syzkaller/sys/kdbus.txt
2016-10-10 16:13:26 +02:00

445 lines
13 KiB
Plaintext

# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
include <asm/ioctl.h>
include <uapi/linux/fcntl.h>
resource fd_kdbus[fd]
openat$kdbus(fd const[AT_FDCWD], file strconst["/dev/kdbus"], flags flags[open_flags], mode const[0]) fd_kdbus
ioctl$kdbus_bus_make(fd fd_kdbus, cmd const[KDBUS_CMD_BUS_MAKE], arg ptr[in, kdbus_cmd_bus_make])
ioctl$kdbus_ep_make(fd fd_kdbus, cmd const[KDBUS_CMD_ENDPOINT_MAKE], arg ptr[in, kdbus_cmd_ep_make])
ioctl$kdbus_ep_update(fd fd_kdbus, cmd const[KDBUS_CMD_ENDPOINT_UPDATE], arg ptr[in, kdbus_cmd_ep_update])
ioctl$kdbus_hello(fd fd_kdbus, cmd const[KDBUS_CMD_HELLO], arg ptr[in, kdbus_cmd_hello])
ioctl$kdbus_name_acquire(fd fd_kdbus, cmd const[KDBUS_CMD_NAME_ACQUIRE], arg ptr[in, kdbus_cmd_name_acquire])
ioctl$kdbus_name_release(fd fd_kdbus, cmd const[KDBUS_CMD_NAME_RELEASE], arg ptr[in, kdbus_cmd_name_release])
ioctl$kdbus_free(fd fd_kdbus, cmd const[KDBUS_CMD_FREE], arg ptr[in, kdbus_cmd_free])
ioctl$kdbus_recv(fd fd_kdbus, cmd const[KDBUS_CMD_RECV], arg ptr[in, kdbus_cmd_recv])
ioctl$kdbus_send(fd fd_kdbus, cmd const[KDBUS_CMD_SEND], arg ptr[in, kdbus_cmd_send])
ioctl$kdbus_update(fd fd_kdbus, cmd const[KDBUS_CMD_UPDATE], arg ptr[in, kdbus_cmd_update])
ioctl$kdbus_bye(fd fd_kdbus, cmd const[KDBUS_CMD_BYEBYE], arg ptr[in, kdbus_cmd_bye])
ioctl$kdbus_conn_info(fd fd_kdbus, cmd const[KDBUS_CMD_CONN_INFO], arg ptr[in, kdbus_cmd_info])
ioctl$kdbus_bus_info(fd fd_kdbus, cmd const[KDBUS_CMD_BUS_CREATOR_INFO], arg ptr[in, kdbus_cmd_info])
ioctl$kdbus_list(fd fd_kdbus, cmd const[KDBUS_CMD_LIST], arg ptr[in, kdbus_cmd_list])
ioctl$kdbus_match_add(fd fd_kdbus, cmd const[KDBUS_CMD_MATCH_ADD], arg ptr[in, kdbus_cmd_match])
ioctl$kdbus_match_remove(fd fd_kdbus, cmd const[KDBUS_CMD_MATCH_REMOVE], arg ptr[in, kdbus_cmd_match])
kdbus_cmd_bus_make {
size len[parent, int64]
flags flags[kdbus_make_flags, int64]
rflags const[0, int64]
bloom kdbus_bloom_parameter
name kdbus_make_name_parameter
}
kdbus_cmd_ep_make {
size len[parent, int64]
flags flags[kdbus_make_flags, int64]
rflags const[0, int64]
name kdbus_make_name_parameter
}
kdbus_cmd_ep_update {
size len[parent, int64]
flags flags[kdbus_make_flags, int64]
rflags const[0, int64]
name kdbus_make_name_parameter
policy kdbus_policy_parameter
}
kdbus_cmd_hello {
size len[parent, int64]
flags flags[kdbus_hello_flags, int64]
rflags1 const[0, int64]
