123 124#endif /* !_SYS_PRIV_H_ */ 125