From cd51d4eaf0cba93c606155d8ffd186872d3d0520 Mon Sep 17 00:00:00 2001
From: Matheus <matheusuky@gmail.com>
Date: Sat, 24 Aug 2024 21:52:44 -0300
Subject: [PATCH] auth: chroot

---
 kernel-src/include/kernel/auth.h |  8 +++++---
 kernel-src/sys/defaultauth.c     | 18 ++++++++++++++++++
 kernel-src/sys/syscalls/chroot.c |  5 +++++
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h
index bd3230b6..411ff2f3 100644
--- a/kernel-src/include/kernel/auth.h
+++ b/kernel-src/include/kernel/auth.h
@@ -14,10 +14,12 @@
 #define AUTH_DECISION_DEFER 0
 #define AUTH_DECISION_DENY -1000
 
-#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
-#define AUTH_ACTIONS_FILESYSTEM_READ 	4
-#define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
+#define AUTH_ACTIONS_SYSTEM_CHROOT	1
+
 #define AUTH_ACTIONS_FILESYSTEM_EXECUTE 1
+#define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
+#define AUTH_ACTIONS_FILESYSTEM_READ 	4
+#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
 
 typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
 
diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c
index 41c1847b..da82e26c 100644
--- a/kernel-src/sys/defaultauth.c
+++ b/kernel-src/sys/defaultauth.c
@@ -75,6 +75,24 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
 	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
 }
 
+static int system(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
+	int weight = 0;
+
+	if (actions & AUTH_ACTIONS_SYSTEM_CHROOT) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
+
+	done:
+	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
+}
+
 void defaultauth_init() {
 	auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem);
+	auth_registerlistener(AUTH_SCOPE_SYSTEM, system);
 }
diff --git a/kernel-src/sys/syscalls/chroot.c b/kernel-src/sys/syscalls/chroot.c
index 0692dd5b..89ad49fc 100644
--- a/kernel-src/sys/syscalls/chroot.c
+++ b/kernel-src/sys/syscalls/chroot.c
@@ -3,12 +3,17 @@
 #include <kernel/vfs.h>
 #include <kernel/alloc.h>
 #include <errno.h>
+#include <kernel/auth.h>
 
 syscallret_t syscall_chroot(context_t *, char *upath) {
 	syscallret_t ret = {
 		.ret = -1
 	};
 
+	ret.errno = auth_system_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_SYSTEM_CHROOT);
+	if (ret.errno)
+		return ret;
+
 	size_t pathlen;
 	ret.errno = usercopy_strlen(upath, &pathlen);
 	if (ret.errno)