210 lines
7.5 KiB
C
210 lines
7.5 KiB
C
/* $NetBSD: intercept.h,v 1.19 2006/04/16 05:19:02 provos Exp $ */
|
|
/* $OpenBSD: intercept.h,v 1.11 2002/08/04 04:15:50 provos Exp $ */
|
|
/*
|
|
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
* must display the following acknowledgement:
|
|
* This product includes software developed by Niels Provos.
|
|
* 4. The name of the author may not be used to endorse or promote products
|
|
* derived from this software without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifndef _INTERCEPT_H_
|
|
#define _INTERCEPT_H_
|
|
#include <sys/param.h>
|
|
#include <sys/queue.h>
|
|
|
|
struct intercept_pid;
|
|
struct intercept_replace;
|
|
struct elevate;
|
|
|
|
struct intercept_system {
|
|
const char *name;
|
|
int (*init)(void);
|
|
int (*open)(void);
|
|
int (*attach)(int, pid_t);
|
|
int (*detach)(int, pid_t);
|
|
int (*report)(int, pid_t);
|
|
int (*read)(int);
|
|
int (*getsyscallnumber)(const char *, const char *);
|
|
int (*setcwd)(int, pid_t);
|
|
int (*restcwd)(int);
|
|
int (*io)(int, pid_t, int, void *, u_char *, size_t);
|
|
int (*getarg)(int, void *, int, void **);
|
|
int (*answer)(int, pid_t, u_int32_t, short, int, short,
|
|
struct elevate *);
|
|
int (*newpolicy)(int);
|
|
int (*assignpolicy)(int, pid_t, int);
|
|
int (*policy)(int, int, int, short);
|
|
int (*replace)(int, pid_t, u_int16_t, struct intercept_replace *);
|
|
void (*clonepid)(struct intercept_pid *, struct intercept_pid *);
|
|
void (*freepid)(struct intercept_pid *);
|
|
int (*scriptname)(int, pid_t, char *);
|
|
};
|
|
|
|
#define INTERCEPT_READ 1
|
|
#define INTERCEPT_WRITE 2
|
|
|
|
#define ICPOLICY_ASK 0
|
|
#define ICPOLICY_PERMIT -1
|
|
#define ICPOLICY_KILL -2
|
|
#define ICPOLICY_NEVER 1 /* overloaded with errno values > 1 */
|
|
|
|
#define ICLINK_NONE 0 /* do not resolve symlinks */
|
|
#define ICLINK_ALL 1 /* resolve all symlinks */
|
|
#define ICLINK_NOLAST 2 /* do not resolve last component */
|
|
|
|
#define ICFLAGS_RESULT 1
|
|
|
|
#define ICTRANS_NOLINKS 1 /* translation should have no symlinks */
|
|
|
|
/* Privilege elevation */
|
|
struct elevate {
|
|
#define ELEVATE_UID 0x01
|
|
#define ELEVATE_GID 0x02
|
|
int e_flags;
|
|
uid_t e_uid;
|
|
gid_t e_gid;
|
|
};
|
|
|
|
struct intercept_pid {
|
|
SPLAY_ENTRY(intercept_pid) next;
|
|
pid_t pid;
|
|
pid_t ppid; /* parent pid */
|
|
|
|
short policynr;
|
|
int execve_code;
|
|
short execve_policy;
|
|
char *name; /* name of current process image */
|
|
char *newname; /* image name to be committed by execve */
|
|
|
|
uid_t uid; /* current uid */
|
|
gid_t gid; /* current gid */
|
|
|
|
char username[LOGIN_NAME_MAX];
|
|
char home[MAXPATHLEN]; /* current home dir for uid */
|
|
|
|
void *data;
|
|
|
|
int uflags; /* Flags that can be used by external application */
|
|
struct elevate *elevate; /* privilege elevation request */
|
|
};
|
|
|
|
#define INTERCEPT_MAXSYSCALLARGS 10
|
|
|
|
struct intercept_translate {
|
|
const char *name;
|
|
int (*translate)(struct intercept_translate *, int, pid_t, void *);
|
|
int (*print)(char *, size_t, struct intercept_translate *);
|
|
int off2;
|
|
int off;
|
|
u_char trans_valid;
|
|
void *trans_addr;
|
|
void *trans_addr2;
|
|
void *trans_data;
|
|
size_t trans_size;
|
|
char *trans_print;
|
|
u_int trans_flags;
|
|
TAILQ_ENTRY(intercept_translate) next;
|
|
};
|
|
|
|
struct intercept_replace {
|
|
int num;
|
|
int ind[INTERCEPT_MAXSYSCALLARGS];
|
|
u_char *address[INTERCEPT_MAXSYSCALLARGS];
