mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-28 13:18:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: filesystem unlink action check + add parent vnode to auth_filesystem_check

Browse Source
This commit is contained in:
Matheus
2024-08-27 21:46:33 -03:00
parent 284d91f6e7
commit ba6506b9d7
9 changed files with 55 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/sys/defaultauth.c
+40
View File
@@ -10,10 +10,15 @@
static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
vnode_t *vnode = arg0; // expected locked
vnode_t *dirvnode = arg1; // expected locked
vattr_t attr;
VOP_GETATTR(vnode, &attr, NULL);
vattr_t dirattr;
if (dirvnode)
VOP_GETATTR(dirvnode, &dirattr, NULL);
int weight = 0;
if (actions & AUTH_ACTIONS_FILESYSTEM_WRITE) {
if (CRED_IS_ESU(cred))
@@ -77,8 +82,43 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
weight += 1;
else
return AUTH_DECISION_DENY;
DONE_CHECK(actions);
}
if (actions & AUTH_ACTIONS_FILESYSTEM_UNLINK) {
__assert(dirvnode);
bool dosticky = false;
if (CRED_IS_ESU(cred)) {
dosticky = false;
weight += 1;
} else if (dirattr.uid == cred->euid && (dirattr.mode & V_ATTR_MODE_USER_WRITE)) {
dosticky = true;
} else if (dirattr.uid != cred->euid && dirattr.gid == cred->egid && (dirattr.mode & V_ATTR_MODE_GROUP_WRITE)) {
dosticky = true;
} else if (dirattr.uid != cred->euid && dirattr.gid != cred->egid && (dirattr.mode & V_ATTR_MODE_OTHERS_WRITE)) {
dosticky = true;
} else {
return AUTH_DECISION_DENY;
}
if (dosticky && (dirattr.mode & V_ATTR_MODE_STICKY)) {
// sticky directory, file can only be unlinked if:
// - user requesting deletion is root (already checked for)
// OR
// - user requesting deletion has write access (already checked for) AND
// - effective user requesting deletion is owner of directory
// OR
// - effective user requesting deletion is owner of file
if (dirattr.uid == cred->euid || attr.uid == cred->euid)
weight += 1;
else
return AUTH_DECISION_DENY;
}
DONE_CHECK(actions);
}
done:
return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
kernel-src/sys/syscalls/chmod.c
+1 -1
View File
@@ -10,7 +10,7 @@ static int dochmod(vnode_t *node, mode_t mode) {
vattr_t attr;
cred_t *cred = &_cpu()->thread->proc->cred;
int e = auth_filesystem_check(cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
int e = auth_filesystem_check(cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node, NULL);
if (e)
return e;
kernel-src/sys/syscalls/fchownat.c
+1 -1
View File
@@ -50,7 +50,7 @@ syscallret_t syscall_fchownat(context_t *, int fd, char *upath, uid_t owner, gid
goto cleanup;
}
ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node, NULL);
if (ret.errno) {
VOP_UNLOCK(node);
goto cleanup;
kernel-src/sys/syscalls/utime.c
+1 -1
View File
@@ -71,7 +71,7 @@ syscallret_t syscall_utimensat(context_t *, int fd, char *upath, timespec_t uts[
attr.atime = ts[0];
attr.mtime = ts[1];
ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node);
ret.errno = auth_filesystem_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_FILESYSTEM_SETATTR, node, NULL);
if (ret.errno) {
if (uts == NULL)
ret.errno = VOP_ACCESS(node, V_ACCESS_WRITE, &_cpu()->thread->proc->cred);