DAOS API: src/include/daos_security.h Source File

| DAOS API (v2.1 - dev)

Loading...
Searching...
No Matches
daos_security.h
Go to the documentation of this file.
1/*
2 * (C) Copyright 2019-2023 Intel Corporation.
3 *
4 * SPDX-License-Identifier: BSD-2-Clause-Patent
5 */
6
12
13#ifndef __DAOS_SECURITY_H__
14#define __DAOS_SECURITY_H__
15
16#if defined(__cplusplus)
17extern "C" {
18#endif
19
20#include <stdio.h>
21#include <stdint.h>
22#include <stdbool.h>
23#include <sys/types.h>
24#include <daos_prop.h>
25
29#define DAOS_ACL_VERSION (1)
30
35#define DAOS_ACL_MAX_PRINCIPAL_LEN (255)
37#define DAOS_ACL_MAX_PRINCIPAL_BUF_LEN (DAOS_ACL_MAX_PRINCIPAL_LEN + 1)
38
40#define DAOS_ACL_PRINCIPAL_OWNER "OWNER@"
42#define DAOS_ACL_PRINCIPAL_OWNER_GRP "GROUP@"
44#define DAOS_ACL_PRINCIPAL_EVERYONE "EVERYONE@"
45
49#define DAOS_ACL_MAX_ACE_LEN (65536)
50
55#define DAOS_ACL_MAX_ACE_STR_LEN (DAOS_ACL_MAX_PRINCIPAL_LEN + 64)
56
63 struct daos_acl {
65 uint16_t dal_ver;
67 uint16_t dal_reserv;
69 uint32_t dal_len;
71 uint8_t dal_ace[];
72};
73
79 enum daos_acl_principal_type {
80 DAOS_ACL_OWNER,
81 DAOS_ACL_USER,
82 DAOS_ACL_OWNER_GROUP,
83 DAOS_ACL_GROUP,
84 DAOS_ACL_EVERYONE,
85
86 NUM_DAOS_ACL_TYPES
87};
88
92 enum daos_acl_access_type {
93 DAOS_ACL_ACCESS_ALLOW = (1U << 0),
94 DAOS_ACL_ACCESS_AUDIT = (1U << 1),
95 DAOS_ACL_ACCESS_ALARM = (1U << 2)
96};
97
101#define DAOS_ACL_ACCESS_ALL (DAOS_ACL_ACCESS_ALLOW | \
102 DAOS_ACL_ACCESS_AUDIT | \
103 DAOS_ACL_ACCESS_ALARM)
104
108 enum daos_acl_flags {
110 DAOS_ACL_FLAG_GROUP = (1U << 0),
112 DAOS_ACL_FLAG_POOL_INHERIT = (1U << 1),
114 DAOS_ACL_FLAG_ACCESS_FAIL = (1U << 2),
116 DAOS_ACL_FLAG_ACCESS_SUCCESS = (1U << 3)
117};
118
122#define DAOS_ACL_FLAG_ALL (DAOS_ACL_FLAG_GROUP | \
123 DAOS_ACL_FLAG_POOL_INHERIT | \
124 DAOS_ACL_FLAG_ACCESS_FAIL | \
125 DAOS_ACL_FLAG_ACCESS_SUCCESS)
126
130 enum daos_acl_perm {
131 DAOS_ACL_PERM_READ = (1U << 0),
132 DAOS_ACL_PERM_WRITE = (1U << 1),
133 DAOS_ACL_PERM_CREATE_CONT = (1U << 2),
134 DAOS_ACL_PERM_DEL_CONT = (1U << 3),
135 DAOS_ACL_PERM_GET_PROP = (1U << 4),
136 DAOS_ACL_PERM_SET_PROP = (1U << 5),
137 DAOS_ACL_PERM_GET_ACL = (1U << 6),
138 DAOS_ACL_PERM_SET_ACL = (1U << 7),
139 DAOS_ACL_PERM_SET_OWNER = (1U << 8),
140};
141
145#define DAOS_ACL_PERM_POOL_ALL (DAOS_ACL_PERM_READ | \
146 DAOS_ACL_PERM_GET_PROP | \
147 DAOS_ACL_PERM_WRITE | \
148 DAOS_ACL_PERM_CREATE_CONT | \
149 DAOS_ACL_PERM_DEL_CONT)
150
154#define DAOS_ACL_PERM_CONT_ALL (DAOS_ACL_PERM_READ | \
155 DAOS_ACL_PERM_WRITE | \
156 DAOS_ACL_PERM_DEL_CONT | \
157 DAOS_ACL_PERM_GET_PROP | \
158 DAOS_ACL_PERM_SET_PROP | \
159 DAOS_ACL_PERM_GET_ACL | \
160 DAOS_ACL_PERM_SET_ACL | \
161 DAOS_ACL_PERM_SET_OWNER)
162
166#define DAOS_ACL_PERM_ALL (DAOS_ACL_PERM_POOL_ALL | \
167 DAOS_ACL_PERM_CONT_ALL)
168
174 struct daos_ace {
176 uint8_t dae_access_types;
178 uint8_t dae_principal_type;
180 uint16_t dae_principal_len;
182 uint16_t dae_access_flags;
184 uint16_t dae_reserv;
186 uint64_t dae_allow_perms;
188 uint64_t dae_audit_perms;
190 uint64_t dae_alarm_perms;
197 char dae_principal[];
198};
199
208struct daos_acl *
209daos_acl_create(struct daos_ace *aces[], uint16_t num_aces);
210
219struct daos_acl *
220daos_acl_dup(struct daos_acl *acl);
221
227void
228daos_acl_free(struct daos_acl *acl);
229
239ssize_t
240daos_acl_get_size(struct daos_acl *acl);
