mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-29 05:38:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: initial implementation + some filesystem checks

Browse Source
This commit is contained in:
Matheus
2024-08-24 20:00:46 -03:00
parent dd70116695
commit 4d51507953
19 changed files with 251 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/sys/auth.c
+36
View File
@@ -0,0 +1,36 @@
#include <kernel/auth.h>
static authscope_t scopes[AUTH_SCOPE_COUNT];
void auth_registerlistener(int _scope, authlistener_t listener) {
authscope_t *scope = &scopes[_scope];
for (int i = 0; i < AUTH_LISTENER_LIMIT; ++i) {
if (scope->listeners[i])
continue;
scope->listeners[i] = listener;
break;
}
}
int auth_check(int _scope, cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
if (cred == NULL || actions == 0)
return 0;
authscope_t *scope = &scopes[_scope];
int allow = 0;
for (int i = 0; i < AUTH_LISTENER_LIMIT; ++i) {
authlistener_t listener = scope->listeners[i];
if (listener == NULL)
continue;
int decision = listener(cred, actions, arg0, arg1, arg2);
if (decision == AUTH_DECISION_DENY)
return EPERM;
allow += decision;
}
return allow ? 0 : EPERM;
}
kernel-src/sys/cred.c
+6 -6
View File
@@ -7,9 +7,9 @@ int cred_setuids(cred_t *cred, int uid, int euid, int suid) {
// TODO do permission check to see if its possible
cred->uid = uid;
cred->euid = euid;
cred->suid = suid;
cred->uid = (uid == -1) ? cred->uid : uid;
cred->euid = (euid == -1) ? cred->euid : euid;
cred->suid = (suid == -1) ? cred->suid : suid;
return 0;
}
@@ -20,9 +20,9 @@ int cred_setgids(cred_t *cred, int gid, int egid, int sgid) {
// TODO do permission check to see if its possible
cred->gid = gid;
cred->egid = egid;
cred->sgid = sgid;
cred->gid = (gid == -1) ? cred->gid : gid;
cred->egid = (egid == -1) ? cred->egid : egid;
cred->sgid = (sgid == -1) ? cred->sgid : sgid;
return 0;
}
kernel-src/sys/defaultauth.c
+78
View File
@@ -0,0 +1,78 @@
#include <kernel/auth.h>
#include <logging.h>
// default listeners for auth
#define DONE_CHECK(a) {\
if ((a) == 0) \
goto done; \
}
static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
vnode_t *vnode = arg0;
vattr_t attr;
VOP_GETATTR(vnode, &attr, NULL);
int weight = 0;
if (actions & AUTH_ACTIONS_FILESYSTEM_WRITE) {
if (CRED_IS_ESU(cred))
weight += 1;
else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_WRITE))
weight += 1;
else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_WRITE))
weight += 1;
else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_WRITE))
weight += 1;
else
return AUTH_DECISION_DENY;
DONE_CHECK(actions);
}
if (actions & AUTH_ACTIONS_FILESYSTEM_READ) {
if (CRED_IS_ESU(cred))
weight += 1;
else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_READ))
weight += 1;
else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_READ))
weight += 1;
else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_READ))
weight += 1;
else
return AUTH_DECISION_DENY;
DONE_CHECK(actions);
}
if (actions & AUTH_ACTIONS_FILESYSTEM_EXECUTE) {
if ((attr.mode & (V_ATTR_MODE_USER_EXECUTE | V_ATTR_MODE_GROUP_EXECUTE | V_ATTR_MODE_OTHERS_EXECUTE)) && CRED_IS_ESU(cred))
weight += 1;
else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_EXECUTE))
weight += 1;
else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_EXECUTE))
weight += 1;
else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_EXECUTE))
weight += 1;
else
return AUTH_DECISION_DENY;
DONE_CHECK(actions);
}
if (actions & AUTH_ACTIONS_FILESYSTEM_SETATTR) {
if (CRED_IS_ESU(cred) || cred->euid == attr.uid)
weight += 1;
else
return AUTH_DECISION_DENY;
DONE_CHECK(actions);
}
done:
return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
}
void defaultauth_init() {
auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem);
