Commit 2ccf944a authored by Marc Vef's avatar Marc Vef
Browse files

Added: access control for open/opendir

parent dd58a49b

lfs/src/adafs_ops/access.cpp

+33 −2
Original line number Diff line number Diff line
@@ -5,6 +5,37 @@ 
#include "access.h"

#include "metadata_ops.h"



/**

 * chk_access wrapper for opendir and open.

 * @param req

 * @param ino

 * @param flags from fuse_file_info

 * @return err

 */

int open_chk_access(fuse_req_t& req, fuse_ino_t ino, int flags) {

    // XXX error handling

    auto md = make_shared<Metadata>();



    auto err = get_metadata(*md, ino);



    if (err != 0) return err;



    int access = flags & O_ACCMODE; // flags & 3. 0 = R, 1 = W, 2 = RW



    ADAFS_DATA->spdlogger()->debug("access {} flags {}", access, flags);

    switch (access) {

        case O_RDONLY:

            return chk_access(req, *md, R_OK);

        case O_WRONLY:

            return chk_access(req, *md, W_OK);

        case O_RDWR:

            return chk_access(req, *md, R_OK | W_OK);

        default:

            return EACCES;

    }



}



/**

 * Checks access for mask (can be R_OK, W_OK, or X_OK (or combined) AFAIK and not verified) against metadata's mode.

 * First the mask is checked agains the 3 bits for the user, then for the 3 bits of the group, and lastly other.
@@ -15,8 +46,8 @@ 
 * @return

 */

int chk_access(const fuse_req_t& req, const Metadata& md, int mask) {

    ADAFS_DATA->spdlogger()->debug("chk_access() enter: metadata_uid {} fusecontext_uid {}", md.uid(),

                                   fuse_req_ctx(req)->uid);

    ADAFS_DATA->spdlogger()->debug("chk_access() enter: metadata_uid {} fusecontext_uid {} mask {}", md.uid(),

                                   fuse_req_ctx(req)->uid, mask);

    // root user is a god

    if (fuse_req_ctx(req)->uid == 0)

        return 0;

lfs/src/adafs_ops/access.h

+1 −0
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ 


#include "../classes/metadata.h"



int open_chk_access(fuse_req_t& req, fuse_ino_t ino, int flags);



int chk_access(const fuse_req_t& req, const Metadata& md, int mask);

lfs/src/configure.h

+1 −1
Original line number Diff line number Diff line
@@ -14,6 +14,6 @@ 
#define ACMtime



// If access permissions should be checked while opening a file

//#define CHECK_ACCESS

#define CHECK_ACCESS



#endif //FS_CONFIGURE_H

lfs/src/fuse_ops/directory.cpp

+3 −25
Original line number Diff line number Diff line
@@ -78,35 +78,13 @@ void adafs_ll_lookup(fuse_req_t req, fuse_ino_t parent, const char* name) { 
	 */

void adafs_ll_opendir(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info* fi) {

    ADAFS_DATA->spdlogger()->debug("adafs_ll_opendir() enter: inode {}", ino);

#ifdef CHECK_ACCESS //TODO

    // XXX error handling

    auto md = make_shared<Metadata>();

#ifdef CHECK_ACCESS

    auto err = open_chk_access(req, ino, fi->flags);



    auto err = get_metadata(*md, ino);



    if (!err) {

        int access = fi->flags & O_ACCMODE;



//    ADAFS_DATA->logger->debug("access variable: {}", access);

        switch (access) {

            case O_RDONLY:

                err = chk_access(req, *md, R_OK);

                break;

            case O_WRONLY:

                err = chk_access(req, *md, W_OK);

                break;

            case O_RDWR:

                err = chk_access(req, *md, R_OK | W_OK);

                break;

            default:

                err = EACCES;

        }

    }

    if (err)

    if (err != 0)

        fuse_reply_err(req, err);

    else

        fuse_reply_open(req, fi);



#else

    // access permitted without checking

    fuse_reply_open(req, fi);

lfs/src/fuse_ops/file.cpp

+21 −10
Original line number Diff line number Diff line
@@ -199,7 +199,8 @@ void adafs_ll_create(fuse_req_t req, fuse_ino_t parent, const char *name, mode_t 
 * @param rdev the device number (only valid if created file is a device)

 */

void adafs_ll_mknod(fuse_req_t req, fuse_ino_t parent, const char* name, mode_t mode, dev_t rdev) {

    ADAFS_DATA->spdlogger()->debug("adafs_ll_mknod() enter: parent_inode {} name {} mode {:o} dev {}", parent, name, mode, rdev);

    ADAFS_DATA->spdlogger()->debug("adafs_ll_mknod() enter: parent_inode {} name {} mode {:o} dev {}", parent, name,

                                   mode, rdev);



    auto fep = make_shared<fuse_entry_param>();
@@ -306,10 +307,20 @@ void adafs_ll_unlink(fuse_req_t req, fuse_ino_t parent, const char* name) { 
 */

void adafs_ll_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info* fi) {

    ADAFS_DATA->spdlogger()->debug("adafs_ll_open() enter: inode {}", ino);

    // TODO to be implemented

    // I think this is used for optimizing what'll happen with the file in the future through fi



#ifdef CHECK_ACCESS

    auto err = open_chk_access(req, ino, fi->flags);



    if (err != 0)

        fuse_reply_err(req, err);

    else

        fuse_reply_open(req, fi);

//    fuse_reply_err(req, 0);

#else

    // access permitted without checking

    fuse_reply_open(req, fi);

#endif





}



/**