auth: initial implementation + some filesystem checks

kernel-src/arch/x86-64/main.c

@@ -38,6 +38,7 @@
 #include <kernel/tty.h>
 #include <kernel/pty.h>
 #include <kernel/vmmcache.h>
+#include <kernel/defaultauth.h>
 
 static cpu_t bsp_cpu;
 
@@ -119,6 +120,7 @@ void kernel_entry() {
 	if (cmdline_get("initrd"))
 		initrd_unpack();
 
+	defaultauth_init();
 	sched_runinit();
 	sched_threadexit();
 }

kernel-src/fs/devfs.c

@@ -8,6 +8,7 @@
 #include <kernel/timekeeper.h>
 #include <kernel/pmm.h>
 #include <kernel/vmmcache.h>
+#include <kernel/auth.h>
 
 static devnode_t *devfsroot;
 
@@ -188,9 +189,8 @@ int devfs_munmap(vnode_t *node, void *addr, uintmax_t offset, int flags, cred_t
 	return devnode->devops->munmap(devnode->attr.rdevminor, addr, offset, flags);
 }
 
-int devfs_access(vnode_t *node, mode_t mode, cred_t *cred) {
+int devfs_access(vnode_t *vnode, mode_t mode, cred_t *cred) {
-	// TODO permission checks
+	return auth_filesystem_check(cred, auth_filesystem_convertaccess(mode), vnode) ? EACCES : 0;
-	return 0;
 }
 
 int devfs_isatty(vnode_t *node) {

kernel-src/fs/ext2.c

@@ -11,6 +11,7 @@
 #include <util.h>
 #include <kernel/vmmcache.h>
 #include <kernel/pipefs.h>
+#include <kernel/auth.h>
 
 #define INODE_ROOT 2
 
@@ -1246,8 +1247,7 @@ static int ext2_getdents(vnode_t *vnode, dent_t *buffer, size_t count, uintmax_t
 }
 
 static int ext2_access(vnode_t *vnode, mode_t mode, cred_t *cred) {
-	// TODO permission checks
+	return auth_filesystem_check(cred, auth_filesystem_convertaccess(mode), vnode) ? EACCES : 0;
-	return 0;
 }
 
 static int ext2_readlink(vnode_t *vnode, char **link, cred_t *cred) {

kernel-src/fs/tmpfs.c

@@ -14,6 +14,7 @@
 #include <string.h>
 #include <kernel/vmmcache.h>
 #include <kernel/pipefs.h>
+#include <kernel/auth.h>
 
 static scache_t *nodecache;
 static tmpfsnode_t *newnode(vfs_t *vfs, int type);
@@ -234,9 +235,8 @@ static int tmpfs_write(vnode_t *node, void *buffer, size_t size, uintmax_t offse
 	__assert(!"tmpfs_read is handled by the page cache");
 }
 
-static int tmpfs_access(vnode_t *node, mode_t mode, cred_t *cred) {
+static int tmpfs_access(vnode_t *vnode, mode_t mode, cred_t *cred) {
-	// TODO permission checks
+	return auth_filesystem_check(cred, auth_filesystem_convertaccess(mode), vnode) ? EACCES : 0;
-	return 0;
 }
 
 static int tmpfs_unlink(vnode_t *node, char *name, cred_t *cred) {

kernel-src/fs/vfs.c

@@ -10,6 +10,7 @@
 #include <kernel/vmmcache.h>
 #include <kernel/block.h>
 #include <kernel/pipefs.h>
+#include <kernel/auth.h>
 
 #define PATHNAME_MAX 512
 #define MAXLINKDEPTH 64
@@ -20,14 +21,9 @@ vnode_t *vfsroot;
 static spinlock_t listlock;
 static vfs_t *vfslist;
 
