Switch to std kern_auth.
This commit is contained in:
pooka
parent
1e58602315
commit
44e0ae2322
|
|
@ -1,4 +1,4 @@
|
|||
# $NetBSD: Makefile.rumpkern,v 1.8 2008/09/27 16:03:30 pooka Exp $
|
||||
# $NetBSD: Makefile.rumpkern,v 1.9 2008/09/30 19:25:56 pooka Exp $
|
||||
#
|
||||
|
||||
.include "${RUMPTOP}/Makefile.rump"
|
||||
|
|
@ -15,14 +15,14 @@ INCS+= rump.h rumpdefs.h rump_syscalls.h rumpvnode_if.h
|
|||
${RUMPTOP}/../miscfs/genfs ${RUMPTOP}/../miscfs/syncfs
|
||||
|
||||
# implement something
|
||||
SRCS= rump.c atomic.c auth.c emul.c intr.c genfs_io.c locks.c \
|
||||
SRCS= rump.c atomic.c emul.c intr.c genfs_io.c locks.c \
|
||||
ltsleep.c pool.c specfs.c vfs.c vm.c
|
||||
|
||||
# just stubs
|
||||
SRCS+= fstrans_stub.c misc_stub.c pmap_stub.c vfsops_stub.c
|
||||
|
||||
# sys/kern
|
||||
SRCS+= clock_subr.c kern_descrip.c kern_malloc_stdtype.c \
|
||||
SRCS+= clock_subr.c kern_auth.c kern_descrip.c kern_malloc_stdtype.c \
|
||||
kern_module.c kern_stub.c kern_sysctl.c param.c subr_bufq.c \
|
||||
subr_callback.c subr_hash.c subr_kobj.c subr_prf2.c \
|
||||
subr_specificdata.c subr_time.c subr_workqueue.c sys_descrip.c \
|
||||
|
|
|
|||
|
|
@ -1,230 +0,0 @@
|
|||
/* $NetBSD: auth.c,v 1.10 2008/07/29 13:17:47 pooka Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2007 Antti Kantee. All Rights Reserved.
|
||||
*
|
||||
* Development of this software was supported by
|
||||
* The Finnish Cultural Foundation.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
|
||||
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/errno.h>
|
||||
#include <sys/kauth.h>
|
||||
#include <sys/kmem.h>
|
||||
#include <sys/proc.h>
|
||||
|
||||
#include <rump/rump.h>
|
||||
|
||||
struct kauth_cred {
|
||||
uid_t cr_uid;
|
||||
gid_t cr_gid;
|
||||
|
||||
size_t cr_ngroups;
|
||||
gid_t cr_groups[NGROUPS];
|
||||
};
|
||||
|
||||
kauth_cred_t
|
||||
rump_cred_create(uid_t uid, gid_t gid, size_t ngroups, gid_t *groups)
|
||||
{
|
||||
kauth_cred_t cred;
|
||||
|
||||
KASSERT(ngroups <= NGROUPS);
|
||||
cred = kmem_alloc(sizeof(struct kauth_cred), KM_SLEEP);
|
||||
|
||||
cred->cr_uid = uid;
|
||||
cred->cr_gid = gid;
|
||||
cred->cr_ngroups = ngroups;
|
||||
memcpy(cred->cr_groups, groups, ngroups * sizeof(gid_t));
|
||||
|
||||
return cred;
|
||||
}
|
||||
|
||||
void
|
||||
rump_cred_destroy(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
if (cred != RUMPCRED_SUSER)
|
||||
kmem_free(cred, sizeof(struct kauth_cred));
|
||||
}
|
||||
|
||||
int
|
||||
kauth_authorize_generic(kauth_cred_t cred, kauth_action_t op, void *arg0)
|
||||
{
|
||||
|
||||
if (op != KAUTH_GENERIC_ISSUSER)
|
||||
panic("%s: op %d not implemented", __func__, op);
|
||||
|
||||
if (cred == RUMPCRED_SUSER || cred->cr_uid == 0)
|
||||
return 0;
|
||||
|
||||
return EPERM;
|
||||
}
|
||||
|
||||
int
|
||||
kauth_authorize_system(kauth_cred_t cred, kauth_action_t op,
|
||||
enum kauth_system_req req, void *arg1, void *arg2, void *arg3)
|
||||
{
|
||||
|
||||
if (op != KAUTH_SYSTEM_CHSYSFLAGS && op != KAUTH_SYSTEM_MKNOD)
|
||||
panic("%s: op %d not implemented", __func__, op);
|
||||
|
||||
/* always allow */
|
||||
return 0;
|
||||
}
|
||||
