auth: initial implementation + some filesystem checks

kernel-src/sys/syscalls/chmod.c

@@ -3,15 +3,21 @@
 #include <kernel/file.h>
 #include <kernel/vfs.h>
 #include <arch/cpu.h>
+#include <kernel/auth.h>
 
 static int dochmod(vnode_t *node, mode_t mode) {
 	vattr_t attr;
 	cred_t *cred = &_cpu()->thread->proc->cred;
-	int e = VOP_GETATTR(node, &attr, cred);
+
+	int e = auth_filesystem_check(cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
 	if (e)
 		return e;
 
-	attr.mode = UMASK(mode);
+	e = VOP_GETATTR(node, &attr, cred);
+	if (e)
+		return e;
+
+	attr.mode = mode;
 
 	return VOP_SETATTR(node, &attr, V_ATTR_MODE, cred);
 }

kernel-src/sys/syscalls/execve.c

@@ -177,6 +177,10 @@ static syscallret_t execve(context_t *context, char *upath, char *uargv[], char
 	if (ret.errno)
 		goto error;
 
+	ret.errno = VOP_ACCESS(node, V_ACCESS_EXECUTE, &_cpu()->thread->proc->cred);
+	if (ret.errno)
+		goto error;
+
 	size_t readcount;
 	ret.errno = vfs_read(node, shebang, SHEBANG_SIZE - 1, 0, &readcount, 0);
 	if (ret.errno)

kernel-src/sys/syscalls/fchownat.c

@@ -1,6 +1,7 @@
 #include <kernel/syscalls.h>
 #include <kernel/alloc.h>
 #include <kernel/vfs.h>
+#include <kernel/auth.h>
 
 syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid_t group, int flags) {
 	syscallret_t ret = {
@@ -48,15 +49,21 @@ syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid
 			goto cleanup;
 	}
 
+	ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
+	if (ret.errno)
+		goto cleanup;
+
 	vattr_t attr;
 	ret.errno = VOP_GETATTR(node, &attr, &_cpu()->thread->proc->cred);
 	if (ret.errno)
 		goto cleanup;
 
+	// TODO retain set uid and set gid bits if an auth access was ok
 	attr.uid = owner;
 	attr.gid = group;
+	attr.mode = (attr.mode) & ~(V_ATTR_MODE_SGID | V_ATTR_MODE_SUID);
 
-	ret.errno = VOP_SETATTR(node, &attr, V_ATTR_UID | V_ATTR_GID, &_cpu()->thread->proc->cred);
+	ret.errno = VOP_SETATTR(node, &attr, ((owner == -1) ? 0 : V_ATTR_UID) | ((group == -1) ? 0 : V_ATTR_GID), &_cpu()->thread->proc->cred);
 	ret.ret = ret.errno ? -1 : 0;
 
 	cleanup:

kernel-src/sys/syscalls/mkdirat.c

@@ -35,8 +35,8 @@ syscallret_t syscall_mkdirat(context_t *, int dirfd, char *upath, mode_t mode) {
 
 	vattr_t attr = {
 		.mode = UMASK(mode),
-		.gid = _cpu()->thread->proc->cred.gid,
-		.uid = _cpu()->thread->proc->cred.uid
+		.gid = _cpu()->thread->proc->cred.egid,
+		.uid = _cpu()->thread->proc->cred.euid
 	};
 
 	ret.errno = vfs_create(dirnode, path, &attr, V_TYPE_DIR, NULL);

kernel-src/sys/syscalls/mknodat.c

@@ -38,8 +38,8 @@ syscallret_t syscall_mknodat(context_t *, int dirfd, char *upath, mode_t mode, d
 
 	vattr_t attr = {
 		.mode = UMASK(mode),
-		.gid = _cpu()->thread->proc->cred.gid,
-		.uid = _cpu()->thread->proc->cred.uid,
+		.gid = _cpu()->thread->proc->cred.egid,
+		.uid = _cpu()->thread->proc->cred.euid,
 		.rdevmajor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MAJORDEV(dev) : 0,
 		.rdevminor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MINORDEV(dev) : 0,
 	};

kernel-src/sys/syscalls/open.c

@@ -4,6 +4,7 @@
 #include <kernel/alloc.h>
 #include <errno.h>
 #include <logging.h>
+#include <kernel/auth.h>
 
 syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags, mode_t mode) {
 	syscallret_t ret = {
@@ -54,8 +55,8 @@ syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags
 	if (ret.errno == ENOENT && (flags & O_CREAT)) {
 		vattr_t attr = {
 			.mode = UMASK(mode),
-			.gid = _cpu()->thread->proc->cred.gid,
-			.uid = _cpu()->thread->proc->cred.uid
+			.gid = _cpu()->thread->proc->cred.egid,
+			.uid = _cpu()->thread->proc->cred.euid
 		};
 
 		ret.errno = vfs_create(dirnode, pathbuf, &attr, V_TYPE_REGULAR, &vnode);

kernel-src/sys/syscalls/sync.c

@@ -21,5 +21,6 @@ syscallret_t syscall_fsync(context_t *context, int fd) {
 	ret.errno = VOP_SYNC(file->vnode);
 
 	fd_release(file);
+	ret.ret = ret.errno ? -1 : 0;
 	return ret;
 }