-static cred_t kernelcred = {
-	.gid = 0,
-	.uid = 0
-};
-
 static cred_t *getcred() {
 	if (_cpu()->thread == NULL || _cpu()->thread->proc == NULL)
-		return &kernelcred;
+		return NULL;
 	else
 		return &_cpu()->thread->proc->cred;
 }
@@ -111,6 +107,10 @@ int vfs_open(vnode_t *ref, char *path, int flags, vnode_t **res) {
 	if (err)
 		return err;
 
+	err = VOP_ACCESS(tmp, ((flags & V_FFLAGS_READ) ? V_ACCESS_READ : 0) | ((flags & V_FFLAGS_WRITE) ? V_ACCESS_WRITE : 0), getcred());
+	if (err)
+		return err;
+
 	err = VOP_OPEN(&tmp, flags, getcred());
 	if (err) {
 		VOP_RELEASE(tmp);
@@ -189,6 +189,7 @@ int vfs_write(vnode_t *node, void *buffer, size_t size, uintmax_t offset, size_t
 		}
 
 		MUTEX_ACQUIRE(&node->sizelock, false);
+
 		vattr_t attr;
 		err = VOP_GETATTR(node, &attr, getcred());
 		if (err)

kernel-src/include/kernel/auth.h

@@ -0,0 +1,52 @@
+#ifndef _AUTH_H
+#define _AUTH_H
+
+#include <kernel/cred.h>
+#include <kernel/vfs.h>
+
+#define AUTH_SCOPE_COUNT 2
+#define AUTH_SCOPE_SYSTEM 0
+#define AUTH_SCOPE_FILESYSTEM 1
+
+#define AUTH_LISTENER_LIMIT 8
+
+#define AUTH_DECISION_ALLOW 1
+#define AUTH_DECISION_DEFER 0
+#define AUTH_DECISION_DENY -1000
+
+#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
+#define AUTH_ACTIONS_FILESYSTEM_READ 	4
+#define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
+#define AUTH_ACTIONS_FILESYSTEM_EXECUTE 1
+
+typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
+
+typedef struct {
+	authlistener_t listeners[AUTH_LISTENER_LIMIT];
+} authscope_t;
+
+void auth_registerlistener(int scope, authlistener_t listener);
+int auth_check(int scope, cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
+
+static inline int auth_filesystem_check(cred_t *cred, int actions, vnode_t *vnode) {
+	return auth_check(AUTH_SCOPE_FILESYSTEM, cred, actions, vnode, NULL, NULL);
+}
+
+static inline int auth_system_check(cred_t *cred, int actions) {
+	return auth_check(AUTH_SCOPE_SYSTEM, cred, actions, NULL, NULL, NULL);
+}
+
+static inline int auth_filesystem_convertaccess(int access) {
+	int r = 0;
+
+	if (access & V_ACCESS_EXECUTE)
+		r |= AUTH_ACTIONS_FILESYSTEM_EXECUTE;
+	if (access & V_ACCESS_WRITE)
+		r |= AUTH_ACTIONS_FILESYSTEM_WRITE;
+	if (access & V_ACCESS_READ)
+		r |= AUTH_ACTIONS_FILESYSTEM_READ;
+
+	return r;
+}
+
+#endif

kernel-src/include/kernel/cred.h

@@ -1,18 +1,18 @@
 #ifndef _CRED_H
 #define _CRED_H
 
-#define CRED_PERM_SUPERUSER (1l << 63)
-
 #include <stdint.h>
 
 typedef struct {
 	int uid, euid, suid;
 	int gid, egid, sgid;
-
-	uintmax_t allow;
-	uintmax_t deny;
 } cred_t;
 