|
||||
uid_t
|
||||
kauth_cred_getuid(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
return kauth_cred_geteuid(cred);
|
||||
}
|
||||
|
||||
gid_t
|
||||
kauth_cred_getgid(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
return cred == RUMPCRED_SUSER ? 0 : cred->cr_gid;
|
||||
}
|
||||
|
||||
uid_t
|
||||
kauth_cred_geteuid(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
return cred == RUMPCRED_SUSER ? 0 : cred->cr_uid;
|
||||
}
|
||||
|
||||
gid_t
|
||||
kauth_cred_getegid(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
return cred == RUMPCRED_SUSER ? 0 : cred->cr_gid;
|
||||
}
|
||||
|
||||
int
|
||||
kauth_cred_ismember_gid(kauth_cred_t cred, gid_t gid, int *resultp)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (cred == RUMPCRED_SUSER) {
|
||||
*resultp = 1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
*resultp = 1;
|
||||
if (cred->cr_gid == gid)
|
||||
return 0;
|
||||
for (i = 0; i < cred->cr_ngroups; i++)
|
||||
if (cred->cr_groups[i] == gid)
|
||||
break;
|
||||
if (i == cred->cr_ngroups)
|
||||
*resultp = 0;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
u_int
|
||||
kauth_cred_ngroups(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
if (cred == RUMPCRED_SUSER)
|
||||
return 1;
|
||||
|
||||
return cred->cr_ngroups;
|
||||
}
|
||||
|
||||
gid_t
|
||||
kauth_cred_group(kauth_cred_t cred, u_int idx)
|
||||
{
|
||||
|
||||
if (cred == RUMPCRED_SUSER)
|
||||
return 0;
|
||||
|
||||
KASSERT(idx < cred->cr_ngroups);
|
||||
|
||||
return cred->cr_groups[idx];
|
||||
}
|
||||
|
||||
void
|
||||
kauth_cred_to_uucred(struct uucred *uucred, const kauth_cred_t cred)
|
||||
{
|
||||
|
||||
if (cred == RUMPCRED_SUSER) {
|
||||
memset(uucred, 0, sizeof(struct uucred));
|
||||
return;
|
||||
}
|
||||
|
||||
uucred->cr_uid = cred->cr_uid;
|
||||
uucred->cr_gid = cred->cr_gid;
|
||||
uucred->cr_ngroups = cred->cr_ngroups;
|
||||
memcpy(uucred->cr_groups, cred->cr_groups,
|
||||
cred->cr_ngroups * sizeof(gid_t));
|
||||
}
|
||||
|
||||
void
|
||||
kauth_cred_seteuid(kauth_cred_t cred, uid_t uid)
|
||||
{
|
||||
|
||||
if (cred == RUMPCRED_SUSER)
|
||||
return;
|
||||
|
||||
cred->cr_uid = uid;
|
||||
}
|
||||
|
||||
void
|
||||
kauth_cred_setegid(kauth_cred_t cred, gid_t gid)
|
||||
{
|
||||
|
||||
if (cred == RUMPCRED_SUSER)
|
||||
return;
|
||||
|
||||
cred->cr_gid = gid;
|
||||
}
|
||||
|
||||
void
|
||||
kauth_cred_hold(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
/* nada: creds are always destroyed upon exit from VOP */
|
||||
}
|
||||
|
||||
void
|
||||
kauth_cred_free(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
/* nada: see above */
|
||||
}
|
||||
|
||||
kauth_cred_t
|
||||
kauth_cred_get()
|
||||
{
|
||||
|
||||
return curlwp->l_cred;
|
||||
}
|
||||
|
||||
kauth_cred_t
|
||||
kauth_cred_dup(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
panic("%s: unimplemented", __func__);
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
/* $NetBSD: emul.c,v 1.48 2008/09/25 16:23:46 pooka Exp $ */
|
||||
/* $NetBSD: emul.c,v 1.49 2008/09/30 19:25:56 pooka Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2007 Antti Kantee. All Rights Reserved.
