From 4d51507953aff8615eb8a5f0e0f411fa18160d54 Mon Sep 17 00:00:00 2001 From: Matheus Date: Sat, 24 Aug 2024 20:00:46 -0300 Subject: [PATCH] auth: initial implementation + some filesystem checks --- kernel-src/arch/x86-64/main.c | 2 + kernel-src/fs/devfs.c | 6 +- kernel-src/fs/ext2.c | 4 +- kernel-src/fs/tmpfs.c | 6 +- kernel-src/fs/vfs.c | 13 +++-- kernel-src/include/kernel/auth.h | 52 +++++++++++++++++ kernel-src/include/kernel/cred.h | 10 ++-- kernel-src/include/kernel/defaultauth.h | 6 ++ kernel-src/include/kernel/vfs.h | 23 ++++++++ kernel-src/sys/auth.c | 36 ++++++++++++ kernel-src/sys/cred.c | 12 ++-- kernel-src/sys/defaultauth.c | 78 +++++++++++++++++++++++++ kernel-src/sys/syscalls/chmod.c | 10 +++- kernel-src/sys/syscalls/execve.c | 4 ++ kernel-src/sys/syscalls/fchownat.c | 9 ++- kernel-src/sys/syscalls/mkdirat.c | 4 +- kernel-src/sys/syscalls/mknodat.c | 4 +- kernel-src/sys/syscalls/open.c | 5 +- kernel-src/sys/syscalls/sync.c | 1 + 19 files changed, 251 insertions(+), 34 deletions(-) create mode 100644 kernel-src/include/kernel/auth.h create mode 100644 kernel-src/include/kernel/defaultauth.h create mode 100644 kernel-src/sys/auth.c create mode 100644 kernel-src/sys/defaultauth.c diff --git a/kernel-src/arch/x86-64/main.c b/kernel-src/arch/x86-64/main.c index 46b59ced..670511bb 100644 --- a/kernel-src/arch/x86-64/main.c +++ b/kernel-src/arch/x86-64/main.c @@ -38,6 +38,7 @@ #include #include #include +#include static cpu_t bsp_cpu; @@ -119,6 +120,7 @@ void kernel_entry() { if (cmdline_get("initrd")) initrd_unpack(); + defaultauth_init(); sched_runinit(); sched_threadexit(); } diff --git a/kernel-src/fs/devfs.c b/kernel-src/fs/devfs.c index adcb9171..5c4fdb7f 100644 --- a/kernel-src/fs/devfs.c +++ b/kernel-src/fs/devfs.c @@ -8,6 +8,7 @@ #include #include #include +#include static devnode_t *devfsroot; @@ -188,9 +189,8 @@ int devfs_munmap(vnode_t *node, void *addr, uintmax_t offset, int flags, cred_t return devnode->devops->munmap(devnode->attr.rdevminor, addr, offset, flags); } -int devfs_access(vnode_t *node, mode_t mode, cred_t *cred) { - // TODO permission checks - return 0; +int devfs_access(vnode_t *vnode, mode_t mode, cred_t *cred) { + return auth_filesystem_check(cred, auth_filesystem_convertaccess(mode), vnode) ? EACCES : 0; } int devfs_isatty(vnode_t *node) { diff --git a/kernel-src/fs/ext2.c b/kernel-src/fs/ext2.c index cc30ff67..e3b1d681 100644 --- a/kernel-src/fs/ext2.c +++ b/kernel-src/fs/ext2.c @@ -11,6 +11,7 @@ #include #include #include +#include #define INODE_ROOT 2 @@ -1246,8 +1247,7 @@ static int ext2_getdents(vnode_t *vnode, dent_t *buffer, size_t count, uintmax_t } static int ext2_access(vnode_t *vnode, mode_t mode, cred_t *cred) { - // TODO permission checks - return 0; + return auth_filesystem_check(cred, auth_filesystem_convertaccess(mode), vnode) ? EACCES : 0; } static int ext2_readlink(vnode_t *vnode, char **link, cred_t *cred) { diff --git a/kernel-src/fs/tmpfs.c b/kernel-src/fs/tmpfs.c index 9f68d139..85fd0dc8 100644 --- a/kernel-src/fs/tmpfs.c +++ b/kernel-src/fs/tmpfs.c @@ -14,6 +14,7 @@ #include #include #include +#include static scache_t *nodecache; static tmpfsnode_t *newnode(vfs_t *vfs, int type); @@ -234,9 +235,8 @@ static int tmpfs_write(vnode_t *node, void *buffer, size_t size, uintmax_t offse __assert(!"tmpfs_read is handled by the page cache"); } -static int tmpfs_access(vnode_t *node, mode_t mode, cred_t *cred) { - // TODO permission