+#define CRED_SUPERUSER 0
+#define CRED_IS_SU(cred) ((cred)->uid == CRED_SUPERUSER)
+#define CRED_IS_ESU(cred) ((cred)->euid == CRED_SUPERUSER)
+#define CRED_IS_SSU(cred) ((cred)->suid == CRED_SUPERUSER)
+
 int cred_setuids(cred_t *cred, int uid, int euid, int suid);
 int cred_setgids(cred_t *cred, int uid, int euid, int suid);
 void cred_getuids(cred_t *cred, int *uidp, int *euidp, int *suidp);

kernel-src/include/kernel/defaultauth.h

@@ -0,0 +1,6 @@
+#ifndef _DEFAULTAUTH_H
+#define _DEFAULTAUTH_H
+
+void defaultauth_init();
+
+#endif

kernel-src/include/kernel/vfs.h

@@ -19,6 +19,29 @@
 
 #define V_ATTR_ALL (V_ATTR_MODE | V_ATTR_UID | V_ATTR_GID | V_ATTR_ATIME | V_ATTR_MTIME | V_ATTR_CTIME)
 
+#define V_ATTR_MODE_OTHERS_EXECUTE 	00001
+#define V_ATTR_MODE_OTHERS_SEARCH 	V_ATTR_MODE_OTHERS_EXECUTE
+#define V_ATTR_MODE_OTHERS_WRITE 	00002
+#define V_ATTR_MODE_OTHERS_READ 	00004
+#define V_ATTR_MODE_OTHERS_ALL		00007
+#define V_ATTR_MODE_GROUP_EXECUTE 	00010
+#define V_ATTR_MODE_GROUP_SEARCH 	V_ATTR_MODE_GROUP_EXECUTE
+#define V_ATTR_MODE_GROUP_WRITE 	00020
+#define V_ATTR_MODE_GROUP_READ 		00040
+#define V_ATTR_MODE_GROUP_ALL		00070
+#define V_ATTR_MODE_USER_EXECUTE 	00100
+#define V_ATTR_MODE_USER_SEARCH 	V_ATTR_MODE_USER_EXECUTE
+#define V_ATTR_MODE_USER_WRITE 		00200
+#define V_ATTR_MODE_USER_READ 		00400
+#define V_ATTR_MODE_USER_ALL		00700
+#define V_ATTR_MODE_STICKY 		01000
+#define V_ATTR_MODE_SGID 		02000
+#define V_ATTR_MODE_SUID 		04000
+
+#define V_ACCESS_EXECUTE 1
+#define V_ACCESS_WRITE 2
+#define V_ACCESS_READ 4
+
 typedef struct {
 	int type;
 	mode_t mode;

kernel-src/sys/auth.c

@@ -0,0 +1,36 @@
+#include <kernel/auth.h>
+
+static authscope_t scopes[AUTH_SCOPE_COUNT];
+
+void auth_registerlistener(int _scope, authlistener_t listener) {
+	authscope_t *scope = &scopes[_scope];
+	for (int i = 0; i < AUTH_LISTENER_LIMIT; ++i) {
+		if (scope->listeners[i])
+			continue;
+
+		scope->listeners[i] = listener;
+		break;
+	}
+}
+
+int auth_check(int _scope, cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
+	if (cred == NULL || actions == 0)
+		return 0;
+
+	authscope_t *scope = &scopes[_scope];
+
+	int allow = 0;
+	for (int i = 0; i < AUTH_LISTENER_LIMIT; ++i) {
+		authlistener_t listener = scope->listeners[i];
+		if (listener == NULL)
+			continue;
+
+		int decision = listener(cred, actions, arg0, arg1, arg2);
+		if (decision == AUTH_DECISION_DENY)
+			return EPERM;
+
+		allow += decision;
+	}
+
+	return allow ? 0 : EPERM;
+}

kernel-src/sys/cred.c

@@ -7,9 +7,9 @@ int cred_setuids(cred_t *cred, int uid, int euid, int suid) {
 
 	// TODO do permission check to see if its possible
 
-	cred->uid = uid;
+	cred->uid = (uid == -1) ? cred->uid : uid;
-	cred->euid = euid;
+	cred->euid = (euid == -1) ? cred->euid : euid;
-	cred->suid = suid;
+	cred->suid = (suid == -1) ? cred->suid : suid;
 
 	return 0;
 }
@@ -20,9 +20,9 @@ int cred_setgids(cred_t *cred, int gid, int egid, int sgid) {
 
