mknodat: add auth check for device nodes

kernel-src/fs/vfs.c

@@ -337,6 +337,12 @@ int vfs_create(vnode_t *ref, char *path, vattr_t *attr, int type, vnode_t **node
 		goto cleanup_parent;
 	}
 
+	if (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) {
+		err = auth_filesystem_check(getcred(), AUTH_ACTIONS_FILESYSTEM_MKNOD, parent, NULL);
+		if (err)
+			goto cleanup_parent;
+	}
+
 	vnode_t *ret;
 	err = VOP_CREATE(parent, component, attr, type, &ret, getcred());
 	if (err)

kernel-src/include/kernel/auth.h

@@ -29,6 +29,7 @@
 #define AUTH_ACTIONS_FILESYSTEM_MOUNT 	16
 #define AUTH_ACTIONS_FILESYSTEM_UNLINK	32
 #define AUTH_ACTIONS_FILESYSTEM_RENAME	64
+#define AUTH_ACTIONS_FILESYSTEM_MKNOD	128
 
 #define AUTH_ACTIONS_CRED_SETRESUID	1
 #define AUTH_ACTIONS_CRED_SETRESGID	2

kernel-src/sys/defaultauth.c

@@ -94,6 +94,15 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
 		DONE_CHECK(actions);
 	}
 
+	if (actions & AUTH_ACTIONS_FILESYSTEM_MKNOD) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
 	if (actions & (AUTH_ACTIONS_FILESYSTEM_UNLINK | AUTH_ACTIONS_FILESYSTEM_RENAME)) {
 		__assert(dirvnode);