RC. Dynamic Role Switching


From: Stanislav Ievlev <inger@altlinux.ru>
Subject: RC. Dynamic Role Switching
Date: Mon, 18 Jun 2001 16:53:32 +0400

Next Article (by Subject): Re: RC. Dynamic Role Switching Amon Ott
Previous Article (by Subject): RC redirection Stanislav Ievlev
Next in Thread: Re: RC. Dynamic Role Switching Amon Ott
Articles sorted by: [Date] [Author] [Subject]


This is a multi-part message in MIME format.
--------------020007000402020701070104
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Hello!

There are following problem.

Some processes needs different permissions in different time, e.g. http 
server apache need different roles for different virtual hosts
Example:
a) "Role 1" --> (for www.test1.com) Full access to all files in 
/var/www/test1/*, no access outside this dir.
b) "Role 2" --> (for www.test2.com) Full access to all files in 
/var/www/test2/*, no access outside this dir.

Unfortunately, kernel cannot understand process's wishes. Process will 
have to ask kernel - change role itself.

I propose changes in RC for this goal:
To add to rsbac_adf_request_rc() new checking for R_MODIFY_ATTRIBUTE.
New GRANTED: If (target==T_PROCESS) and (process change it's own role) 
and (this role in assigned) then GRANTED

Patch and test program in attach.
---------------------------
With best regards
Stanislav Ievlev.
<inger@linux.ru.net>





--------------020007000402020701070104
Content-Type: text/plain;
 name="rsbac-rcswitch.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="rsbac-rcswitch.patch"

--- linux/rsbac/adf/rc/rc_main.c.orig	Fri Apr 27 17:09:34 2001
+++ linux/rsbac/adf/rc/rc_main.c	Mon Jun 18 14:41:24 2001
@@ -981,6 +981,12 @@
                         if (!(err=rsbac_rc_test_assign_roles(target, tid, attr, attr_val.rc_role)))
                           return(GRANTED);
                       }
+		    /*New checks for Dynamic Role Switching*/
+		    if ( (target==T_PROCESS)&&(tid.process==caller_pid) )
+		      {
+		        if (!(err=rsbac_rc_test_assign_roles(target, tid, attr, attr_val.rc_role)))
+                          return(GRANTED);
+		      }
                     /* Classical admin_type check */
                     if (rsbac_rc_test_role_admin(TRUE))
                       return(NOT_GRANTED);

--------------020007000402020701070104
Content-Type: text/plain;
 name="test.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="test.c"

#include <stdio.h>
#include <stdlib.h>
#include <rsbac/types.h>
#include <rsbac/rc_data_structures.h>
#include <rsbac/getname.h>
#include <rsbac/rc_getname.h>
#include <rsbac/syscalls.h>
#include <rsbac/error.h>
#include <rsbac/helpers.h>
main()
{
    int res,parent_pid,child_pid;
    int new_role=4,old_role,wrong_role=0;
    union rsbac_attribute_value_t value;
    union rsbac_target_id_t tid;
    enum rsbac_attribute_t attr;
      
    /*get current process's role ID*/
    parent_pid=getpid();
    tid.process=parent_pid;
    res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
    old_role=value.u_char_dummy;
    printf("%i My RC Role: %u\n",res,value.u_char_dummy);
    
    /*try to set new role*/
    value.dummy=new_role;
    res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
    printf("Setting new role %u to process - (GRANTED)\n",value);
    /*get current process role ID*/
    res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
    printf("%i My RC Role: %u\n",res,value.u_char_dummy);
    
    /*try to set wrong role*/
    value.dummy=wrong_role;
    res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
    printf("Setting new role %u to process - (NOT GRANTED)\n",value);
    /*get current process role ID*/
    res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
    printf("%i My RC Role: %u\n",res,value.u_char_dummy);
    
    /*try to set previous role*/
    value.dummy=old_role;
    res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
    printf("Setting previos role %u to process - (GRANTED)\n",value);
    /*get current process role ID*/
    res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
    printf("%i My RC Role: %u\n",res,value.u_char_dummy);
    
    if(fork()==0)
    {	
	child_pid=getpid();
	/*this is a child process*/
	printf("child pid: %u parent pid: %u\n",child_pid,parent_pid);
	
	/*get current settings*/
	tid.process=child_pid;
	res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
	printf("%i Child RC Role: %u\n",res,value.u_char_dummy);

	/*try to set new role to father*/
	tid.process=parent_pid;
	value.dummy=new_role;
	res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
	printf("Setting new role %u to Father - (NOT GRANTED)\n",value);
	/*get current process role ID*/
	res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
	printf("%i Parent RC Role: %u\n",res,value.u_char_dummy);

	/*try to set own new role */
	tid.process=child_pid;
	value.dummy=new_role;
	res=rsbac_set_attr(T_PROCESS,&tid,A_rc_role,&value);
	printf("Setting own new role %u  - (GRANTED)\n",value);
	/*get current process role ID*/
	res=rsbac_get_attr(T_PROCESS,&tid,A_rc_role,&value,0);
	printf("%i Child RC Role: %u\n",res,value.u_char_dummy);
    }else{
	wait(&res);
    }
}

--------------020007000402020701070104--

-
To unsubscribe from the rsbac list, send a mail to
majordomo@rsbac.org with
unsubscribe rsbac
as single line in the body.

Next Article (by Subject): Re: RC. Dynamic Role Switching Amon Ott
Previous Article (by Subject): RC redirection Stanislav Ievlev
Next in Thread: Re: RC. Dynamic Role Switching Amon Ott
Articles sorted by: [Date] [Author] [Subject]


Go to Compuniverse LWGate Home Page.