mirror of
https://github.com/tmux/tmux.git
synced 2026-10-10 20:24:21 +00:00
Allow ACLs to use groups as well as users, GitHub issue 4917.
This commit is contained in:
nicm
222
server-acl.c
222
server-acl.c
@@ -22,6 +22,7 @@
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include <ctype.h>
|
||||
#include <grp.h>
|
||||
#include <pwd.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
@@ -29,158 +30,203 @@
|
||||
|
||||
#include "tmux.h"
|
||||
|
||||
struct server_acl_user {
|
||||
uid_t uid;
|
||||
struct server_acl_entry {
|
||||
id_t id;
|
||||
|
||||
int flags;
|
||||
#define SERVER_ACL_READONLY 0x1
|
||||
int flags;
|
||||
|
||||
RB_ENTRY(server_acl_user) entry;
|
||||
RB_ENTRY(server_acl_entry) entry;
|
||||
};
|
||||
|
||||
static int
|
||||
server_acl_cmp(struct server_acl_user *user1, struct server_acl_user *user2)
|
||||
server_acl_cmp(struct server_acl_entry *entry1,
|
||||
struct server_acl_entry *entry2)
|
||||
{
|
||||
if (user1->uid < user2->uid)
|
||||
if ((entry1->flags ^ entry2->flags) & SERVER_ACL_IS_GROUP) {
|
||||
if (entry1->flags & SERVER_ACL_IS_GROUP)
|
||||
return (1);
|
||||
return (-1);
|
||||
return (user1->uid > user2->uid);
|
||||
}
|
||||
|
||||
if (entry1->id < entry2->id)
|
||||
return (-1);
|
||||
return (entry1->id > entry2->id);
|
||||
}
|
||||
|
||||
RB_HEAD(server_acl_entries, server_acl_user) server_acl_entries;
|
||||
RB_GENERATE_STATIC(server_acl_entries, server_acl_user, entry, server_acl_cmp);
|
||||
RB_HEAD(server_acl_entries, server_acl_entry) server_acl_entries;
|
||||
RB_GENERATE_STATIC(server_acl_entries, server_acl_entry, entry, server_acl_cmp);
|
||||
|
||||
/* Initialize server_acl tree. */
|
||||
static struct server_acl_entry *
|
||||
server_acl_entry_find(id_t id, int flags)
|
||||
{
|
||||
struct server_acl_entry find = {
|
||||
.id = id,
|
||||
.flags = flags & SERVER_ACL_IS_GROUP
|
||||
};
|
||||
|
||||
return (RB_FIND(server_acl_entries, &server_acl_entries, &find));
|
||||
}
|
||||
|
||||
static struct server_acl_entry *
|
||||
server_acl_check(struct client *c)
|
||||
{
|
||||
struct server_acl_entry *entry;
|
||||
uid_t uid;
|
||||
gid_t gid;
|
||||
|
||||
uid = proc_get_peer_uid(c->peer);
|
||||
if (uid == (uid_t)-1)
|
||||
return (NULL);
|
||||
|
||||
entry = server_acl_entry_find(uid, 0);
|
||||
if (entry != NULL)
|
||||
return (entry);
|
||||
|
||||
gid = proc_get_peer_gid(c->peer);
|
||||
if (gid == (gid_t)-1)
|
||||
return (NULL);
|
||||
|
||||
return (server_acl_entry_find(gid, SERVER_ACL_IS_GROUP));
|
||||
}
|
||||
|
||||
static void
|
||||
server_acl_update(void)
|
||||
{
|
||||
struct server_acl_entry *entry;
|
||||
struct client *c;
|
||||
|
||||
TAILQ_FOREACH(c, &clients, entry) {
|
||||
entry = server_acl_check(c);
|
||||
if (entry == NULL) {
|
||||
c->exit_message = xstrdup("access not allowed");
|
||||
c->flags |= CLIENT_EXIT;
|
||||
} else if (entry->flags & SERVER_ACL_READONLY)
|
||||
c->flags |= CLIENT_READONLY;
|
||||
else
|
||||
c->flags &= ~CLIENT_READONLY;
|
||||
}
|
