2 * Copyright (C) 2017 "IoT.bzh"
3 * Author: José Bollo <jose.bollo@iot.bzh>
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
25 #include <sys/types.h>
26 #include <sys/socket.h>
30 #define MAX_LABEL_LENGTH 1024
32 #if !defined(NO_DEFAULT_PEERCRED) && !defined(ADD_DEFAULT_PEERCRED)
33 # define NO_DEFAULT_PEERCRED
36 #if !defined(DEFAULT_PEERSEC_LABEL)
37 # define DEFAULT_PEERSEC_LABEL "NoLabel"
39 #if !defined(DEFAULT_PEERCRED_UID)
40 # define DEFAULT_PEERCRED_UID 99 /* nobody */
42 #if !defined(DEFAULT_PEERCRED_GID)
43 # define DEFAULT_PEERCRED_GID 99 /* nobody */
45 #if !defined(DEFAULT_PEERCRED_PID)
46 # define DEFAULT_PEERCRED_PID 0 /* no process */
49 static struct afb_cred *current;
51 static struct afb_cred *mkcred(uid_t uid, gid_t gid, pid_t pid, const char *label, size_t size)
53 struct afb_cred *cred;
61 user[i++] = (char)('0' + u % 10);
63 } while(u && i < sizeof user);
65 cred = malloc(2 + i + size + sizeof *cred);
73 dest = (char*)(&cred[1]);
80 memcpy(dest, label, size);
82 dest = strrchr(dest, ':');
89 static struct afb_cred *mkcurrent()
91 char label[MAX_LABEL_LENGTH];
95 fd = open("/proc/self/attr/current", O_RDONLY);
99 rc = read(fd, label, sizeof label);
105 return mkcred(getuid(), getgid(), getpid(), label, (size_t)rc);
108 struct afb_cred *afb_cred_create(uid_t uid, gid_t gid, pid_t pid, const char *label)
110 label = label ? : DEFAULT_PEERSEC_LABEL;
111 return mkcred(uid, gid, pid, label, strlen(label));
114 struct afb_cred *afb_cred_create_for_socket(int fd)
119 char label[MAX_LABEL_LENGTH];
121 /* get the credentials */
122 length = (socklen_t)(sizeof ucred);
123 rc = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &length);
124 if (rc < 0 || length != (socklen_t)(sizeof ucred) || !~ucred.uid) {
125 #if !defined(NO_DEFAULT_PEERCRED)
126 ucred.uid = DEFAULT_PEERCRED_UID;
127 ucred.gid = DEFAULT_PEERCRED_GID;
128 ucred.pid = DEFAULT_PEERCRED_PID;
136 /* get the security label */
137 length = (socklen_t)(sizeof label);
138 rc = getsockopt(fd, SOL_SOCKET, SO_PEERSEC, label, &length);
139 if (rc < 0 || length > (socklen_t)(sizeof label)) {
140 #if !defined(NO_DEFAULT_PEERSEC)
141 length = (socklen_t)strlen(DEFAULT_PEERSEC_LABEL);
142 strcpy (label, DEFAULT_PEERSEC_LABEL);
150 /* makes the result */
151 return mkcred(ucred.uid, ucred.gid, ucred.pid, label, (size_t)length);
154 struct afb_cred *afb_cred_addref(struct afb_cred *cred)
157 __atomic_add_fetch(&cred->refcount, 1, __ATOMIC_RELAXED);
161 void afb_cred_unref(struct afb_cred *cred)
163 if (cred && !__atomic_sub_fetch(&cred->refcount, 1, __ATOMIC_RELAXED)) {
171 struct afb_cred *afb_cred_current()
174 current = mkcurrent();
175 return afb_cred_addref(current);