checks - return 0; +static int tmpfs_access(vnode_t *vnode, mode_t mode, cred_t *cred) { + return auth_filesystem_check(cred, auth_filesystem_convertaccess(mode), vnode) ? EACCES : 0; } static int tmpfs_unlink(vnode_t *node, char *name, cred_t *cred) { diff --git a/kernel-src/fs/vfs.c b/kernel-src/fs/vfs.c index 3253eb08..032c05be 100644 --- a/kernel-src/fs/vfs.c +++ b/kernel-src/fs/vfs.c @@ -10,6 +10,7 @@ #include #include #include +#include #define PATHNAME_MAX 512 #define MAXLINKDEPTH 64 @@ -20,14 +21,9 @@ vnode_t *vfsroot; static spinlock_t listlock; static vfs_t *vfslist; -static cred_t kernelcred = { - .gid = 0, - .uid = 0 -}; - static cred_t *getcred() { if (_cpu()->thread == NULL || _cpu()->thread->proc == NULL) - return &kernelcred; + return NULL; else return &_cpu()->thread->proc->cred; } @@ -111,6 +107,10 @@ int vfs_open(vnode_t *ref, char *path, int flags, vnode_t **res) { if (err) return err; + err = VOP_ACCESS(tmp, ((flags & V_FFLAGS_READ) ? V_ACCESS_READ : 0) | ((flags & V_FFLAGS_WRITE) ? V_ACCESS_WRITE : 0), getcred()); + if (err) + return err; + err = VOP_OPEN(&tmp, flags, getcred()); if (err) { VOP_RELEASE(tmp); @@ -189,6 +189,7 @@ int vfs_write(vnode_t *node, void *buffer, size_t size, uintmax_t offset, size_t } MUTEX_ACQUIRE(&node->sizelock, false); + vattr_t attr; err = VOP_GETATTR(node, &attr, getcred()); if (err) diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h new file mode 100644 index 00000000..bd3230b6 --- /dev/null +++ b/kernel-src/include/kernel/auth.h @@ -0,0 +1,52 @@ +#ifndef _AUTH_H +#define _AUTH_H + +#include +#include + +#define AUTH_SCOPE_COUNT 2 +#define AUTH_SCOPE_SYSTEM 0 +#define AUTH_SCOPE_FILESYSTEM 1 + +#define AUTH_LISTENER_LIMIT 8 + +#define AUTH_DECISION_ALLOW 1 +#define AUTH_DECISION_DEFER 0 +#define AUTH_DECISION_DENY -1000 + +#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8 +#define AUTH_ACTIONS_FILESYSTEM_READ 4 +#define AUTH_ACTIONS_FILESYSTEM_WRITE 2 +#define AUTH_ACTIONS_FILESYSTEM_EXECUTE 1 + +typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2); + +typedef struct { + authlistener_t listeners[AUTH_LISTENER_LIMIT]; +} authscope_t; + +void auth_registerlistener(int scope, authlistener_t listener); +int auth_check(int scope, cred_t *cred, int actions, void *arg0, void *arg1, void *arg2); + +static inline int auth_filesystem_check(cred_t *cred, int actions, vnode_t *vnode) { + return auth_check(AUTH_SCOPE_FILESYSTEM, cred, actions, vnode, NULL, NULL); +} + +static inline int auth_system_check(cred_t *cred, int actions) { + return auth_check(AUTH_SCOPE_SYSTEM, cred, actions, NULL, NULL, NULL); +} + +static inline int auth_filesystem_convertaccess(int access) { + int r = 0; + + if (access & V_ACCESS_EXECUTE) + r |= AUTH_ACTIONS_FILESYSTEM_EXECUTE; + if (access & V_ACCESS_WRITE) + r |= AUTH_ACTIONS_FILESYSTEM_WRITE; + if (access & V_ACCESS_READ) + r |= AUTH_ACTIONS_FILESYSTEM_READ; + + return r; +} + +#endif diff --git a/kernel-src/include/kernel/cred.h b/kernel-src/include/kernel/cred.h index cf5f4bf3..b3cb6dac 100644 --- a/kernel-src/include/kernel/cred.h +++ b/kernel-src/include/kernel/cred.h @@ -1,18 +1,18 @@ #ifndef _CRED_H #define _CRED_H -#define CRED_PERM_SUPERUSER (1l << 63) - #include typedef struct { int uid, euid, suid; int gid, egid, sgid; - - uintmax_t allow; - uintmax_t deny; } cred_t; +#define CRED_SUPERUSER 0 +#define CRED_IS_SU(cred) ((cred)->uid == CRED_SUPERUSER) +#define CRED_IS_ESU(cred) ((cred)->euid == CRED_SUPERUSER) +#define CRED_IS_SSU(cred) ((cred)->suid == CRED_SUPERUSER) + int cred_setuids(cred_t *cred, int uid, int euid, int suid); int cred_setgids(cred_t *cred, int uid, int euid, int suid); void cred_getuids(cred_t *cred, int *uidp, int *euidp, int *suidp); diff --git a/kernel-src/include/kernel/defaultauth.h b/kernel-src/include/kernel/defaultauth.h new file mode 100644 index 00000000..34109b72 --- /dev/null +++ b/kernel-src/include/kernel/defaultauth.h @@ -0,0 +1,6 @@ +#ifndef _DEFAULTAUTH_H +#define _DEFAULTAUTH_H + +void defaultauth_init(); + +#endif diff --git a/kernel-src/include/kernel/vfs.h b/kernel-src/include/kernel/vfs.h index 5bd88ed8..52ad30d9 100644 --- a/kernel-src/include/kernel/vfs.h +++ b/kernel-src/include/kernel/vfs.h @@ -19,6 +19,29 @@ #define V_ATTR_ALL (V_ATTR_MODE | V_ATTR_UID | V_ATTR_GID | V_ATTR_ATIME | V_ATTR_MTIME | V_ATTR_CTIME) +#define V_ATTR_MODE_OTHERS_EXECUTE 00001 +#define V_ATTR_MODE_OTHERS_SEARCH V_ATTR_MODE_OTHERS_EXECUTE +#define V_ATTR_MODE_OTHERS_WRITE 00002 +#define V_ATTR_MODE_OTHERS_READ 00004 +#define V_ATTR_MODE_OTHERS_ALL 00007 +#define V_ATTR_MODE_GROUP_EXECUTE 00010 +#define V_ATTR_MODE_GROUP_SEARCH V_ATTR_MODE_GROUP_EXECUTE +#define V_ATTR_MODE_GROUP_WRITE 00020 +#define V_ATTR_MODE_GROUP_READ 00040 +#define V_ATTR_MODE_GROUP_ALL 00070 +#define V_ATTR_MODE_USER_EXECUTE 00100 +#define V_ATTR_MODE_USER_SEARCH V_ATTR_MODE_USER_EXECUTE +#define V_ATTR_MODE_USER_WRITE 00200 +#define V_ATTR_MODE_USER_READ 00400 +#define V_ATTR_MODE_USER_ALL 00700 +#define V_ATTR_MODE_STICKY 01000 +#define V_ATTR_MODE_SGID 02000 +#define V_ATTR_MODE_SUID 04000 + +#define V_ACCESS_EXECUTE 1 +#define V_ACCESS_WRITE 2 +#define V_ACCESS_READ 4 + typedef struct { int type; mode_t mode; diff --git a/kernel-src/sys/auth.c b/kernel-src/sys/auth.c new file mode 100644 index 00000000..34670ba0 --- /dev/null +++ b/kernel-src/sys/auth.c @@ -0,0 +1,36 @@ +#include + +static authscope_t scopes[AUTH_SCOPE_COUNT]; + +void auth_registerlistener(int _scope, authlistener_t listener) { + authscope_t *scope = &scopes[_scope]; + for (int i = 0; i < AUTH_LISTENER_LIMIT; ++i) { + if (scope->listeners[i]) + continue; + + scope->listeners[i] = listener; + break; + } +} + +int auth_check(int _scope, cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) { + if (cred == NULL || actions == 0) + return 0; + + authscope_t *scope = &scopes[_scope]; + + int allow = 0; + for (int i = 0; i < AUTH_LISTENER_LIMIT; ++i) { + authlistener_t listener = scope->listeners[i]; + if (listener == NULL) + continue; + + int decision = listener(cred, actions, arg0, arg1, arg2); + if (decision == AUTH_DECISION_DENY) + return EPERM; + + allow += decision; + } + + return allow ? 0 : EPERM; +} diff --git a/kernel-src/sys/cred.c b/kernel-src/sys/cred.c index 0ac7d03b..72c8f762 100644 --- a/kernel-src/sys/cred.c +++ b/kernel-src/sys/cred.c @@ -7,9 +7,9 @@ int cred_setuids(cred_t *cred, int uid, int euid, int suid) { // TODO do permission check to see if its possible - cred->uid = uid; - cred->euid = euid; - cred->suid = suid; + cred->uid = (uid == -1) ? cred->uid : uid; + cred->euid = (euid == -1) ? cred->euid : euid; + cred->suid = (suid == -1) ? cred->suid : suid; return 0; } @@ -20,9 +20,9 @@ int cred_setgids(cred_t *cred, int gid, int egid, int sgid) { // TODO do permission check to see if its possible - cred->gid = gid; - cred->egid = egid; - cred->sgid = sgid; + cred->gid = (gid == -1) ? cred->gid : gid; + cred->egid = (egid == -1) ? cred->egid : egid; + cred->sgid = (sgid == -1) ? cred->sgid : sgid; return 0; } diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c new file mode 100644 index 00000000..4526388f --- /dev/null +++ b/kernel-src/sys/defaultauth.c @@ -0,0 +1,78 @@ +#include +#include + +// default listeners for auth + +#define DONE_CHECK(a) {\ + if ((a) == 0) \ + goto done; \ + } + +static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) { + vnode_t *vnode = arg0; + + vattr_t attr; + VOP_GETATTR(vnode, &attr, NULL); + + int weight = 0; + if (actions & AUTH_ACTIONS_FILESYSTEM_WRITE) { + if (CRED_IS_ESU(cred)) + weight += 1; + else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_WRITE)) + weight += 1; + else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_WRITE)) + weight += 1; + else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_WRITE)) + weight += 1; + else + return AUTH_DECISION_DENY; + + DONE_CHECK(actions); + } + + if (actions & AUTH_ACTIONS_FILESYSTEM_READ) { + if (CRED_IS_ESU(cred)) + weight += 1; + else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_READ)) + weight += 1; + else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_READ)) + weight += 1; + else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_READ)) + weight += 1; + else + return AUTH_DECISION_DENY; + + DONE_CHECK(actions); + } + + if (actions & AUTH_ACTIONS_FILESYSTEM_EXECUTE) { + if ((attr.mode & (V_ATTR_MODE_USER_EXECUTE | V_ATTR_MODE_GROUP_EXECUTE | V_ATTR_MODE_OTHERS_EXECUTE)) && CRED_IS_ESU(cred)) + weight += 1; + else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_EXECUTE)) + weight += 1; + else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_EXECUTE)) + weight += 1; + else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_EXECUTE)) + weight += 1; + else + return AUTH_DECISION_DENY; + + DONE_CHECK(actions); + } + + if (actions & AUTH_ACTIONS_FILESYSTEM_SETATTR) { + if (CRED_IS_ESU(cred) || cred->euid == attr.uid) + weight += 1; + else + return AUTH_DECISION_DENY; + + DONE_CHECK(actions); + } + + done: + return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER; +} + +void defaultauth_init() { + auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem); +} diff --git a/kernel-src/sys/syscalls/chmod.c b/kernel-src/sys/syscalls/chmod.c index 5dfc0b6c..587c597b 100644 --- a/kernel-src/sys/syscalls/chmod.c +++ b/kernel-src/sys/syscalls/chmod.c @@ -3,15 +3,21 @@ #include #include #include +#include static int dochmod(vnode_t *node, mode_t mode) { vattr_t attr; cred_t *cred = &_cpu()->thread->proc->cred; - int e = VOP_GETATTR(node, &attr, cred); + + int e = auth_filesystem_check(cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node); if (e) return e; - attr.mode = UMASK(mode); + e = VOP_GETATTR(node, &attr, cred); + if (e) + return e; + + attr.mode = mode; return VOP_SETATTR(node, &attr, V_ATTR_MODE, cred); } diff --git a/kernel-src/sys/syscalls/execve.c b/kernel-src/sys/syscalls/execve.c index a23bc6c6..d312a993 100644 --- a/kernel-src/sys/syscalls/execve.c +++ b/kernel-src/sys/syscalls/execve.c @@ -177,6 +177,10 @@ static syscallret_t execve(context_t *context, char *upath, char *uargv[], char if (ret.errno) goto error; + ret.errno = VOP_ACCESS(node, V_ACCESS_EXECUTE, &_cpu()->thread->proc->cred); + if (ret.errno) + goto error; + size_t readcount; ret.errno = vfs_read(node, shebang, SHEBANG_SIZE - 1, 