From 84c47f07c91bb5b6651c8709cb7cb8b7e02ec10a Mon Sep 17 00:00:00 2001 From: Matheus Date: Mon, 26 Aug 2024 17:45:05 -0300 Subject: [PATCH] auth: signals --- kernel-src/include/kernel/auth.h | 10 +++++++++- kernel-src/io/net/tcp.c | 2 +- kernel-src/sys/defaultauth.c | 26 ++++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 2 deletions(-) diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h index bd6ad4e4..196d6cfd 100644 --- a/kernel-src/include/kernel/auth.h +++ b/kernel-src/include/kernel/auth.h @@ -3,11 +3,13 @@ #include #include +#include -#define AUTH_SCOPE_COUNT 3 +#define AUTH_SCOPE_COUNT 4 #define AUTH_SCOPE_SYSTEM 0 #define AUTH_SCOPE_FILESYSTEM 1 #define AUTH_SCOPE_CRED 2 +#define AUTH_SCOPE_PROCESS 3 #define AUTH_LISTENER_LIMIT 8 @@ -31,6 +33,8 @@ #define AUTH_ACTIONS_CRED_SETEUID 16 #define AUTH_ACTIONS_CRED_SETEGID 32 +#define AUTH_ACTIONS_PROCESS_SIGNAL 1 + typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2); typedef struct { @@ -52,6 +56,10 @@ static inline int auth_cred_check(cred_t *cred, int actions, int id, int eid, in return auth_check(AUTH_SCOPE_CRED, cred, actions, &id, &eid, &sid); } +static inline int auth_process_check(cred_t *cred, int actions, proc_t *proc) { + return auth_check(AUTH_SCOPE_PROCESS, cred, actions, proc, NULL, NULL); +} + static inline int auth_filesystem_convertaccess(int access) { int r = 0; diff --git a/kernel-src/io/net/tcp.c b/kernel-src/io/net/tcp.c index ca04670d..952f94d2 100644 --- a/kernel-src/io/net/tcp.c +++ b/kernel-src/io/net/tcp.c @@ -1450,7 +1450,7 @@ static int tcp_bind(socket_t *socket, sockaddr_t *addr) { return error; } -static int tcp_connect(socket_t *socket, sockaddr_t *addr, uintmax_t flags) { +static int tcp_connect(socket_t *socket, sockaddr_t *addr, uintmax_t flags, cred_t *cred) { tcpsocket_t *tcpsocket = (tcpsocket_t *)socket; size_t mtu = ipv4_getmtu(addr->ipv4addr.addr); diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c index ed314cc4..4a8ab2fd 100644 --- a/kernel-src/sys/defaultauth.c +++ b/kernel-src/sys/defaultauth.c @@ -197,8 +197,34 @@ static int credlistener(cred_t *cred, int actions, void *arg0, void *arg1, void return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER; } +static int process(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) { + proc_t *proc = arg0; + int *signal = arg1; + + int weight = 0; + if (actions & AUTH_ACTIONS_PROCESS_SIGNAL) { + if (CRED_IS_ESU(cred)) + weight += 1; + else if (cred->uid == proc->cred.uid || + cred->uid == proc->cred.suid || + cred->euid == proc->cred.uid || + cred->euid == proc->cred.suid) + weight += 1; + else if (*signal == SIGCONT) { + // TODO SIGCONT is supposed to work on the same process group; we are being a bit more permissive here for now + weight += 1; + } + + DONE_CHECK(actions); + } + + done: + return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER; +} + void defaultauth_init() { auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem); auth_registerlistener(AUTH_SCOPE_SYSTEM, system); auth_registerlistener(AUTH_SCOPE_CRED, credlistener); + auth_registerlistener(AUTH_SCOPE_PROCESS, process); }