mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-27 20:58:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: filesystem unlink action check + add parent vnode to auth_filesystem_check

Browse Source
This commit is contained in:
Matheus
2024-08-27 21:46:33 -03:00
parent 284d91f6e7
commit ba6506b9d7
9 changed files with 55 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/sys/defaultauth.c
+40
View File
@@ -10,10 +10,15 @@
static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
vnode_t *vnode = arg0; // expected locked
vnode_t *dirvnode = arg1; // expected locked
vattr_t attr;
VOP_GETATTR(vnode, &attr, NULL);
vattr_t dirattr;
if (dirvnode)
VOP_GETATTR(dirvnode, &dirattr, NULL);
int weight = 0;
if (actions & AUTH_ACTIONS_FILESYSTEM_WRITE) {
if (CRED_IS_ESU(cred))
@@ -77,8 +82,43 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
weight += 1;
else
return AUTH_DECISION_DENY;
DONE_CHECK(actions);
}
if (actions & AUTH_ACTIONS_FILESYSTEM_UNLINK) {
__assert(dirvnode);
bool dosticky = false;
if (CRED_IS_ESU(cred)) {
dosticky = false;
weight += 1;
} else if (dirattr.uid == cred->euid && (dirattr.mode & V_ATTR_MODE_USER_WRITE)) {
dosticky = true;
} else if (dirattr.uid != cred->euid && dirattr.gid == cred->egid && (dirattr.mode & V_ATTR_MODE_GROUP_WRITE)) {
dosticky = true;
} else if (dirattr.uid != cred->euid && dirattr.gid != cred->egid && (dirattr.mode & V_ATTR_MODE_OTHERS_WRITE)) {
dosticky = true;
} else {
return AUTH_DECISION_DENY;
}
if (dosticky && (dirattr.mode & V_ATTR_MODE_STICKY)) {
// sticky directory, file can only be unlinked if:
// - user requesting deletion is root (already checked for)
// OR
// - user requesting deletion has write access (already checked for) AND
// - effective user requesting deletion is owner of directory
// OR
// - effective user requesting deletion is owner of file
if (dirattr.uid == cred->euid || attr.uid == cred->euid)
weight += 1;
else
return AUTH_DECISION_DENY;
}
DONE_CHECK(actions);
}
done:
return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;