sflags flags[kdbus_attach_flags, int64]
rflags2 flags[kdbus_attach_flags, int64]
bflags int64
id int64
poolsz int64
off int64
isize int64
id0 int64
id1 int64
name kdbus_make_name_parameter
policy kdbus_policy_parameter
pids kdbus_pids_parameter
creds kdbus_creds_parameter
seclab kdbus_seclabel_parameter
}
kdbus_cmd_bye {
size len[parent, int64]
flags const[0, int64]
rflags const[0, int64]
}
kdbus_cmd_list {
size len[parent, int64]
flags flags[kdbus_list_flags, int64]
rflags const[0, int64]
off int64
lsize const[0, int64]
}
kdbus_cmd_update {
size len[parent, int64]
flags flags[kdbus_name_flags, int64]
rflags const[0, int64]
name kdbus_make_name_parameter
policy kdbus_policy_parameter
attach kdbus_attach_flags_parameter
}
kdbus_cmd_name_acquire {
size len[parent, int64]
flags flags[kdbus_name_flags, int64]
rflags const[0, int64]
name kdbus_make_name_parameter
}
kdbus_cmd_name_release {
size len[parent, int64]
flags const[0, int64]
rflags const[0, int64]
name kdbus_make_name_parameter
}
kdbus_cmd_match {
size len[parent, int64]
flags flags[kdbus_match_flags, int64]
rflags const[0, int64]
# TODO: this needs to match between add and remove
cookie int64
bloom kdbus_bloom_parameter
name0 kdbus_name_parameter
name1 kdbus_name_parameter
name2 kdbus_name_parameter
name3 kdbus_name_parameter
idadd kdbus_id_change_parameter
idremov kdbus_id_change_parameter
id kdbus_id_parameter
dstid kdbus_id_parameter
}
kdbus_cmd_free {
size len[parent, int64]
flags int64
rflags const[0, int64]
off int64
# TODO: followed by arbitrary sequence of parameters
}
kdbus_cmd_recv {
size len[parent, int64]
flags flags[kdbus_recv_flags, int64]
rflags const[0, int64]
prio int64
dropped int64
msg kdbus_msg_info
# TODO: followed by arbitrary sequence of parameters
}
kdbus_cmd_send {
size len[parent, int64]
flags flags[kdbus_send_flags, int64]
rflags const[0, int64]
msg ptr[in, kdbus_msg]
reply kdbus_msg_info
fd kdbus_fd_parameter
}
kdbus_msg {
size len[parent, int64]
flags flags[kdbus_msg_flags, int64]
rflags const[0, int64]
vec0 kdbus_payload_vec
vec1 kdbus_payload_vec
memfd0 kdbus_payload_memfd
memfd1 kdbus_payload_memfd
fds kdbus_fd_parameter
bloom kdbus_bloom_parameter
dname kdbus_dst_name_parameter
}
kdbus_msg_info {
off int64
size int64
rflags const[0, int64]
}
kdbus_cmd_info {
size len[parent, int64]
flags const[0, int64]
rflags const[0, int64]
# TODO: this is connection id, need to extract it from somewhere
id int64
aflags flags[kdbus_attach_flags, int64]
