minix/lib/libpuffs/creds.c
Thomas Veerman 490e0de548 Import librefuse and libpuffs
Import libpuffs and our port of libpuffs. The port was done as part of
GSoC 2011 FUSE project, done by Evgeniy Ivanov. The librefuse import
did not require any porting efforts. Libpuffs has been modified to
understand our VFS-FS protocol and translate between that and PUFFS. As
an example that it works, fuse-ntfs-3g from pkgsrc can be compiled and
used to mount ntfs partitions:
mount -t ntfs-3g <device> <mountpoint>

FUSE only works with the asynchronous version of VFS. See <docs/UPDATING> on
how to run AVFS.

This patch further includes some changes to mount(1) and mount(2) so it's
possible to use file systems provided by pkgsrc (note: manual modifications
to /etc/system.conf are still needed. There has been made an exception for
fuse-ntfs-3g, so it already as an entry).
2011-11-14 11:53:05 +00:00

259 lines
6 KiB
C

/* $NetBSD: creds.c,v 1.14.12.1 2009/11/28 16:01:03 bouyer Exp $ */
/*
* Copyright (c) 2006 Antti Kantee. All Rights Reserved.
*
* Development of this software was supported by the Ulla Tuominen Foundation.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>
#if !defined(lint)
__RCSID("$NetBSD: creds.c,v 1.14.12.1 2009/11/28 16:01:03 bouyer Exp $");
#endif /* !lint */
/*
* Interface for dealing with credits.
*/
#include <sys/types.h>
#include <sys/param.h>
#include <errno.h>
#include <stdbool.h>
#include <string.h>
#include "puffs.h"
#include "puffs_priv.h"
#define UUCCRED(a) (a->pkcr_type == PUFFCRED_TYPE_UUC)
#define INTCRED(a) (a->pkcr_type == PUFFCRED_TYPE_INTERNAL)
int
puffs_cred_getuid(const struct puffs_cred *pcr, uid_t *ruid)
{
PUFFS_MAKEKCRED(pkcr, pcr);
if (!UUCCRED(pkcr)) {
errno = EOPNOTSUPP;
return -1;
}
*ruid = pkcr->pkcr_uuc.cr_uid;
return 0;
}
int
puffs_cred_getgid(const struct puffs_cred *pcr, gid_t *rgid)
{
PUFFS_MAKEKCRED(pkcr, pcr);
if (!UUCCRED(pkcr)) {
errno = EOPNOTSUPP;
return -1;
}
*rgid = pkcr->pkcr_uuc.cr_gid;
return 0;
}
int
puffs_cred_getgroups(const struct puffs_cred *pcr, gid_t *rgids, short *ngids)
{
PUFFS_MAKEKCRED(pkcr, pcr);
size_t ncopy;
if (!UUCCRED(pkcr)) {
errno = EOPNOTSUPP;
*ngids = 0;
return -1;
}
ncopy = MIN(*ngids, pkcr->pkcr_uuc.cr_ngroups);
(void)memcpy(rgids, pkcr->pkcr_uuc.cr_groups, sizeof(gid_t) * ncopy);
*ngids = (short)ncopy;
return 0;
}
bool
puffs_cred_isuid(const struct puffs_cred *pcr, uid_t uid)
{
PUFFS_MAKEKCRED(pkcr, pcr);
return UUCCRED(pkcr) && pkcr->pkcr_uuc.cr_uid == uid;
}
bool
puffs_cred_hasgroup(const struct puffs_cred *pcr, gid_t gid)
{
PUFFS_MAKEKCRED(pkcr, pcr);
short i;
if (!UUCCRED(pkcr))
return false;
if (pkcr->pkcr_uuc.cr_gid == gid)
return true;
for (i = 0; i < pkcr->pkcr_uuc.cr_ngroups; i++)
if (pkcr->pkcr_uuc.cr_groups[i] == gid)
return true;
return false;
}
bool