||||
}
|
||||
|
||||
/* Initialize ACL tree. */
|
||||
void
|
||||
server_acl_init(void)
|
||||
{
|
||||
RB_INIT(&server_acl_entries);
|
||||
|
||||
if (getuid() != 0)
|
||||
server_acl_user_allow(0);
|
||||
server_acl_user_allow(getuid());
|
||||
server_acl_allow(0, 0);
|
||||
server_acl_allow(getuid(), 0);
|
||||
}
|
||||
|
||||
/* Find user entry. */
|
||||
struct server_acl_user*
|
||||
server_acl_user_find(uid_t uid)
|
||||
/* Check if an ACL entry exists. */
|
||||
int
|
||||
server_acl_find(id_t id, int flags)
|
||||
{
|
||||
struct server_acl_user find = { .uid = uid };
|
||||
|
||||
return (RB_FIND(server_acl_entries, &server_acl_entries, &find));
|
||||
return (server_acl_entry_find(id, flags) != NULL);
|
||||
}
|
||||
|
||||
/* Display the tree. */
|
||||
void
|
||||
server_acl_display(struct cmdq_item *item)
|
||||
{
|
||||
struct server_acl_user *loop;
|
||||
struct server_acl_entry *loop;
|
||||
struct passwd *pw;
|
||||
struct group *gr;
|
||||
const char *name;
|
||||
char type;
|
||||
|
||||
RB_FOREACH(loop, server_acl_entries, &server_acl_entries) {
|
||||
if (loop->uid == 0)
|
||||
continue;
|
||||
if ((pw = getpwuid(loop->uid)) != NULL)
|
||||
name = pw->pw_name;
|
||||
if (~loop->flags & SERVER_ACL_IS_GROUP) {
|
||||
if (loop->id == 0)
|
||||
continue;
|
||||
if ((pw = getpwuid(loop->id)) != NULL)
|
||||
name = pw->pw_name;
|
||||
else
|
||||
name = "unknown";
|
||||
type = 'U';
|
||||
} else {
|
||||
if ((gr = getgrgid(loop->id)) != NULL)
|
||||
name = gr->gr_name;
|
||||
else
|
||||
name = "unknown";
|
||||
type = 'G';
|
||||
}
|
||||
if (loop->flags & SERVER_ACL_READONLY)
|
||||
cmdq_print(item, "%s (%c,R)", name, type);
|
||||
else
|
||||
name = "unknown";
|
||||
if (loop->flags == SERVER_ACL_READONLY)
|
||||
cmdq_print(item, "%s (R)", name);
|
||||
else
|
||||
cmdq_print(item, "%s (W)", name);
|
||||
cmdq_print(item, "%s (%c,W)", name, type);
|
||||
}
|
||||
}
|
||||
|
||||
/* Allow a user. */
|
||||
/* Allow an ACL entry. */
|
||||
void
|
||||
server_acl_user_allow(uid_t uid)
|
||||
server_acl_allow(id_t id, int flags)
|
||||
{
|
||||
struct server_acl_user *user;
|
||||
struct server_acl_entry *entry;
|
||||
|
||||
user = server_acl_user_find(uid);
|
||||
if (user == NULL) {
|
||||
user = xcalloc(1, sizeof *user);
|
||||
user->uid = uid;
|
||||
RB_INSERT(server_acl_entries, &server_acl_entries, user);
|
||||
entry = server_acl_entry_find(id, flags);
|
||||
if (entry == NULL) {
|
||||
entry = xcalloc(1, sizeof *entry);
|
||||
entry->id = id;
|
||||
entry->flags = flags & SERVER_ACL_IS_GROUP;
|
||||
RB_INSERT(server_acl_entries, &server_acl_entries, entry);
|
||||
}
|
||||
}
|
||||
|
||||
/* Deny a user (remove from the tree). */
|
||||
/* Deny an ACL entry (remove it from the tree). */
|
||||
void
|
||||
server_acl_user_deny(uid_t uid)
|
||||
server_acl_deny(id_t id, int flags)
|
||||
{
|
||||
struct server_acl_user *user;
|
||||
struct server_acl_entry *entry;
|
||||
|
||||
user = server_acl_user_find(uid);
|
||||
if (user != NULL) {
