From: Stanislav Ievlev <inger@altlinux.ru>
Subject: RC. Dynamic Role Switching
Date: Mon, 18 Jun 2001 16:53:32 +0400
Next Article (by Subject): Re: RC. Dynamic Role Switching Amon Ott
Previous Article (by Subject): RC redirection Stanislav Ievlev
Next in Thread: Re: RC. Dynamic Role Switching Amon Ott
Articles sorted by: [Date]
[Author]
[Subject]
This is a multi-part message in MIME format.
--------------020007000402020701070104
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Hello!
There are following problem.
Some processes needs different permissions in different time, e.g. http
server apache need different roles for different virtual hosts
Example:
a) "Role 1" --> (for www.test1.com) Full access to all files in
/var/www/test1/*, no access outside this dir.
b) "Role 2" --> (for www.test2.com) Full access to all files in
/var/www/test2/*, no access outside this dir.
Unfortunately, kernel cannot understand process's wishes. Process will
have to ask kernel - change role itself.
I propose changes in RC for this goal:
To add to rsbac_adf_request_rc() new checking for R_MODIFY_ATTRIBUTE.
New GRANTED: If (target==T_PROCESS) and (process change it's own role)
and (this role in assigned) then GRANTED
Patch and test program in attach.
---------------------------
With best regards
Stanislav Ievlev.
<inger@linux.ru.net>
--------------020007000402020701070104
Content-Type: text/plain;
name="rsbac-rcswitch.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="rsbac-rcswitch.patch"
--- linux/rsbac/adf/rc/rc_main.c.orig Fri Apr 27 17:09:34 2001
+++ linux/rsbac/adf/rc/rc_main.c Mon Jun 18 14:41:24 2001
@@ -981,6 +981,12 @@
if (!(err=rsbac_rc_test_assign_roles(target, tid, attr, attr_val.rc_role)))
return(GRANTED);
}
+ /*New checks for Dynamic Role Switching*/
+ if ( (target==T_PROCESS)&&(tid.process==caller_pid) )
+ {
+ if (!(err=rsbac_rc_test_assign_roles(target, tid, attr, attr_val.rc_role)))
+ return(GRANTED);
+ }
/* Classical admin_type check */
if (rsbac_rc_test_role_admin(TRUE))
return(NOT_GRANTED);
--------------020007000402020701070104
Content-Type: text/plain;
name="test.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="test.c"
#include <stdio.h>
#include <stdlib.h>
#include <rsbac/types.h>
#include <rsbac/rc_data_structures.h>
#include <rsbac/getname.h>
#include <rsbac/rc_getname.h>
#include <rsbac/syscalls.h>
#include <rsbac/error.h>
#include <rsbac/helpers.h>
main()
{
int res,parent_pid,child_pid;
int new_role=4,old_role,wrong_role=0;
union rsbac_attribute_value_t value;
union rsbac_target_id_t tid;
enum rsbac_attribute_t attr;
/*get current process's role ID*/
parent_pid=getpid();
tid.process=parent_pid;
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
old_role=value.u_char_dummy;
printf("%i My RC Role: %u\n",res,value.u_char_dummy);
/*try to set new role*/
value.dummy=new_role;
res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
printf("Setting new role %u to process - (GRANTED)\n",value);
/*get current process role ID*/
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
printf("%i My RC Role: %u\n",res,value.u_char_dummy);
/*try to set wrong role*/
value.dummy=wrong_role;
res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
printf("Setting new role %u to process - (NOT GRANTED)\n",value);
/*get current process role ID*/
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
printf("%i My RC Role: %u\n",res,value.u_char_dummy);
/*try to set previous role*/
value.dummy=old_role;
res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
printf("Setting previos role %u to process - (GRANTED)\n",value);
/*get current process role ID*/
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
printf("%i My RC Role: %u\n",res,value.u_char_dummy);
if(fork()==0)
{
child_pid=getpid();
/*this is a child process*/
printf("child pid: %u parent pid: %u\n",child_pid,parent_pid);
/*get current settings*/
tid.process=child_pid;
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
printf("%i Child RC Role: %u\n",res,value.u_char_dummy);
/*try to set new role to father*/
tid.process=parent_pid;
value.dummy=new_role;
res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
printf("Setting new role %u to Father - (NOT GRANTED)\n",value);
/*get current process role ID*/
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
printf("%i Parent RC Role: %u\n",res,value.u_char_dummy);
/*try to set own new role */
tid.process=child_pid;
value.dummy=new_role;
res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
printf("Setting own new role %u - (GRANTED)\n",value);
/*get current process role ID*/
res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
printf("%i Child RC Role: %u\n",res,value.u_char_dummy);
}else{
wait(&res);
}
}
--------------020007000402020701070104--
-
To unsubscribe from the rsbac list, send a mail to
majordomo@rsbac.org with
unsubscribe rsbac
as single line in the body.
Next Article (by Subject): Re: RC. Dynamic Role Switching Amon Ott
Previous Article (by Subject): RC redirection Stanislav Ievlev
Next in Thread: Re: RC. Dynamic Role Switching Amon Ott
Articles sorted by: [Date]
[Author]
[Subject]