# TODO: off is offset in the caller's pool buffer where the kdbus_info struct result is stored.
# It needs to be passed to KDBUS_CMD_FREE, so it should be a resource.
off int64
isize const[0, int64]
# TODO: name is optional if id is specified
name kdbus_make_name_parameter
}
kdbus_bloom_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_BLOOM_PARAMETER, int64]
bsize int64
hash int64
}
kdbus_make_name_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_MAKE_NAME, int64]
# TODO: this is embed strz buffer of variable-length
name int64
}
kdbus_dst_name_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_DST_NAME, int64]
# TODO: this is embed strz buffer of variable-length
name int64
}
kdbus_name_parameter {
size len[parent, int64]
type flags[kdbus_name_params, int64]
flags flags[kdbus_name_flags, int64]
# TODO: this is embed var-len string
name int64
}
kdbus_negotiate_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_NEGOTIATE, int64]
}
kdbus_policy_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_POLICY_ACCESS, int64]
ptype flags[kdbus_policy_access, int64]
access flags[kdbus_policy_flags, int64]
id uid
}
kdbus_attach_flags_parameter {
size len[parent, int64]
type flags[kdbug_attach_type, int64]
flags flags[kdbus_attach_flags, int64]
}
kdbus_fd_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_CANCEL_FD, int64]
# TODO: this can be embed var-len array
fd fd
}
kdbus_pids_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_PIDS, int64]
pid pid
pad1 const[0, int32]
tid pid
pad2 const[0, int32]
ppid pid
pad3 const[0, int32]
}
kdbus_creds_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_CREDS, int64]
uid uid
pad1 const[0, int32]
euid uid
pad2 const[0, int32]
suid uid
pad3 const[0, int32]
fsuid uid
pad4 const[0, int32]
gid uid
pad5 const[0, int32]
egid uid
pad6 const[0, int32]
sgid uid
pad7 const[0, int32]
fsgid uid
pad8 const[0, int32]
}
kdbus_seclabel_parameter {
size len[parent, int64]
type const[KDBUS_ITEM_SECLABEL, int64]
# TODO: this is some var-len string of unknown nature
label int64
}
kdbus_payload_vec {
size1 len[parent, int64]
type const[KDBUS_ITEM_PAYLOAD_VEC, int64]
size2 len[data, int64]
data buffer[in]
}
kdbus_payload_memfd {
size1 len[parent, int64]
type const[KDBUS_ITEM_PAYLOAD_MEMFD, int64]
start int64
size2 int64
fd fd
}
kdbus_id_change_parameter {
size len[parent, int64]
type flags[kdbus_id_change_type, int64]
id const[0, int64]
flags const[0, int64]
}
kdbus_id_parameter {
size len[parent, int64]
type flags[kdbus_id_type, int64]
# TODO: what is this id?
id int64
}
kdbus_make_flags = KDBUS_MAKE_ACCESS_GROUP, KDBUS_MAKE_ACCESS_WORLD
kdbus_hello_flags = KDBUS_HELLO_ACCEPT_FD, KDBUS_HELLO_ACTIVATOR, KDBUS_HELLO_POLICY_HOLDER, KDBUS_HELLO_MONITOR