puffs_cred_isregular(const struct puffs_cred *pcr)
{
PUFFS_MAKEKCRED(pkcr, pcr);
return UUCCRED(pkcr);
}
bool
puffs_cred_iskernel(const struct puffs_cred *pcr)
{
PUFFS_MAKEKCRED(pkcr, pcr);
return INTCRED(pkcr) && pkcr->pkcr_internal == PUFFCRED_CRED_NOCRED;
}
bool
puffs_cred_isfs(const struct puffs_cred *pcr)
{
PUFFS_MAKEKCRED(pkcr, pcr);
return INTCRED(pkcr) && pkcr->pkcr_internal == PUFFCRED_CRED_FSCRED;
}
bool
puffs_cred_isjuggernaut(const struct puffs_cred *pcr)
{
return puffs_cred_isuid(pcr, 0) || puffs_cred_iskernel(pcr)
|| puffs_cred_isfs(pcr);
}
/*
* Generic routine for checking file access rights. Modeled after
* vaccess() in the kernel.
*/
int
puffs_access(enum vtype type, mode_t file_mode, uid_t uid, gid_t gid,
mode_t acc_mode, const struct puffs_cred *pcr)
{
mode_t mask;
/* megapower */
if (puffs_cred_iskernel(pcr) || puffs_cred_isfs(pcr))
return 0;
/* superuser, allow all except exec if *ALL* exec bits are unset */
if (puffs_cred_isuid(pcr, 0)) {
if ((acc_mode & PUFFS_VEXEC) && type != VDIR &&
(file_mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)
return EACCES;
return 0;
}
mask = 0;
/* owner */
if (puffs_cred_isuid(pcr, uid)) {
if (acc_mode & PUFFS_VEXEC)
mask |= S_IXUSR;
if (acc_mode & PUFFS_VREAD)
mask |= S_IRUSR;
if (acc_mode & PUFFS_VWRITE)
mask |= S_IWUSR;
/* group */
} else if (puffs_cred_hasgroup(pcr, gid)) {
if (acc_mode & PUFFS_VEXEC)
mask |= S_IXGRP;
if (acc_mode & PUFFS_VREAD)
mask |= S_IRGRP;
if (acc_mode & PUFFS_VWRITE)
mask |= S_IWGRP;
/* other */
} else {
if (acc_mode & PUFFS_VEXEC)
mask |= S_IXOTH;
if (acc_mode & PUFFS_VREAD)
mask |= S_IROTH;
if (acc_mode & PUFFS_VWRITE)
mask |= S_IWOTH;
}
if ((file_mode & mask) == mask)
return 0;
else
return EACCES;
}
int
puffs_access_chown(uid_t owner, gid_t group, uid_t newowner, gid_t newgroup,
const struct puffs_cred *pcr)
{
if (newowner == (uid_t)PUFFS_VNOVAL)
newowner = owner;
if (newgroup == (gid_t)PUFFS_VNOVAL)
newgroup = group;
if ((!puffs_cred_isuid(pcr, owner) || newowner != owner ||
((newgroup != group && !puffs_cred_hasgroup(pcr, newgroup))))
&& !puffs_cred_isjuggernaut(pcr))
return EPERM;
return 0;
}
int
puffs_access_chmod(uid_t owner, gid_t group, enum vtype type, mode_t mode,
const struct puffs_cred *pcr)
{
if (!puffs_cred_isuid(pcr, owner) && !puffs_cred_isjuggernaut(pcr))
return EPERM;
if (!puffs_cred_isjuggernaut(pcr)) {
if (type != VDIR && (mode & S_ISTXT))
return EFTYPE;
if (!puffs_cred_hasgroup(pcr, group) && (mode & S_ISGID))
return EPERM;
}
return 0;
}
int
puffs_access_times(uid_t uid, gid_t gid, mode_t mode, int va_utimes_null,
const struct puffs_cred *pcr)
{
if (!puffs_cred_isuid(pcr, uid) && !puffs_cred_isjuggernaut(pcr)
&& (va_utimes_null == 0
|| puffs_access(VNON, mode, uid, gid, PUFFS_VWRITE, pcr) != 0))
return EPERM;
return 0;
}