|
||||
|
|
@ -614,3 +614,17 @@ devsw_detach(const struct bdevsw *bdev, const struct cdevsw *cdev)
|
|||
|
||||
panic("%s: not implemented", __func__);
|
||||
}
|
||||
|
||||
void
|
||||
proc_crmod_enter()
|
||||
{
|
||||
|
||||
panic("%s: not implemented", __func__);
|
||||
}
|
||||
|
||||
void
|
||||
proc_crmod_leave(kauth_cred_t c1, kauth_cred_t c2, bool sugid)
|
||||
{
|
||||
|
||||
panic("%s: not implemented", __func__);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $NetBSD: rump.c,v 1.58 2008/09/30 16:51:26 pooka Exp $ */
|
||||
/* $NetBSD: rump.c,v 1.59 2008/09/30 19:25:56 pooka Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2007 Antti Kantee. All Rights Reserved.
|
||||
|
|
@ -53,11 +53,11 @@ struct proc proc0;
|
|||
struct cwdinfo rump_cwdi;
|
||||
struct pstats rump_stats;
|
||||
struct plimit rump_limits;
|
||||
kauth_cred_t rump_cred = RUMPCRED_SUSER;
|
||||
struct cpu_info rump_cpu;
|
||||
struct filedesc rump_filedesc0;
|
||||
struct proclist allproc;
|
||||
char machine[] = "rump";
|
||||
static kauth_cred_t rump_susercred;
|
||||
|
||||
kmutex_t rump_giantlock;
|
||||
|
||||
|
|
@ -113,14 +113,20 @@ rump_init()
|
|||
rump_threads = *buf != '0';
|
||||
}
|
||||
|
||||
mutex_init(&rump_atomic_lock, MUTEX_DEFAULT, IPL_NONE);
|
||||
|
||||
rumpvm_init();
|
||||
rump_sleepers_init();
|
||||
#ifdef RUMP_USE_REAL_KMEM
|
||||
kmem_init();
|
||||
#endif
|
||||
|
||||
kauth_init();
|
||||
rump_susercred = rump_cred_create(0, 0, 0, NULL);
|
||||
|
||||
cache_cpu_init(&rump_cpu);
|
||||
rw_init(&rump_cwdi.cwdi_lock);
|
||||
|
||||
l = &lwp0;
|
||||
p = &proc0;
|
||||
p->p_stats = &rump_stats;
|
||||
|
|
@ -130,14 +136,11 @@ rump_init()
|
|||
p->p_fd = &rump_filedesc0;
|
||||
p->p_vmspace = &rump_vmspace;
|
||||
p->p_emul = &emul_rump;
|
||||
l->l_cred = rump_cred;
|
||||
l->l_cred = rump_cred_suserget();
|
||||
l->l_proc = p;
|
||||
l->l_lid = 1;
|
||||
|
||||
LIST_INSERT_HEAD(&allproc, p, p_list);
|
||||
|
||||
mutex_init(&rump_atomic_lock, MUTEX_DEFAULT, IPL_NONE);
|
||||
|
||||
rump_limits.pl_rlimit[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
|
||||
rump_limits.pl_rlimit[RLIMIT_NOFILE].rlim_cur = RLIM_INFINITY;
|
||||
|
||||
|
|
@ -691,7 +694,7 @@ rump_setup_curlwp(pid_t pid, lwpid_t lid, int set)
|
|||
p = &proc0;
|
||||
}
|
||||
|
||||
l->l_cred = rump_cred;
|
||||
l->l_cred = rump_cred_suserget();
|
||||
l->l_proc = p;
|
||||
l->l_lid = lid;
|
||||
l->l_fd = p->p_fd;
