mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-27 20:58:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: signals

Browse Source
This commit is contained in:
Matheus
2024-08-26 17:45:05 -03:00
parent fdcda428f9
commit 84c47f07c9
3 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/include/kernel/auth.h
+9 -1
View File
@@ -3,11 +3,13 @@
#include <kernel/cred.h>
#include <kernel/vfs.h>
#include <kernel/scheduler.h>
#define AUTH_SCOPE_COUNT 3
#define AUTH_SCOPE_COUNT 4
#define AUTH_SCOPE_SYSTEM 0
#define AUTH_SCOPE_FILESYSTEM 1
#define AUTH_SCOPE_CRED 2
#define AUTH_SCOPE_PROCESS 3
#define AUTH_LISTENER_LIMIT 8
@@ -31,6 +33,8 @@
#define AUTH_ACTIONS_CRED_SETEUID 16
#define AUTH_ACTIONS_CRED_SETEGID 32
#define AUTH_ACTIONS_PROCESS_SIGNAL 1
typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
typedef struct {
@@ -52,6 +56,10 @@ static inline int auth_cred_check(cred_t *cred, int actions, int id, int eid, in
return auth_check(AUTH_SCOPE_CRED, cred, actions, &id, &eid, &sid);
}
static inline int auth_process_check(cred_t *cred, int actions, proc_t *proc) {
return auth_check(AUTH_SCOPE_PROCESS, cred, actions, proc, NULL, NULL);
}
static inline int auth_filesystem_convertaccess(int access) {
int r = 0;
kernel-src/io/net/tcp.c
+1 -1
View File
@@ -1450,7 +1450,7 @@ static int tcp_bind(socket_t *socket, sockaddr_t *addr) {
return error;
}
static int tcp_connect(socket_t *socket, sockaddr_t *addr, uintmax_t flags) {
static int tcp_connect(socket_t *socket, sockaddr_t *addr, uintmax_t flags, cred_t *cred) {
tcpsocket_t *tcpsocket = (tcpsocket_t *)socket;
size_t mtu = ipv4_getmtu(addr->ipv4addr.addr);
kernel-src/sys/defaultauth.c
+26
View File
@@ -197,8 +197,34 @@ static int credlistener(cred_t *cred, int actions, void *arg0, void *arg1, void
return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
}
static int process(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
proc_t *proc = arg0;
int *signal = arg1;
int weight = 0;
if (actions & AUTH_ACTIONS_PROCESS_SIGNAL) {
if (CRED_IS_ESU(cred))
weight += 1;
else if (cred->uid == proc->cred.uid ||
cred->uid == proc->cred.suid ||
cred->euid == proc->cred.uid ||
cred->euid == proc->cred.suid)
weight += 1;
else if (*signal == SIGCONT) {
// TODO SIGCONT is supposed to work on the same process group; we are being a bit more permissive here for now
weight += 1;
}
DONE_CHECK(actions);
}
done:
return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
}
void defaultauth_init() {
auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem);
auth_registerlistener(AUTH_SCOPE_SYSTEM, system);
auth_registerlistener(AUTH_SCOPE_CRED, credlistener);
auth_registerlistener(AUTH_SCOPE_PROCESS, process);
}