[thirdparty/systemd.git] / src / basic / securebits.h

#pragma once

/* This is minimal version of Linux' linux/securebits.h header file,
 * which is licensed GPL2 */

#define SECUREBITS_DEFAULT 0x00000000

/* When set UID 0 has no special privileges. When unset, we support
   inheritance of root-permissions and suid-root executable under
   compatibility mode. We raise the effective and inheritable bitmasks
   *of the executable file* if the effective uid of the new process is
   0. If the real uid is 0, we raise the effective (legacy) bit of the
   executable file. */
#define SECURE_NOROOT			0
#define SECURE_NOROOT_LOCKED		1  /* make bit-0 immutable */

/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
   When unset, to provide compatibility with old programs relying on
   set*uid to gain/lose privilege, transitions to/from uid 0 cause
   capabilities to be gained/lost. */
#define SECURE_NO_SETUID_FIXUP		2
#define SECURE_NO_SETUID_FIXUP_LOCKED	3  /* make bit-2 immutable */

/* When set, a process can retain its capabilities even after
   transitioning to a non-root user (the set-uid fixup suppressed by
   bit 2). Bit-4 is cleared when a process calls exec(); setting both
   bit 4 and 5 will create a barrier through exec that no exec()'d
   child can use this feature again. */
#define SECURE_KEEP_CAPS		4
#define SECURE_KEEP_CAPS_LOCKED		5  /* make bit-4 immutable */

/* Each securesetting is implemented using two bits. One bit specifies
   whether the setting is on or off. The other bit specify whether the
   setting is locked or not. A setting which is locked cannot be
   changed from user-level. */
#define issecure_mask(X)	(1 << (X))
#define issecure(X)		(issecure_mask(X) & current_cred_xxx(securebits))

#define SECURE_ALL_BITS		(issecure_mask(SECURE_NOROOT) | \
                                 issecure_mask(SECURE_NO_SETUID_FIXUP) | \
                                 issecure_mask(SECURE_KEEP_CAPS))
#define SECURE_ALL_LOCKS	(SECURE_ALL_BITS << 1)
Commit	Line	Data
7a3c343c	1	#pragma once
b9f880f4 LP	2
	3	/* This is minimal version of Linux' linux/securebits.h header file,
	4	* which is licensed GPL2 */
	5
	6	#define SECUREBITS_DEFAULT 0x00000000
	7
	8	/* When set UID 0 has no special privileges. When unset, we support
	9	inheritance of root-permissions and suid-root executable under
	10	compatibility mode. We raise the effective and inheritable bitmasks
	11	of the executable file if the effective uid of the new process is
	12	0. If the real uid is 0, we raise the effective (legacy) bit of the
	13	executable file. */
	14	#define SECURE_NOROOT 0
	15	#define SECURE_NOROOT_LOCKED 1 /* make bit-0 immutable */
	16
	17	/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
35b8ca3a	18	When unset, to provide compatibility with old programs relying on
b9f880f4 LP	19	set*uid to gain/lose privilege, transitions to/from uid 0 cause
	20	capabilities to be gained/lost. */
	21	#define SECURE_NO_SETUID_FIXUP 2
	22	#define SECURE_NO_SETUID_FIXUP_LOCKED 3 /* make bit-2 immutable */
	23
	24	/* When set, a process can retain its capabilities even after
	25	transitioning to a non-root user (the set-uid fixup suppressed by
	26	bit 2). Bit-4 is cleared when a process calls exec(); setting both
	27	bit 4 and 5 will create a barrier through exec that no exec()'d
	28	child can use this feature again. */
	29	#define SECURE_KEEP_CAPS 4
	30	#define SECURE_KEEP_CAPS_LOCKED 5 /* make bit-4 immutable */
	31
	32	/* Each securesetting is implemented using two bits. One bit specifies
	33	whether the setting is on or off. The other bit specify whether the
	34	setting is locked or not. A setting which is locked cannot be
	35	changed from user-level. */
	36	#define issecure_mask(X) (1 << (X))
	37	#define issecure(X) (issecure_mask(X) & current_cred_xxx(securebits))
	38
	39	#define SECURE_ALL_BITS (issecure_mask(SECURE_NOROOT) \| \
baabc577 LP	40	issecure_mask(SECURE_NO_SETUID_FIXUP) \| \
baabc577 LP	41	issecure_mask(SECURE_KEEP_CAPS))
b9f880f4	42	#define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1)