|
||||
|
|
@ -711,6 +714,7 @@ rump_clear_curlwp()
|
|||
if (l->l_proc->p_pid != 0) {
|
||||
fd_free();
|
||||
cwdfree(l->l_proc->p_cwdi);
|
||||
rump_cred_destroy(l->l_cred);
|
||||
kmem_free(l->l_proc, sizeof(*l->l_proc));
|
||||
}
|
||||
kmem_free(l, sizeof(*l));
|
||||
|
|
@ -781,6 +785,42 @@ rump_biodone(void *arg, size_t count, int error)
|
|||
rump_intr_exit();
|
||||
}
|
||||
|
||||
kauth_cred_t
|
||||
rump_cred_create(uid_t uid, gid_t gid, size_t ngroups, gid_t *groups)
|
||||
{
|
||||
kauth_cred_t cred;
|
||||
int rv;
|
||||
|
||||
cred = kauth_cred_alloc();
|
||||
kauth_cred_setuid(cred, uid);
|
||||
kauth_cred_seteuid(cred, uid);
|
||||
kauth_cred_setsvuid(cred, uid);
|
||||
kauth_cred_setgid(cred, gid);
|
||||
kauth_cred_setgid(cred, gid);
|
||||
kauth_cred_setegid(cred, gid);
|
||||
kauth_cred_setsvgid(cred, gid);
|
||||
rv = kauth_cred_setgroups(cred, groups, ngroups, 0, UIO_SYSSPACE);
|
||||
/* oh this is silly. and by "this" I mean kauth_cred_setgroups() */
|
||||
assert(rv == 0);
|
||||
|
||||
return cred;
|
||||
}
|
||||
|
||||
void
|
||||
rump_cred_destroy(kauth_cred_t cred)
|
||||
{
|
||||
|
||||
kauth_cred_free(cred);
|
||||
}
|
||||
|
||||
kauth_cred_t
|
||||
rump_cred_suserget()
|
||||
{
|
||||
|
||||
kauth_cred_hold(rump_susercred);
|
||||
return rump_susercred;
|
||||
}
|
||||
|
||||
int _syspuffs_stub(int, int *);
|
||||
int
|
||||
_syspuffs_stub(int fd, int *newfd)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $NetBSD: rump.h,v 1.32 2008/09/02 19:38:25 pooka Exp $ */
|
||||
/* $NetBSD: rump.h,v 1.33 2008/09/30 19:25:56 pooka Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2007 Antti Kantee. All Rights Reserved.
|
||||
|
|
@ -107,10 +107,13 @@ int rump_vp_islocked(struct vnode *);
|
|||
void rump_vp_interlock(struct vnode *);
|
||||
|
||||
kauth_cred_t rump_cred_create(uid_t, gid_t, size_t, gid_t *);
|
||||
kauth_cred_t rump_cred_suserget(void);
|
||||
void rump_cred_destroy(kauth_cred_t);
|
||||
|
||||
#define RUMPCRED_SUSER ((void *)-3)
|
||||
#define WizardMode RUMPCRED_SUSER /* COMPAT_NETHACK */
|
||||
#define rump_cred_suserput(c) rump_cred_destroy(c)
|
||||
/* COMPAT_NETHACK */
|
||||
#define WizardMode() rump_cred_suserget()
|
||||
#define YASD(cred) rump_cred_suserput(cred)
|
||||
|
||||
int rump_vfs_unmount(struct mount *, int);
|
||||
int rump_vfs_root(struct mount *, struct vnode **, int);
|
||||
|
|
|
|||
Loading…
Reference in New Issue