2.5.42: accessfs 3/3: access permission filesystem

PATCH In review Olaf Dietsche 2 participants 2 messages Oct 13, 2002 VFS

Share & tools

Olaf Dietsche

author

2002-10-13 21:39 UTC #0 lore raw

PATCH 1/1 2.5.42: accessfs 3/3: access permission filesystem

This patch adds a new permission managing file system. Furthermore, it adds two modules, which make use of this file system.

One module allows granting capabilities based on user-/groupid. The second module allows to grant access to lower numbered ports based on user-/groupid, too.

Changes:
- fixed module reference counting
- fixed oops, when init_capabilities() failed
- my first try at locking. It seems to work here, but I do have UP only. So SMP might do nasty things, I just don't know.

Regards, Olaf.

MAINTAINERS +6 -0

diff -urN a/MAINTAINERS b/MAINTAINERS
@@ -138,6 +138,12 @@
 L:	[email protected]
 S:	Supported
 
+ACCESS FILE SYSTEM
+P:	Olaf Dietsche
+M:	[email protected]
+M:	[email protected]
+S:	Maintained
+
 ACENIC DRIVER
 P:	Jes Sorensen
 M:	[email protected]

fs/Config.in +3 -0

diff -urN a/fs/Config.in b/fs/Config.in
@@ -108,6 +108,9 @@
    define_bool CONFIG_QUOTACTL y
 fi
 
+dep_tristate 'Accessfs support (EXPERIMENTAL)' CONFIG_ACCESS_FS $CONFIG_EXPERIMENTAL
+source fs/accessfs/Config.in
+
 if [ "$CONFIG_NET" = "y" ]; then
 
    mainmenu_option next_comment

fs/Makefile +1 -0

diff -urN a/fs/Makefile b/fs/Makefile
@@ -84,5 +84,6 @@
 obj-$(CONFIG_SUN_OPENPROMFS)	+= openpromfs/
 obj-$(CONFIG_JFS_FS)		+= jfs/
 obj-$(CONFIG_XFS_FS)		+= xfs/
+obj-$(CONFIG_ACCESS_FS)		+= accessfs/
 
 include $(TOPDIR)/Rules.make

fs/accessfs/Config.help +68 -0

68 lines not on this page · raw message

fs/accessfs/Config.in +11 -0

diff -urN a/fs/accessfs/Config.in b/fs/accessfs/Config.in
@@ -0,0 +1,11 @@
+#
+# Accessfs configuration
+#
+
+if [ "$CONFIG_ACCESS_FS" != "n" ]; then
+	dep_tristate '  User permission based capabilities' CONFIG_ACCESSFS_USER_CAPABILITIES $CONFIG_ACCESS_FS
+	dep_tristate '  User permission based IP ports' CONFIG_ACCESSFS_USER_PORTS $CONFIG_ACCESS_FS
+	if [ "$CONFIG_ACCESSFS_USER_PORTS" != "n" ]; then
+		int '  Range of protected ports (1024-65536)' CONFIG_ACCESSFS_PROT_SOCK 1024
+	fi
+fi

fs/accessfs/Makefile +13 -0

diff -urN a/fs/accessfs/Makefile b/fs/accessfs/Makefile
@@ -0,0 +1,13 @@
+#
+# Makefile for the linux accessfs routines.
+#
+
+obj-$(CONFIG_ACCESS_FS) += accessfs.o
+obj-$(CONFIG_ACCESSFS_USER_CAPABILITIES) += usercaps.o
+obj-$(CONFIG_ACCESSFS_USER_PORTS) += userports.o
+export-objs := inode.o
+accessfs-objs := inode.o
+usercaps-objs := capabilities.o
+userports-objs := ip.o
+
+include $(TOPDIR)/Rules.make

fs/accessfs/capabilities.c +120 -0

120 lines not on this page · raw message

fs/accessfs/inode.c +429 -0

429 lines not on this page · raw message

fs/accessfs/ip.c +92 -0

92 lines not on this page · raw message

include/linux/accessfs_fs.h +49 -0

49 lines not on this page · raw message

Rik van Riel

2002-10-13 22:09 UTC #1 lore raw

fs/accessfs/Config.help line 31

Quoted 5 lines · Olaf Dietsche

This patch adds a new permission managing file system.
fs/accessfs/Config.help +3 -0
+  # mount -t accessfs none /proc/access
+  # chown www /proc/access/net/ip/bind/80
+  # chown mail /proc/access/net/ip/bind/25

I like it. This looks like a good way to run more daemons with less priviledges.

regards,

Rik

Signature · 3 lines

Bravely reimplemented by the knights who say "NIH".
http://www.surriel.com/		http://distro.conectiva.com/
Current spamtrap:  <a href=mailto:"[email protected]">[email protected]</a>