kdbus_attach_flags = KDBUS_ATTACH_TIMESTAMP, KDBUS_ATTACH_CREDS, KDBUS_ATTACH_PIDS, KDBUS_ATTACH_AUXGROUPS, KDBUS_ATTACH_NAMES, KDBUS_ATTACH_TID_COMM, KDBUS_ATTACH_PID_COMM, KDBUS_ATTACH_EXE, KDBUS_ATTACH_CMDLINE, KDBUS_ATTACH_CGROUP, KDBUS_ATTACH_CAPS, KDBUS_ATTACH_SECLABEL, KDBUS_ATTACH_AUDIT, KDBUS_ATTACH_CONN_DESCRIPTION, KDBUS_ATTACH_ANY
kdbus_name_flags = KDBUS_NAME_REPLACE_EXISTING, KDBUS_NAME_ALLOW_REPLACEMENT, KDBUS_NAME_QUEUE, KDBUS_NAME_IN_QUEUE, KDBUS_NAME_ACTIVATOR, KDBUS_NAME_PRIMARY, KDBUS_NAME_ACQUIRED
kdbus_recv_flags = KDBUS_RECV_RETURN_INCOMPLETE_FDS, KDBUS_RECV_RETURN_DROPPED_MSGS
kdbus_send_flags = KDBUS_SEND_SYNC_REPLY
kdbus_policy_access = KDBUS_POLICY_ACCESS_NULL, KDBUS_POLICY_ACCESS_USER, KDBUS_POLICY_ACCESS_GROUP, KDBUS_POLICY_ACCESS_WORLD
kdbus_policy_flags = KDBUS_POLICY_OWN, KDBUS_POLICY_TALK, KDBUS_POLICY_SEE
kdbug_attach_type = KDBUS_ITEM_ATTACH_FLAGS_SEND, KDBUS_ITEM_ATTACH_FLAGS_RECV
kdbus_msg_flags = KDBUS_MSG_EXPECT_REPLY, KDBUS_MSG_NO_AUTO_START, KDBUS_MSG_SIGNAL
kdbus_list_flags = KDBUS_LIST_UNIQUE, KDBUS_LIST_NAMES, KDBUS_LIST_ACTIVATORS, KDBUS_LIST_QUEUED
kdbus_match_flags = KDBUS_MATCH_REPLACE
kdbus_name_params = KDBUS_ITEM_NAME, KDBUS_ITEM_NAME_ADD, KDBUS_ITEM_NAME_REMOVE, KDBUS_ITEM_NAME_CHANGE
kdbus_id_change_type = KDBUS_ITEM_ID_ADD, KDBUS_ITEM_ID_REMOVE
kdbus_id_type = KDBUS_ITEM_ID, KDBUS_ITEM_DST_ID
define KDBUS_IOCTL_MAGIC 0x95
define KDBUS_CMD_BUS_MAKE _IOW(KDBUS_IOCTL_MAGIC, 0x00, int)
define KDBUS_CMD_ENDPOINT_MAKE _IOW(KDBUS_IOCTL_MAGIC, 0x10, int)
define KDBUS_CMD_ENDPOINT_UPDATE _IOW(KDBUS_IOCTL_MAGIC, 0x11, int)
define KDBUS_CMD_HELLO _IOWR(KDBUS_IOCTL_MAGIC, 0x80, int)
define KDBUS_CMD_UPDATE _IOW(KDBUS_IOCTL_MAGIC, 0x81, int)
define KDBUS_CMD_BYEBYE _IOW(KDBUS_IOCTL_MAGIC, 0x82, int)
define KDBUS_CMD_FREE _IOW(KDBUS_IOCTL_MAGIC, 0x83, int)
define KDBUS_CMD_CONN_INFO _IOR(KDBUS_IOCTL_MAGIC, 0x84, int)
define KDBUS_CMD_BUS_CREATOR_INFO _IOR(KDBUS_IOCTL_MAGIC, 0x85, int)
define KDBUS_CMD_LIST _IOR(KDBUS_IOCTL_MAGIC, 0x86, int)
define KDBUS_CMD_SEND _IOW(KDBUS_IOCTL_MAGIC, 0x90, int)
define KDBUS_CMD_RECV _IOR(KDBUS_IOCTL_MAGIC, 0x91, int)
define KDBUS_CMD_NAME_ACQUIRE _IOW(KDBUS_IOCTL_MAGIC, 0xa0, int)
define KDBUS_CMD_NAME_RELEASE _IOW(KDBUS_IOCTL_MAGIC, 0xa1, int)
define KDBUS_CMD_MATCH_ADD _IOW(KDBUS_IOCTL_MAGIC, 0xb0, int)
define KDBUS_CMD_MATCH_REMOVE _IOW(KDBUS_IOCTL_MAGIC, 0xb1, int)
define KDBUS_MAKE_ACCESS_GROUP (1ULL << 0)
define KDBUS_MAKE_ACCESS_WORLD (1ULL << 1)
define KDBUS_HELLO_ACCEPT_FD (1ULL << 0)
define KDBUS_HELLO_ACTIVATOR (1ULL << 1)
define KDBUS_HELLO_POLICY_HOLDER (1ULL << 2)
define KDBUS_HELLO_MONITOR (1ULL << 3)
define KDBUS_ATTACH_TIMESTAMP 1ULL << 0
define KDBUS_ATTACH_CREDS 1ULL << 1
define KDBUS_ATTACH_PIDS 1ULL << 2