|
||||
RB_REMOVE(server_acl_entries, &server_acl_entries, user);
|
||||
free(user);
|
||||
entry = server_acl_entry_find(id, flags);
|
||||
if (entry != NULL) {
|
||||
RB_REMOVE(server_acl_entries, &server_acl_entries, entry);
|
||||
free(entry);
|
||||
server_acl_update();
|
||||
}
|
||||
}
|
||||
|
||||
/* Allow this user write access. */
|
||||
/* Allow this ACL entry write access. */
|
||||
void
|
||||
server_acl_user_allow_write(uid_t uid)
|
||||
server_acl_allow_write(id_t id, int flags)
|
||||
{
|
||||
struct server_acl_user *user;
|
||||
struct client *c;
|
||||
struct server_acl_entry *entry;
|
||||
|
||||
user = server_acl_user_find(uid);
|
||||
if (user == NULL)
|
||||
entry = server_acl_entry_find(id, flags);
|
||||
if (entry == NULL)
|
||||
return;
|
||||
user->flags &= ~SERVER_ACL_READONLY;
|
||||
|
||||
TAILQ_FOREACH(c, &clients, entry) {
|
||||
uid = proc_get_peer_uid(c->peer);
|
||||
if (uid != (uid_t)-1 && uid == user->uid)
|
||||
c->flags &= ~CLIENT_READONLY;
|
||||
}
|
||||
entry->flags &= ~SERVER_ACL_READONLY;
|
||||
server_acl_update();
|
||||
}
|
||||
|
||||
/* Deny this user write access. */
|
||||
/* Deny this ACL entry write access. */
|
||||
void
|
||||
server_acl_user_deny_write(uid_t uid)
|
||||
server_acl_deny_write(id_t id, int flags)
|
||||
{
|
||||
struct server_acl_user *user;
|
||||
struct client *c;
|
||||
struct server_acl_entry *entry;
|
||||
|
||||
user = server_acl_user_find(uid);
|
||||
if (user == NULL)
|
||||
entry = server_acl_entry_find(id, flags);
|
||||
if (entry == NULL)
|
||||
return;
|
||||
user->flags |= SERVER_ACL_READONLY;
|
||||
|
||||
TAILQ_FOREACH(c, &clients, entry) {
|
||||
uid = proc_get_peer_uid(c->peer);
|
||||
if (uid != (uid_t)-1 && uid == user->uid)
|
||||
c->flags |= CLIENT_READONLY;
|
||||
}
|
||||
entry->flags |= SERVER_ACL_READONLY;
|
||||
server_acl_update();
|
||||
}
|
||||
|
||||
/*
|
||||
* Check if the client's UID exists in the ACL list and if so, set as read only
|
||||
* if needed. Return false if the user does not exist.
|
||||
* Check if the client's UID or GID exists in the ACL list and if so, set as
|
||||
* read only if needed. UID entries take precedence over GID entries. Return
|
||||
* false if no entry exists.
|
||||
*/
|
||||
int
|
||||
server_acl_join(struct client *c)
|
||||
{
|
||||
struct server_acl_user *user;
|
||||
uid_t uid;
|
||||
struct server_acl_entry *entry;
|
||||
|
||||
uid = proc_get_peer_uid(c->peer);
|
||||
if (uid == (uid_t)-1)
|
||||
entry = server_acl_check(c);
|
||||
if (entry == NULL)
|
||||
return (0);
|
||||
|
||||
user = server_acl_user_find(uid);
|
||||
if (user == NULL)
|
||||
return (0);
|
||||
if (user->flags & SERVER_ACL_READONLY)
|
||||
if (entry->flags & SERVER_ACL_READONLY)
|
||||
c->flags |= CLIENT_READONLY;
|
||||
return (1);
|
||||
}
|
||||
|
||||
/* Get UID for user entry. */
|
||||
uid_t
|
||||
server_acl_get_uid(struct server_acl_user *user)
|
||||
{
|
||||
return (user->uid);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user