 	// TODO do permission check to see if its possible
 
-	cred->gid = gid;
+	cred->gid = (gid == -1) ? cred->gid : gid;
-	cred->egid = egid;
+	cred->egid = (egid == -1) ? cred->egid : egid;
-	cred->sgid = sgid;
+	cred->sgid = (sgid == -1) ? cred->sgid : sgid;
 
 	return 0;
 }

kernel-src/sys/defaultauth.c

@@ -0,0 +1,78 @@
+#include <kernel/auth.h>
+#include <logging.h>
+
+// default listeners for auth
+
+#define DONE_CHECK(a) {\
+		if ((a) == 0) \
+			goto done; \
+	}
+
+static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
+	vnode_t *vnode = arg0;
+
+	vattr_t attr;
+	VOP_GETATTR(vnode, &attr, NULL);
+
+	int weight = 0;
+	if (actions & AUTH_ACTIONS_FILESYSTEM_WRITE) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_WRITE))
+			weight += 1;
+		else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_WRITE))
+			weight += 1;
+		else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_WRITE))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
+	if (actions & AUTH_ACTIONS_FILESYSTEM_READ) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_READ))
+			weight += 1;
+		else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_READ))
+			weight += 1;
+		else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_READ))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
+	if (actions & AUTH_ACTIONS_FILESYSTEM_EXECUTE) {
+		if ((attr.mode & (V_ATTR_MODE_USER_EXECUTE | V_ATTR_MODE_GROUP_EXECUTE | V_ATTR_MODE_OTHERS_EXECUTE)) && CRED_IS_ESU(cred))
+			weight += 1;
+		else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_EXECUTE))
+			weight += 1;
+		else if (attr.uid != cred->euid && attr.gid == cred->egid && (attr.mode & V_ATTR_MODE_GROUP_EXECUTE))
+			weight += 1;
+		else if (attr.uid != cred->euid && attr.gid != cred->egid && (attr.mode & V_ATTR_MODE_OTHERS_EXECUTE))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
+	if (actions & AUTH_ACTIONS_FILESYSTEM_SETATTR) {
+		if (CRED_IS_ESU(cred) || cred->euid == attr.uid)
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
+	done:
+	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
+}
+
+void defaultauth_init() {
+	auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem);
+}

kernel-src/sys/syscalls/chmod.c

@@ -3,15 +3,21 @@
 #include <kernel/file.h>
 #include <kernel/vfs.h>
 #include <arch/cpu.h>
+#include <kernel/auth.h>
 
 static int dochmod(vnode_t *node, mode_t mode) {
 	vattr_t attr;
 	cred_t *cred = &_cpu()->thread->proc->cred;
-	int e = VOP_GETATTR(node, &attr, cred);
+
+	int e = auth_filesystem_check(cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
 	if (e)
 		return e;
 
-	attr.mode = UMASK(mode);
+	e = VOP_GETATTR(node, &attr, cred);
+	if (e)
+		return e;
+
+	attr.mode = mode;
 
 	return VOP_SETATTR(node, &attr, V_ATTR_MODE, cred);
 }

kernel-src/sys/syscalls/execve.c

@@ -177,6 +177,10 @@ static syscallret_t execve(context_t *context, char *upath, char *uargv[], char
 	if (ret.errno)
 		goto error;
 
+	ret.errno = VOP_ACCESS(node, V_ACCESS_EXECUTE, &_cpu()->thread->proc->cred);
+	if (ret.errno)
+		goto error;
+
 	size_t readcount;
 	ret.errno = vfs_read(node, shebang, SHEBANG_SIZE - 1, 0, &readcount, 0);
 	if (ret.errno)

kernel-src/sys/syscalls/fchownat.c

@@ -1,6 +1,7 @@
 #include <kernel/syscalls.h>
 #include <kernel/alloc.h>
 #include <kernel/vfs.h>
+#include <kernel/auth.h>
 
 syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid_t group, int flags) {
 	syscallret_t ret = {
@@ -48,15 +49,21 @@ syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid
 			goto cleanup;
 	}
 