|
|
size_t len[INTERCEPT_MAXSYSCALLARGS];
|
|
u_int flags[INTERCEPT_MAXSYSCALLARGS];
|
|
};
|
|
|
|
TAILQ_HEAD(intercept_tlq, intercept_translate);
|
|
|
|
int intercept_init(void);
|
|
pid_t intercept_run(int, int, uid_t, gid_t, char *, char * const *);
|
|
int intercept_open(void);
|
|
int intercept_attach(int, pid_t);
|
|
int intercept_attachpid(int, pid_t, char *);
|
|
int intercept_detach(int, pid_t);
|
|
int intercept_read(int);
|
|
int intercept_newpolicy(int);
|
|
int intercept_assignpolicy(int, pid_t, int);
|
|
int intercept_modifypolicy(int, int, const char *, const char *, short);
|
|
void intercept_child_info(pid_t, pid_t);
|
|
void intercept_policy_free(int);
|
|
|
|
int intercept_replace_init(struct intercept_replace *);
|
|
int intercept_replace_add(struct intercept_replace *, int, u_char *, size_t, u_int);
|
|
int intercept_replace(int, pid_t, u_int16_t, struct intercept_replace *);
|
|
|
|
int intercept_register_sccb(const char *, const char *,
|
|
short (*)(int, pid_t, int, const char *, int, const char *, void *, int,
|
|
struct intercept_replace *, struct intercept_tlq *, void *),
|
|
void *);
|
|
void *intercept_sccb_cbarg(char *, char *);
|
|
|
|
int intercept_register_gencb(short (*)(int, pid_t, int, const char *, int, const char *, void *, int, void *), void *);
|
|
int intercept_register_execcb(void (*)(int, pid_t, int, const char *, const char *, void *), void *);
|
|
int intercept_register_pfreecb(void (*)(int, void *), void *);
|
|
|
|
struct intercept_translate *intercept_register_translation(const char *,
|
|
const char *, int, struct intercept_translate *);
|
|
int intercept_translate(struct intercept_translate *, int, pid_t, int, void *, int);
|
|
const char *intercept_translate_print(struct intercept_translate *);
|
|
|
|
#define intercept_register_transstring(x,y,z) \
|
|
intercept_register_translation(x, y, z, &ic_translate_string)
|
|
#define intercept_register_transfn(x,y,z) \
|
|
intercept_register_translation(x, y, z, &ic_translate_filename)
|
|
#define intercept_register_translink(x,y,z) \
|
|
intercept_register_translation(x, y, z, &ic_translate_linkname)
|
|
|
|
extern struct intercept_translate ic_translate_string;
|
|
extern struct intercept_translate ic_translate_filename;
|
|
extern struct intercept_translate ic_translate_linkname;
|
|
extern struct intercept_translate ic_translate_unlinkname;
|
|
extern struct intercept_translate ic_translate_connect;
|
|
extern struct intercept_translate ic_translate_sendmsg;
|
|
|
|
void intercept_freepid(pid_t);
|
|
struct intercept_pid *intercept_findpid(pid_t);
|
|
struct intercept_pid *intercept_getpid(pid_t);
|
|
int intercept_existpids(void);
|
|
|
|
char *intercept_get_string(int, pid_t, void *);
|
|
char *normalize_filename(int, pid_t, char *, int);
|
|
char *intercept_filename(int, pid_t, void *, int, char *);
|
|
void intercept_syscall(int, pid_t, u_int16_t, int, const char *, int,
|
|
const char *, void *, int);
|
|
void intercept_syscall_result(int, pid_t, u_int16_t, int, const char *, int,
|
|
const char *, void *, int, int, void *);
|
|
void intercept_ugid(struct intercept_pid *, uid_t, gid_t);
|
|
void intercept_setpid(struct intercept_pid *, uid_t, gid_t);
|
|
void intercept_newimage(int, pid_t, int, const char *, char *,
|
|
struct intercept_pid *);
|
|
|
|
int intercept_isvalidsystemcall(char *, char *);
|
|
|
|
char *intercept_realpath(const char *, char *);
|
|
|
|
#endif /* _INTERCEPT_H_ */
|