1*82657471SMarkus Pfeiffer /*
2*82657471SMarkus Pfeiffer * Copyright (c) 2013 Larisa Grigore <larisagrigore@gmail.com>.
3*82657471SMarkus Pfeiffer * All rights reserved.
4*82657471SMarkus Pfeiffer *
5*82657471SMarkus Pfeiffer * Redistribution and use in source and binary forms, with or without
6*82657471SMarkus Pfeiffer * modification, are permitted provided that the following conditions
7*82657471SMarkus Pfeiffer * are met:
8*82657471SMarkus Pfeiffer * 1. Redistributions of source code must retain the above copyright
9*82657471SMarkus Pfeiffer * notice, this list of conditions and the following disclaimer.
10*82657471SMarkus Pfeiffer * 2. Redistributions in binary form must reproduce the above copyright
11*82657471SMarkus Pfeiffer * notice, this list of conditions and the following disclaimer in the
12*82657471SMarkus Pfeiffer * documentation and/or other materials provided with the distribution.
13*82657471SMarkus Pfeiffer * 3. All advertising materials mentioning features or use of this software
14*82657471SMarkus Pfeiffer * must display the following acknowledgement:
15*82657471SMarkus Pfeiffer * This product includes software developed by Herb Peyerl.
16*82657471SMarkus Pfeiffer * 4. The name of Herb Peyerl may not be used to endorse or promote products
17*82657471SMarkus Pfeiffer * derived from this software without specific prior written permission.
18*82657471SMarkus Pfeiffer *
19*82657471SMarkus Pfeiffer * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20*82657471SMarkus Pfeiffer * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21*82657471SMarkus Pfeiffer * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22*82657471SMarkus Pfeiffer * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23*82657471SMarkus Pfeiffer * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24*82657471SMarkus Pfeiffer * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25*82657471SMarkus Pfeiffer * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26*82657471SMarkus Pfeiffer * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27*82657471SMarkus Pfeiffer * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28*82657471SMarkus Pfeiffer * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29*82657471SMarkus Pfeiffer */
30*82657471SMarkus Pfeiffer
31*82657471SMarkus Pfeiffer #include <unistd.h>
32*82657471SMarkus Pfeiffer
33*82657471SMarkus Pfeiffer #include "perm.h"
34*82657471SMarkus Pfeiffer #include <errno.h>
35*82657471SMarkus Pfeiffer
36*82657471SMarkus Pfeiffer static int
is_root(struct cmsgcred * cred)37*82657471SMarkus Pfeiffer is_root(struct cmsgcred *cred) {
38*82657471SMarkus Pfeiffer return (cred->cmcred_euid == 0);
39*82657471SMarkus Pfeiffer }
40*82657471SMarkus Pfeiffer
41*82657471SMarkus Pfeiffer static int
is_grpmember(gid_t gid,struct cmsgcred * cred)42*82657471SMarkus Pfeiffer is_grpmember(gid_t gid, struct cmsgcred *cred) {
43*82657471SMarkus Pfeiffer int n;
44*82657471SMarkus Pfeiffer
45*82657471SMarkus Pfeiffer if (cred->cmcred_gid == gid)
46*82657471SMarkus Pfeiffer return (1);
47*82657471SMarkus Pfeiffer
48*82657471SMarkus Pfeiffer for (n = 0 ; n < cred->cmcred_ngroups ; n++) {
49*82657471SMarkus Pfeiffer if (cred->cmcred_groups[n] == gid)
50*82657471SMarkus Pfeiffer return (1);
51*82657471SMarkus Pfeiffer }
52*82657471SMarkus Pfeiffer
53*82657471SMarkus Pfeiffer return (0);
54*82657471SMarkus Pfeiffer }
55*82657471SMarkus Pfeiffer
56*82657471SMarkus Pfeiffer int
ipcperm(struct cmsgcred * cred,struct ipc_perm * perm,int mode)57*82657471SMarkus Pfeiffer ipcperm(struct cmsgcred *cred, struct ipc_perm *perm, int mode) {
58*82657471SMarkus Pfeiffer if (cred == NULL)
59*82657471SMarkus Pfeiffer return (0);
60*82657471SMarkus Pfeiffer
61*82657471SMarkus Pfeiffer if (cred->cmcred_euid != perm->cuid
62*82657471SMarkus Pfeiffer && cred->cmcred_euid != perm->uid) {
63*82657471SMarkus Pfeiffer /* In order to modify control info the caller must be
64*82657471SMarkus Pfeiffer * owner, creator or privileged.
65*82657471SMarkus Pfeiffer */
66*82657471SMarkus Pfeiffer if (mode & IPC_M)
67*82657471SMarkus Pfeiffer return (is_root(cred) ? 0 : EACCES);
68*82657471SMarkus Pfeiffer
69*82657471SMarkus Pfeiffer /* Check for group match. */
70*82657471SMarkus Pfeiffer mode >>= 3;
71*82657471SMarkus Pfeiffer if (!is_grpmember(perm->gid, cred) &&
72*82657471SMarkus Pfeiffer !is_grpmember(perm->cgid, cred))
73*82657471SMarkus Pfeiffer mode >>= 3;
74*82657471SMarkus Pfeiffer }
75*82657471SMarkus Pfeiffer
76*82657471SMarkus Pfeiffer if (mode & IPC_M)
77*82657471SMarkus Pfeiffer return (0);
78*82657471SMarkus Pfeiffer
79*82657471SMarkus Pfeiffer if ((mode & perm->mode) == mode)
80*82657471SMarkus Pfeiffer return (0);
81*82657471SMarkus Pfeiffer
82*82657471SMarkus Pfeiffer if (is_root(cred))
83*82657471SMarkus Pfeiffer return (0);
84*82657471SMarkus Pfeiffer
85*82657471SMarkus Pfeiffer return (EACCES);
86*82657471SMarkus Pfeiffer }
87