define KDBUS_ATTACH_AUXGROUPS 1ULL << 3
define KDBUS_ATTACH_NAMES 1ULL << 4
define KDBUS_ATTACH_TID_COMM 1ULL << 5
define KDBUS_ATTACH_PID_COMM 1ULL << 6
define KDBUS_ATTACH_EXE 1ULL << 7
define KDBUS_ATTACH_CMDLINE 1ULL << 8
define KDBUS_ATTACH_CGROUP 1ULL << 9
define KDBUS_ATTACH_CAPS 1ULL << 10
define KDBUS_ATTACH_SECLABEL 1ULL << 11
define KDBUS_ATTACH_AUDIT 1ULL << 12
define KDBUS_ATTACH_CONN_DESCRIPTION 1ULL << 13
define KDBUS_ATTACH_ANY ~0ULL
define KDBUS_NAME_REPLACE_EXISTING 1ULL << 0
define KDBUS_NAME_ALLOW_REPLACEMENT 1ULL << 1
define KDBUS_NAME_QUEUE 1ULL << 2
define KDBUS_NAME_IN_QUEUE 1ULL << 3
define KDBUS_NAME_ACTIVATOR 1ULL << 4
define KDBUS_NAME_PRIMARY 1ULL << 5
define KDBUS_NAME_ACQUIRED 1ULL << 6
define KDBUS_RECV_RETURN_INCOMPLETE_FDS 1ULL << 0
define KDBUS_RECV_RETURN_DROPPED_MSGS 1ULL << 1
define KDBUS_SEND_SYNC_REPLY 1ULL << 0
define KDBUS_LIST_UNIQUE 1ULL << 0
define KDBUS_LIST_NAMES 1ULL << 1
define KDBUS_LIST_ACTIVATORS 1ULL << 2
define KDBUS_LIST_QUEUED 1ULL << 3
define KDBUS_POLICY_ACCESS_NULL 0
define KDBUS_POLICY_ACCESS_USER 1
define KDBUS_POLICY_ACCESS_GROUP 2
define KDBUS_POLICY_ACCESS_WORLD 3
define KDBUS_POLICY_SEE 0
define KDBUS_POLICY_TALK 1
define KDBUS_POLICY_OWN 2
define KDBUS_MATCH_REPLACE 1ULL << 0
define KDBUS_MSG_EXPECT_REPLY 1ULL << 0
define KDBUS_MSG_NO_AUTO_START 1ULL << 1
define KDBUS_MSG_SIGNAL 1ULL << 2
define KDBUS_ITEM_NEGOTIATE 1
define KDBUS_ITEM_PAYLOAD_VEC 2
define KDBUS_ITEM_PAYLOAD_OFF 3
define KDBUS_ITEM_PAYLOAD_MEMFD 4
define KDBUS_ITEM_FDS 5
define KDBUS_ITEM_CANCEL_FD 6
define KDBUS_ITEM_BLOOM_PARAMETER 7
define KDBUS_ITEM_BLOOM_FILTER 8
define KDBUS_ITEM_BLOOM_MASK 9
define KDBUS_ITEM_DST_NAME 10
define KDBUS_ITEM_MAKE_NAME 11
define KDBUS_ITEM_ATTACH_FLAGS_SEND 12
define KDBUS_ITEM_ATTACH_FLAGS_RECV 13
define KDBUS_ITEM_ID 14
define KDBUS_ITEM_NAME 15
define KDBUS_ITEM_DST_ID 16
define KDBUS_ITEM_TIMESTAMP (0x1000 + 0)
define KDBUS_ITEM_CREDS (0x1000 + 1)
define KDBUS_ITEM_PIDS (0x1000 + 2)
define KDBUS_ITEM_AUXGROUPS (0x1000 + 3)
define KDBUS_ITEM_OWNED_NAME (0x1000 + 4)
define KDBUS_ITEM_TID_COMM (0x1000 + 5)
define KDBUS_ITEM_PID_COM (0x1000 + 6)
define KDBUS_ITEM_EXE (0x1000 + 7)
define KDBUS_ITEM_CMDLINE (0x1000 + 8)
define KDBUS_ITEM_CGROUP (0x1000 + 9)
define KDBUS_ITEM_CAPS (0x1000 + 10)
define KDBUS_ITEM_SECLABEL (0x1000 + 11)
define KDBUS_ITEM_AUDIT (0x1000 + 12)
define KDBUS_ITEM_CONN_DESCRIPTION (0x1000 + 13)
define KDBUS_ITEM_POLICY_ACCESS (0x2000 + 0)
define KDBUS_ITEM_NAME_ADD (0x8000 + 0)
define KDBUS_ITEM_NAME_REMOVE (0x8000 + 1)
define KDBUS_ITEM_NAME_CHANGE (0x8000 + 2)
define KDBUS_ITEM_ID_ADD (0x8000 + 3)
define KDBUS_ITEM_ID_REMOVE (0x8000 + 4)
define KDBUS_ITEM_REPLY_TIMEOUT (0x8000 + 5)
define KDBUS_ITEM_REPLY_DEAD (0x8000 + 6)