+	ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
+	if (ret.errno)
+		goto cleanup;
+
 	vattr_t attr;
 	ret.errno = VOP_GETATTR(node, &attr, &_cpu()->thread->proc->cred);
 	if (ret.errno)
 		goto cleanup;
 
+	// TODO retain set uid and set gid bits if an auth access was ok
 	attr.uid = owner;
 	attr.gid = group;
+	attr.mode = (attr.mode) & ~(V_ATTR_MODE_SGID | V_ATTR_MODE_SUID);
 
-	ret.errno = VOP_SETATTR(node, &attr, V_ATTR_UID | V_ATTR_GID, &_cpu()->thread->proc->cred);
+	ret.errno = VOP_SETATTR(node, &attr, ((owner == -1) ? 0 : V_ATTR_UID) | ((group == -1) ? 0 : V_ATTR_GID), &_cpu()->thread->proc->cred);
 	ret.ret = ret.errno ? -1 : 0;
 
 	cleanup:

kernel-src/sys/syscalls/mkdirat.c

@@ -35,8 +35,8 @@ syscallret_t syscall_mkdirat(context_t *, int dirfd, char *upath, mode_t mode) {
 
 	vattr_t attr = {
 		.mode = UMASK(mode),
-		.gid = _cpu()->thread->proc->cred.gid,
+		.gid = _cpu()->thread->proc->cred.egid,
-		.uid = _cpu()->thread->proc->cred.uid
+		.uid = _cpu()->thread->proc->cred.euid
 	};
 
 	ret.errno = vfs_create(dirnode, path, &attr, V_TYPE_DIR, NULL);

kernel-src/sys/syscalls/mknodat.c

@@ -38,8 +38,8 @@ syscallret_t syscall_mknodat(context_t *, int dirfd, char *upath, mode_t mode, d
 
 	vattr_t attr = {
 		.mode = UMASK(mode),
-		.gid = _cpu()->thread->proc->cred.gid,
+		.gid = _cpu()->thread->proc->cred.egid,
-		.uid = _cpu()->thread->proc->cred.uid,
+		.uid = _cpu()->thread->proc->cred.euid,
 		.rdevmajor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MAJORDEV(dev) : 0,
 		.rdevminor = (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) ? MINORDEV(dev) : 0,
 	};

kernel-src/sys/syscalls/open.c

@@ -4,6 +4,7 @@
 #include <kernel/alloc.h>
 #include <errno.h>
 #include <logging.h>
+#include <kernel/auth.h>
 
 syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags, mode_t mode) {
 	syscallret_t ret = {
@@ -54,8 +55,8 @@ syscallret_t syscall_openat(context_t *context, int dirfd, char *path, int flags
 	if (ret.errno == ENOENT && (flags & O_CREAT)) {
 		vattr_t attr = {
 			.mode = UMASK(mode),
-			.gid = _cpu()->thread->proc->cred.gid,
+			.gid = _cpu()->thread->proc->cred.egid,
-			.uid = _cpu()->thread->proc->cred.uid
+			.uid = _cpu()->thread->proc->cred.euid
 		};
 
 		ret.errno = vfs_create(dirnode, pathbuf, &attr, V_TYPE_REGULAR, &vnode);

kernel-src/sys/syscalls/sync.c

@@ -21,5 +21,6 @@ syscallret_t syscall_fsync(context_t *context, int fd) {
 	ret.errno = VOP_SYNC(file->vnode);
 
 	fd_release(file);
+	ret.ret = ret.errno ? -1 : 0;
 	return ret;
 }