auth: initial implementation + some filesystem checks

kernel-src/include/kernel/auth.h

@@ -0,0 +1,52 @@
+#ifndef _AUTH_H
+#define _AUTH_H
+
+#include <kernel/cred.h>
+#include <kernel/vfs.h>
+
+#define AUTH_SCOPE_COUNT 2
+#define AUTH_SCOPE_SYSTEM 0
+#define AUTH_SCOPE_FILESYSTEM 1
+
+#define AUTH_LISTENER_LIMIT 8
+
+#define AUTH_DECISION_ALLOW 1
+#define AUTH_DECISION_DEFER 0
+#define AUTH_DECISION_DENY -1000
+
+#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
+#define AUTH_ACTIONS_FILESYSTEM_READ 	4
+#define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
+#define AUTH_ACTIONS_FILESYSTEM_EXECUTE 1
+
+typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
+
+typedef struct {
+	authlistener_t listeners[AUTH_LISTENER_LIMIT];
+} authscope_t;
+
+void auth_registerlistener(int scope, authlistener_t listener);
+int auth_check(int scope, cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
+
+static inline int auth_filesystem_check(cred_t *cred, int actions, vnode_t *vnode) {
+	return auth_check(AUTH_SCOPE_FILESYSTEM, cred, actions, vnode, NULL, NULL);
+}
+
+static inline int auth_system_check(cred_t *cred, int actions) {
+	return auth_check(AUTH_SCOPE_SYSTEM, cred, actions, NULL, NULL, NULL);
+}
+
+static inline int auth_filesystem_convertaccess(int access) {
+	int r = 0;
+
+	if (access & V_ACCESS_EXECUTE)
+		r |= AUTH_ACTIONS_FILESYSTEM_EXECUTE;
+	if (access & V_ACCESS_WRITE)
+		r |= AUTH_ACTIONS_FILESYSTEM_WRITE;
+	if (access & V_ACCESS_READ)
+		r |= AUTH_ACTIONS_FILESYSTEM_READ;
+
+	return r;
+}
+
+#endif

kernel-src/include/kernel/cred.h

@@ -1,18 +1,18 @@
 #ifndef _CRED_H
 #define _CRED_H
 
-#define CRED_PERM_SUPERUSER (1l << 63)
-
 #include <stdint.h>
 
 typedef struct {
 	int uid, euid, suid;
 	int gid, egid, sgid;
-
-	uintmax_t allow;
-	uintmax_t deny;
 } cred_t;
 
+#define CRED_SUPERUSER 0
+#define CRED_IS_SU(cred) ((cred)->uid == CRED_SUPERUSER)
+#define CRED_IS_ESU(cred) ((cred)->euid == CRED_SUPERUSER)
+#define CRED_IS_SSU(cred) ((cred)->suid == CRED_SUPERUSER)
+
 int cred_setuids(cred_t *cred, int uid, int euid, int suid);
 int cred_setgids(cred_t *cred, int uid, int euid, int suid);
 void cred_getuids(cred_t *cred, int *uidp, int *euidp, int *suidp);

kernel-src/include/kernel/defaultauth.h

@@ -0,0 +1,6 @@
+#ifndef _DEFAULTAUTH_H
+#define _DEFAULTAUTH_H
+
+void defaultauth_init();
+
+#endif

kernel-src/include/kernel/vfs.h

@@ -19,6 +19,29 @@
 
 #define V_ATTR_ALL (V_ATTR_MODE | V_ATTR_UID | V_ATTR_GID | V_ATTR_ATIME | V_ATTR_MTIME | V_ATTR_CTIME)
 
+#define V_ATTR_MODE_OTHERS_EXECUTE 	00001
+#define V_ATTR_MODE_OTHERS_SEARCH 	V_ATTR_MODE_OTHERS_EXECUTE
+#define V_ATTR_MODE_OTHERS_WRITE 	00002
+#define V_ATTR_MODE_OTHERS_READ 	00004
+#define V_ATTR_MODE_OTHERS_ALL		00007
+#define V_ATTR_MODE_GROUP_EXECUTE 	00010
+#define V_ATTR_MODE_GROUP_SEARCH 	V_ATTR_MODE_GROUP_EXECUTE
+#define V_ATTR_MODE_GROUP_WRITE 	00020
+#define V_ATTR_MODE_GROUP_READ 		00040
+#define V_ATTR_MODE_GROUP_ALL		00070
+#define V_ATTR_MODE_USER_EXECUTE 	00100
+#define V_ATTR_MODE_USER_SEARCH 	V_ATTR_MODE_USER_EXECUTE
+#define V_ATTR_MODE_USER_WRITE 		00200
+#define V_ATTR_MODE_USER_READ 		00400
+#define V_ATTR_MODE_USER_ALL		00700
+#define V_ATTR_MODE_STICKY 		01000
+#define V_ATTR_MODE_SGID 		02000
+#define V_ATTR_MODE_SUID 		04000
+
+#define V_ACCESS_EXECUTE 1
+#define V_ACCESS_WRITE 2
+#define V_ACCESS_READ 4
+
 typedef struct {
 	int type;
 	mode_t mode;