0, &readcount, 0); if (ret.errno) diff --git a/kernel-src/sys/syscalls/fchownat.c b/kernel-src/sys/syscalls/fchownat.c index 0914f072..b456f914 100644 --- a/kernel-src/sys/syscalls/fchownat.c +++ b/kernel-src/sys/syscalls/fchownat.c @@ -1,6 +1,7 @@ #include #include #include +#include syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid_t group, int flags) { syscallret_t ret = { @@ -48,15 +49,21 @@ syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid goto cleanup; } + ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node); + if (ret.errno) + goto cleanup; + vattr_t attr; ret.errno = VOP_GETATTR(node, &attr, &_cpu()->thread->proc->cred); if (ret.errno) goto cleanup; + // TODO retain set uid and set gid bits if an auth access was ok attr.uid = owner; attr.gid = group; + attr.mode = (attr.mode) & ~(V_ATTR_MODE_SGID | V_ATTR_MODE_SUID); - ret.errno = VOP_SETATTR(node, &attr, V_ATTR_UID | V_ATTR_GID, &_cpu()->thread->proc->cred); + ret.errno = VOP_SETATTR(node, &attr, ((owner == -1) ? 0 : V_ATTR_UID) | ((group == -1) ? 0 : V_ATTR_GID), &_cpu()->thread->proc->cred); ret.ret = ret.errno ? -1 : 0; cleanup: diff --git a/kernel-src/sys/syscalls/mkdirat.c b/kernel-src/sys/syscalls/mkdirat.c index 5410af77..5772fcae 100644 --- a/kernel-src/sys/syscalls/mkdirat.c +++ b/kernel-src/sys/syscalls/mkdirat.c @@ -35,8 +35,8 @@ syscallret_t syscall_mkdirat(context_t *, int dirfd, char *upath, mode_t mode) { vattr_t attr = { .mode = UMASK(mode), - .gid = _cpu()->thread->proc->cred.gid, - .uid = _cpu()->thread->proc->cred.uid + .gid = _cpu()->thread->proc->cred.egid, + .uid = _cpu()->thread->proc->cred.euid }; ret.errno = vfs_create(dirnode, path, &attr, V_TYPE_DIR, NULL); diff --git a/kernel-src/sys/syscalls/mknodat.c b/kernel-src/sys/syscalls/mknodat.c index f0c0a02a..185295f0 100644 --- a/kernel-src/sys/syscalls/mknodat.c +++ b/kernel-src/sys/syscalls/mknodat.c @@ -38,8 +38,8 @@ syscallret_t syscall_mknodat(context_t *, int dirfd, char *upath, mode_t mode, d vattr_t attr = { .mode = UMASK(mode), - .gid = _cpu()->thread->proc->cred.gid, - .uid = _cpu()->thread->proc->cred.uid, + .gid = _cpu()->thread->proc->cred.egid, + .uid = _cpu()->thread->proc->cred.euid, .rdevmajor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MAJORDEV(dev) : 0, .rdevminor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MINORDEV(dev) : 0, }; diff --git a/kernel-src/sys/syscalls/open.c b/kernel-src/sys/syscalls/open.c index 85b1b713..e0cfbba3 100644 --- a/kernel-src/sys/syscalls/open.c +++ b/kernel-src/sys/syscalls/open.c @@ -4,6 +4,7 @@ #include #include #include +#include syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags, mode_t mode) { syscallret_t ret = { @@ -54,8 +55,8 @@ syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags if (ret.errno == ENOENT && (flags & O_CREAT)) { vattr_t attr = { .mode = UMASK(mode), - .gid = _cpu()->thread->proc->cred.gid, - .uid = _cpu()->thread->proc->cred.uid + .gid = _cpu()->thread->proc->cred.egid, + .uid = _cpu()->thread->proc->cred.euid }; ret.errno = vfs_create(dirnode, pathbuf, &attr, V_TYPE_REGULAR, &vnode); diff --git a/kernel-src/sys/syscalls/sync.c b/kernel-src/sys/syscalls/sync.c index a2b768a2..8daccd66 100644 --- a/kernel-src/sys/syscalls/sync.c +++ b/kernel-src/sys/syscalls/sync.c @@ -21,5 +21,6 @@ syscallret_t syscall_fsync(context_t *context, int fd) { ret.errno = VOP_SYNC(file->vnode); fd_release(file); + ret.ret = ret.errno ? -1 : 0; return ret; }