}
kernel-src/sys/syscalls/chmod.c
+8 -2
View File
@@ -3,15 +3,21 @@
#include <kernel/file.h>
#include <kernel/vfs.h>
#include <arch/cpu.h>
#include <kernel/auth.h>
static int dochmod(vnode_t *node, mode_t mode) {
vattr_t attr;
cred_t *cred = &_cpu()->thread->proc->cred;
int e = VOP_GETATTR(node, &attr, cred);
int e = auth_filesystem_check(cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
if (e)
return e;
attr.mode = UMASK(mode);
e = VOP_GETATTR(node, &attr, cred);
if (e)
return e;
attr.mode = mode;
return VOP_SETATTR(node, &attr, V_ATTR_MODE, cred);
}
kernel-src/sys/syscalls/execve.c
+4
View File
@@ -177,6 +177,10 @@ static syscallret_t execve(context_t *context, char *upath, char *uargv[], char
if (ret.errno)
goto error;
ret.errno = VOP_ACCESS(node, V_ACCESS_EXECUTE, &_cpu()->thread->proc->cred);
if (ret.errno)
goto error;
size_t readcount;
ret.errno = vfs_read(node, shebang, SHEBANG_SIZE - 1, 0, &readcount, 0);
if (ret.errno)
kernel-src/sys/syscalls/fchownat.c
+8 -1
View File
@@ -1,6 +1,7 @@
#include <kernel/syscalls.h>
#include <kernel/alloc.h>
#include <kernel/vfs.h>
#include <kernel/auth.h>
syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid_t group, int flags) {
syscallret_t ret = {
@@ -48,15 +49,21 @@ syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid
goto cleanup;
}
ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
if (ret.errno)
goto cleanup;
vattr_t attr;
ret.errno = VOP_GETATTR(node, &attr, &_cpu()->thread->proc->cred);
if (ret.errno)
goto cleanup;
// TODO retain set uid and set gid bits if an auth access was ok
attr.uid = owner;
attr.gid = group;
attr.mode = (attr.mode) & ~(V_ATTR_MODE_SGID | V_ATTR_MODE_SUID);
ret.errno = VOP_SETATTR(node, &attr, V_ATTR_UID | V_ATTR_GID, &_cpu()->thread->proc->cred);
ret.errno = VOP_SETATTR(node, &attr, ((owner == -1) ? 0 : V_ATTR_UID) | ((group == -1) ? 0 : V_ATTR_GID), &_cpu()->thread->proc->cred);
ret.ret = ret.errno ? -1 : 0;
cleanup:
kernel-src/sys/syscalls/mkdirat.c
+2 -2
View File
@@ -35,8 +35,8 @@ syscallret_t syscall_mkdirat(context_t *, int dirfd, char *upath, mode_t mode) {
vattr_t attr = {
.mode = UMASK(mode),
.gid = _cpu()->thread->proc->cred.gid,
.uid = _cpu()->thread->proc->cred.uid
.gid = _cpu()->thread->proc->cred.egid,
.uid = _cpu()->thread->proc->cred.euid
};
ret.errno = vfs_create(dirnode, path, &attr, V_TYPE_DIR, NULL);
kernel-src/sys/syscalls/mknodat.c
+2 -2
View File
@@ -38,8 +38,8 @@ syscallret_t syscall_mknodat(context_t *, int dirfd, char *upath, mode_t mode, d
vattr_t attr = {
.mode = UMASK(mode),
.gid = _cpu()->thread->proc->cred.gid,
.uid = _cpu()->thread->proc->cred.uid,
.gid = _cpu()->thread->proc->cred.egid,
.uid = _cpu()->thread->proc->cred.euid,
.rdevmajor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MAJORDEV(dev) : 0,
.rdevminor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MINORDEV(dev) : 0,
};
kernel-src/sys/syscalls/open.c
+3 -2
View File
@@ -4,6 +4,7 @@
#include <kernel/alloc.h>
#include <errno.h>
#include <logging.h>
#include <kernel/auth.h>
syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags, mode_t mode) {
syscallret_t ret = {
@@ -54,8 +55,8 @@ syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags
if (ret.errno == ENOENT && (flags & O_CREAT)) {
vattr_t attr = {
.mode = UMASK(mode),
.gid = _cpu()->thread->proc->cred.gid,
.uid = _cpu()->thread->proc->cred.uid
.gid = _cpu()->thread->proc->cred.egid,
.uid = _cpu()->thread->proc->cred.euid
};
ret.errno = vfs_create(dirnode, pathbuf, &attr, V_TYPE_REGULAR, &vnode);
kernel-src/sys/syscalls/sync.c
+1
View File
@@ -21,5 +21,6 @@ syscallret_t syscall_fsync(context_t *context, int fd) {
ret.errno = VOP_SYNC(file->vnode);
fd_release(file);
ret.ret = ret.errno ? -1 : 0;
return ret;
}