241
252struct daos_ace *
253daos_acl_get_next_ace(struct daos_acl *acl, struct daos_ace *current_ace);
254
269int
270daos_acl_get_ace_for_principal(struct daos_acl *acl,
271 enum daos_acl_principal_type type,
272 const char *principal, struct daos_ace **ace);
273
291int
292daos_acl_add_ace(struct daos_acl **acl, struct daos_ace *new_ace);
293
310int
311daos_acl_remove_ace(struct daos_acl **acl,
312 enum daos_acl_principal_type type,
313 const char *principal_name);
314
321void
322daos_acl_dump(struct daos_acl *acl);
323
334int
335daos_acl_validate(struct daos_acl *acl);
336
351struct daos_ace *
352daos_ace_create(enum daos_acl_principal_type type, const char *principal_name);
353
359void
360daos_ace_free(struct daos_ace *ace);
361
371ssize_t
372daos_ace_get_size(struct daos_ace *ace);
373
380void
381daos_ace_dump(struct daos_ace *ace, uint32_t tabs);
382
391bool
392daos_ace_is_valid(struct daos_ace *ace);
393
407bool
408daos_acl_principal_is_valid(const char *name);
409
423int
424daos_acl_uid_to_principal(uid_t uid, char **name);
425
439int
440daos_acl_gid_to_principal(gid_t gid, char **name);
441
454int
455daos_acl_principal_to_uid(const char *principal, uid_t *uid);
456
469int
470daos_acl_principal_to_gid(const char *principal, gid_t *gid);
471
480const char *
481daos_ace_get_principal_str(struct daos_ace *ace);
482
494int
495daos_ace_from_str(const char *str, struct daos_ace **ace);
496
511int
512daos_ace_to_str(struct daos_ace *ace, char *buf, size_t buf_len);
513
525int
526daos_ace_str_get_verbose(const char *ace_str, char *buf, size_t buf_len);
527
540int
541daos_acl_from_strs(const char **ace_strs, size_t ace_nr, struct daos_acl **acl);
542
558int
559daos_acl_to_strs(struct daos_acl *acl, char ***ace_strs, size_t *ace_nr);
560
581int
582daos_acl_principal_from_str(const char *principal_str,
583 enum daos_acl_principal_type *type,
584 char **name);
585
598int
599daos_acl_to_stream(FILE *stream, struct daos_acl *acl, bool verbose);
600
601#if defined(__cplusplus)
602}
603#endif
604#endif /* __DAOS_SECURITY_H__ */
daos_acl_from_strs
int daos_acl_from_strs(const char **ace_strs, size_t ace_nr, struct daos_acl **acl)
daos_acl_flags
daos_acl_flags
Definition daos_security.h:108
DAOS_ACL_FLAG_ACCESS_SUCCESS
@ DAOS_ACL_FLAG_ACCESS_SUCCESS
Definition daos_security.h:116
DAOS_ACL_FLAG_POOL_INHERIT
@ DAOS_ACL_FLAG_POOL_INHERIT
Definition daos_security.h:112
DAOS_ACL_FLAG_GROUP
@ DAOS_ACL_FLAG_GROUP
Definition daos_security.h:110
DAOS_ACL_FLAG_ACCESS_FAIL
@ DAOS_ACL_FLAG_ACCESS_FAIL
Definition daos_security.h:114
daos_acl_create
struct daos_acl * daos_acl_create(struct daos_ace *aces[], uint16_t num_aces)
daos_acl_principal_to_gid
int daos_acl_principal_to_gid(const char *principal, gid_t *gid)
daos_acl_principal_to_uid
int daos_acl_principal_to_uid(const char *principal, uid_t *uid)
daos_acl_access_type
daos_acl_access_type
Definition daos_security.h:92
DAOS_ACL_ACCESS_AUDIT
@ DAOS_ACL_ACCESS_AUDIT
Definition daos_security.h:94
DAOS_ACL_ACCESS_ALARM
@ DAOS_ACL_ACCESS_ALARM
Definition daos_security.h:95
daos_ace_to_str
int daos_ace_to_str(struct daos_ace *ace, char *buf, size_t buf_len)
daos_acl_get_size
ssize_t daos_acl_get_size(struct daos_acl *acl)
daos_ace_get_principal_str
const char * daos_ace_get_principal_str(struct daos_ace *ace)
daos_ace_create
