From 3ec2d2f5f1888e67a94b65f4150076376bfa208b Mon Sep 17 00:00:00 2001
From: Matheus <matheusuky@gmail.com>
Date: Fri, 30 Aug 2024 23:00:11 -0300
Subject: [PATCH] auth: network

---
 kernel-src/include/kernel/auth.h | 10 +++++++++-
 kernel-src/sys/defaultauth.c     | 12 ++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h
index 9677d023..3f67285c 100644
--- a/kernel-src/include/kernel/auth.h
+++ b/kernel-src/include/kernel/auth.h
@@ -4,12 +4,14 @@
 #include <kernel/cred.h>
 #include <kernel/vfs.h>
 #include <kernel/scheduler.h>
+#include <kernel/sock.h>
 
-#define AUTH_SCOPE_COUNT 4
+#define AUTH_SCOPE_COUNT 5
 #define AUTH_SCOPE_SYSTEM 0
 #define AUTH_SCOPE_FILESYSTEM 1
 #define AUTH_SCOPE_CRED 2
 #define AUTH_SCOPE_PROCESS 3
+#define AUTH_SCOPE_NETWORK 4
 
 #define AUTH_LISTENER_LIMIT 8
 
@@ -37,6 +39,8 @@
 
 #define AUTH_ACTIONS_PROCESS_SIGNAL	1
 
+#define AUTH_ACTIONS_NETWORK_CONFIGURE	1
+
 typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
 
 typedef struct {
@@ -62,6 +66,10 @@ static inline int auth_process_check(cred_t *cred, int actions, proc_t *proc) {
 	return auth_check(AUTH_SCOPE_PROCESS, cred, actions, proc, NULL, NULL);
 }
 
+static inline int auth_network_check(cred_t *cred, int actions, socket_t *socket, netdev_t *netdev) {
+	return auth_check(AUTH_SCOPE_NETWORK, cred, actions, socket, netdev, NULL);
+}
+
 static inline int auth_filesystem_convertaccess(int access) {
 	int r = 0;
 
diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c
index 6d0c5ddd..2035013d 100644
--- a/kernel-src/sys/defaultauth.c
+++ b/kernel-src/sys/defaultauth.c
@@ -272,9 +272,21 @@ static int process(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2
 	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
 }
 
+static int network(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
+	//socket_t *socket = arg0;
+	//netdev_t *netdev = arg1;
+
+	// for now, all checks will just be privileged operations
+	if (CRED_IS_ESU(cred))
+		return AUTH_DECISION_ALLOW;
+	else
+		return AUTH_DECISION_DENY;
+}
+
 void defaultauth_init() {
 	auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem);
 	auth_registerlistener(AUTH_SCOPE_SYSTEM, system);
 	auth_registerlistener(AUTH_SCOPE_CRED, credlistener);
 	auth_registerlistener(AUTH_SCOPE_PROCESS, process);
+	auth_registerlistener(AUTH_SCOPE_NETWORK, network);
 }