2 * Copyright (C) 2015-2020 "IoT.bzh"
3 * Author: José Bollo <jose.bollo@iot.bzh>
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
27 #include <sys/types.h>
28 #include <sys/socket.h>
33 #define MAX_LABEL_LENGTH 1024
35 #if !defined(NO_DEFAULT_PEERCRED) && !defined(ADD_DEFAULT_PEERCRED)
36 # define NO_DEFAULT_PEERCRED
39 #if !defined(DEFAULT_PEERSEC_LABEL)
40 # define DEFAULT_PEERSEC_LABEL "NoLabel"
42 #if !defined(DEFAULT_PEERCRED_UID)
43 # define DEFAULT_PEERCRED_UID 99 /* nobody */
45 #if !defined(DEFAULT_PEERCRED_GID)
46 # define DEFAULT_PEERCRED_GID 99 /* nobody */
48 #if !defined(DEFAULT_PEERCRED_PID)
49 # define DEFAULT_PEERCRED_PID 0 /* no process */
52 static char export_format[] = "%x:%x:%x-%s";
53 static char import_format[] = "%x:%x:%x-%n";
55 static struct afb_cred *current;
57 static struct afb_cred *mkcred(uid_t uid, gid_t gid, pid_t pid, const char *label, size_t size)
59 struct afb_cred *cred;
67 user[i++] = (char)('0' + u % 10);
69 } while(u && i < sizeof user);
71 cred = malloc(2 + i + size + sizeof *cred);
79 cred->exported = NULL;
80 dest = (char*)(&cred[1]);
87 memcpy(dest, label, size);
89 dest = strrchr(dest, ':');
96 static struct afb_cred *mkcurrent()
98 char label[MAX_LABEL_LENGTH];
102 fd = open("/proc/self/attr/current", O_RDONLY);
106 rc = read(fd, label, sizeof label);
112 return mkcred(getuid(), getgid(), getpid(), label, (size_t)rc);
115 struct afb_cred *afb_cred_create(uid_t uid, gid_t gid, pid_t pid, const char *label)
117 label = label ? : DEFAULT_PEERSEC_LABEL;
118 return mkcred(uid, gid, pid, label, strlen(label));
121 struct afb_cred *afb_cred_create_for_socket(int fd)
126 char label[MAX_LABEL_LENGTH];
128 /* get the credentials */
129 length = (socklen_t)(sizeof ucred);
130 rc = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &length);
131 if (rc < 0 || length != (socklen_t)(sizeof ucred) || !~ucred.uid) {
132 #if !defined(NO_DEFAULT_PEERCRED)
133 ucred.uid = DEFAULT_PEERCRED_UID;
134 ucred.gid = DEFAULT_PEERCRED_GID;
135 ucred.pid = DEFAULT_PEERCRED_PID;
143 /* get the security label */
144 length = (socklen_t)(sizeof label);
145 rc = getsockopt(fd, SOL_SOCKET, SO_PEERSEC, label, &length);
146 if (rc < 0 || length > (socklen_t)(sizeof label)) {
147 #if !defined(NO_DEFAULT_PEERSEC)
148 length = (socklen_t)strlen(DEFAULT_PEERSEC_LABEL);
149 strcpy (label, DEFAULT_PEERSEC_LABEL);
157 /* makes the result */
158 return mkcred(ucred.uid, ucred.gid, ucred.pid, label, (size_t)length);
161 struct afb_cred *afb_cred_addref(struct afb_cred *cred)
164 __atomic_add_fetch(&cred->refcount, 1, __ATOMIC_RELAXED);
168 void afb_cred_unref(struct afb_cred *cred)
170 if (cred && !__atomic_sub_fetch(&cred->refcount, 1, __ATOMIC_RELAXED)) {
174 free((void*)cred->exported);
180 struct afb_cred *afb_cred_current()
183 current = mkcurrent();
184 return afb_cred_addref(current);
187 const char *afb_cred_export(struct afb_cred *cred)
191 if (!cred->exported) {
192 rc = asprintf((char**)&cred->exported,
200 cred->exported = NULL;
203 return cred->exported;
206 struct afb_cred *afb_cred_import(const char *string)
208 struct afb_cred *cred;
209 int rc, uid, gid, pid, pos;
211 rc = sscanf(string, import_format, &uid, &gid, &pid, &pos);
213 cred = afb_cred_create((uid_t)uid, (gid_t)gid, (pid_t)pid, &string[pos]);