auth: chroot

kernel-src/include/kernel/auth.h

@@ -14,10 +14,12 @@
 #define AUTH_DECISION_DEFER 0
 #define AUTH_DECISION_DENY -1000
 
-#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
+#define AUTH_ACTIONS_SYSTEM_CHROOT	1
-#define AUTH_ACTIONS_FILESYSTEM_READ 	4
+
-#define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
 #define AUTH_ACTIONS_FILESYSTEM_EXECUTE 1
+#define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
+#define AUTH_ACTIONS_FILESYSTEM_READ 	4
+#define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
 
 typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
 

kernel-src/sys/defaultauth.c

@@ -75,6 +75,24 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
 	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
 }
 
+static int system(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2) {
+	int weight = 0;
+
+	if (actions & AUTH_ACTIONS_SYSTEM_CHROOT) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
+
+	done:
+	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
+}
+
 void defaultauth_init() {
 	auth_registerlistener(AUTH_SCOPE_FILESYSTEM, filesystem);
+	auth_registerlistener(AUTH_SCOPE_SYSTEM, system);
 }

kernel-src/sys/syscalls/chroot.c

@@ -3,12 +3,17 @@
 #include <kernel/vfs.h>
 #include <kernel/alloc.h>
 #include <errno.h>
+#include <kernel/auth.h>
 
 syscallret_t syscall_chroot(context_t *, char *upath) {
 	syscallret_t ret = {
 		.ret = -1
 	};
 
+	ret.errno = auth_system_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_SYSTEM_CHROOT);
+	if (ret.errno)
+		return ret;
+
 	size_t pathlen;
 	ret.errno = usercopy_strlen(upath, &pathlen);
 	if (ret.errno)