struct daos_ace * daos_ace_create(enum daos_acl_principal_type type, const char *principal_name)
daos_acl_free
void daos_acl_free(struct daos_acl *acl)
daos_ace_str_get_verbose
int daos_ace_str_get_verbose(const char *ace_str, char *buf, size_t buf_len)
daos_acl_to_stream
int daos_acl_to_stream(FILE *stream, struct daos_acl *acl, bool verbose)
daos_acl_dump
void daos_acl_dump(struct daos_acl *acl)
daos_acl_add_ace
int daos_acl_add_ace(struct daos_acl **acl, struct daos_ace *new_ace)
daos_acl_principal_from_str
int daos_acl_principal_from_str(const char *principal_str, enum daos_acl_principal_type *type, char **name)
daos_ace_get_size
ssize_t daos_ace_get_size(struct daos_ace *ace)
daos_acl_get_next_ace
struct daos_ace * daos_acl_get_next_ace(struct daos_acl *acl, struct daos_ace *current_ace)
daos_acl_get_ace_for_principal
int daos_acl_get_ace_for_principal(struct daos_acl *acl, enum daos_acl_principal_type type, const char *principal, struct daos_ace **ace)
daos_ace_dump
void daos_ace_dump(struct daos_ace *ace, uint32_t tabs)
daos_acl_principal_is_valid
bool daos_acl_principal_is_valid(const char *name)
daos_acl_perm
daos_acl_perm
Definition daos_security.h:130
daos_ace_is_valid
bool daos_ace_is_valid(struct daos_ace *ace)
daos_acl_validate
int daos_acl_validate(struct daos_acl *acl)
daos_acl_uid_to_principal
int daos_acl_uid_to_principal(uid_t uid, char **name)
daos_acl_dup
struct daos_acl * daos_acl_dup(struct daos_acl *acl)
daos_acl_to_strs
int daos_acl_to_strs(struct daos_acl *acl, char ***ace_strs, size_t *ace_nr)
daos_acl_gid_to_principal
int daos_acl_gid_to_principal(gid_t gid, char **name)
daos_acl_principal_type
daos_acl_principal_type
Definition daos_security.h:79
DAOS_ACL_EVERYONE
@ DAOS_ACL_EVERYONE
Definition daos_security.h:84
NUM_DAOS_ACL_TYPES
@ NUM_DAOS_ACL_TYPES
Definition daos_security.h:86
DAOS_ACL_GROUP
@ DAOS_ACL_GROUP
Definition daos_security.h:83
DAOS_ACL_USER
@ DAOS_ACL_USER
Definition daos_security.h:81
DAOS_ACL_OWNER_GROUP
@ DAOS_ACL_OWNER_GROUP
Definition daos_security.h:82
daos_acl_remove_ace
int daos_acl_remove_ace(struct daos_acl **acl, enum daos_acl_principal_type type, const char *principal_name)
daos_ace_from_str
int daos_ace_from_str(const char *str, struct daos_ace **ace)
daos_ace_free
void daos_ace_free(struct daos_ace *ace)
daos_ace
Definition daos_security.h:174
daos_ace::dae_access_flags
uint16_t dae_access_flags
Definition daos_security.h:182
daos_ace::dae_allow_perms
uint64_t dae_allow_perms
Definition daos_security.h:186
daos_ace::dae_reserv
uint16_t dae_reserv
Definition daos_security.h:184
daos_ace::dae_access_types
uint8_t dae_access_types
Definition daos_security.h:176
daos_ace::dae_audit_perms
uint64_t dae_audit_perms
Definition daos_security.h:188
daos_ace::dae_alarm_perms
uint64_t dae_alarm_perms
Definition daos_security.h:190
daos_ace::dae_principal
char dae_principal[]
Definition daos_security.h:197
daos_ace::dae_principal_len
uint16_t dae_principal_len
Definition daos_security.h:180
daos_ace::dae_principal_type
uint8_t dae_principal_type
Definition daos_security.h:178
daos_acl
Definition daos_security.h:63
daos_acl::dal_len
uint32_t dal_len
Definition daos_security.h:69
daos_acl::dal_reserv
uint16_t dal_reserv
Definition daos_security.h:67
daos_acl::dal_ace
uint8_t dal_ace[]
Definition daos_security.h:71
daos_acl::dal_ver
uint16_t dal_ver
Definition daos_security.h:65