vdev/acl.h at master · Centuriondan/vdev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
/*
   vdev: a virtual device manager for *nix
   Copyright (C) 2014  Jude Nelson

   This program is dual-licensed: you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 3 or later as
   published by the Free Software Foundation. For the terms of this
   license, see LICENSE.LGPLv3+ or <http://www.gnu.org/licenses/>.

   You are free to use this program under the terms of the GNU General
   Public License, but WITHOUT ANY WARRANTY; without even the implied
   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   See the GNU General Public License for more details.

   Alternatively, you are free to use this program under the terms of the
   Internet Software Consortium License, but WITHOUT ANY WARRANTY; without
   even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   For the terms of this license, see LICENSE.ISC or
   <http://www.isc.org/downloads/software-support-policy/isc-license/>.
*/

#ifndef _VDEV_ACL_H_
#define _VDEV_ACL_H_

#include "util.h"

#include <regex.h>
#include <dirent.h>

// acl fields
#define VDEV_ACL_NAME                   "vdev-acl"

#define VDEV_ACL_NAME_UID               "uid"
#define VDEV_ACL_NAME_GID               "gid"
#define VDEV_ACL_NAME_PROC_PATH         "bin"
#define VDEV_ACL_NAME_PROC_PIDLIST      "pidlist"
#define VDEV_ACL_NAME_PROC_SHA256       "sha256"
#define VDEV_ACL_NAME_PROC_INODE        "inode"

#define VDEV_ACL_DEVICE_REGEX           "paths"

#define VDEV_ACL_NAME_SETUID            "setuid"
#define VDEV_ACL_NAME_SETGID            "setgid"
#define VDEV_ACL_NAME_SETMODE           "setmode"

#define VDEV_ACL_PROC_BUFLEN            65536

// vdev access control list.
struct vdev_acl {

   // user to match
   bool has_uid;
   uid_t uid;

   // group to match
   bool has_gid;
   gid_t gid;

   // process info to match (set at least one; all must match for the ACL to apply)
   bool has_proc;               // if true, at least one of the following is filled in (and the ACL will only apply if the request is from one of the indicated processes)
   char* proc_path;             // path to the allowed process
   unsigned char* proc_sha256;  // sha256 of the allowed process binary
   char* proc_pidlist_cmd;      // command string to run to get the list of PIDs
   bool has_proc_inode;         // whether or not the ACL has an inode check
   ino_t proc_inode;            // process binary's inode

   // UID to set on match
   bool has_setuid;
   uid_t setuid;

   // GID to set on match
   bool has_setgid;
   gid_t setgid;

   // mode to set on match
   bool has_setmode;
   mode_t setmode;

   // device node path regexes over which this ACL applies (NULL-terminated)
   char** paths;
   regex_t* regexes;
   size_t num_paths;
};

extern "C" {

int vdev_acl_init( struct vdev_acl* acl );
int vdev_acl_load_all( char const* dir_path, struct vdev_acl** ret_acls, size_t* ret_num_acls );
int vdev_acl_free( struct vdev_acl* acl );
int vdev_acl_free_all( struct vdev_acl* acl_list, size_t num_acls );

int vdev_acl_apply_all( struct vdev_acl* acls, size_t num_acls, char const* path, struct pstat* caller_proc, uid_t caller_uid, gid_t caller_gid, struct stat* sb );

}

#endif