Updated ui-socket to use the new dialogue

For now, perm table does not set the thrid parameter to anything useful

.gitignore

@@ -2,4 +2,7 @@ build/*
 .clang-tidy
 .cache
 test/protected/*
+test/.pt.db
 compile_commands.json
+test/perf*
+test/callgraph*

Makefile

@@ -12,7 +12,7 @@ CXX := g++
 
 # dependencies
 
-PACKAGE_NAMES := fuse3
+PACKAGE_NAMES := fuse3 sqlite3
 
 ifeq ($(TEST), 1)
 	#	PACKAGE_NAMES += check # TODO: use check?
@@ -43,7 +43,7 @@ endif
 
 # set up targets 
 
-TARGETS := icfs
+TARGETS := $(BUILD_DIR)/icfs
 
 ifeq ($(TEST), 1)
 	TARGETS += icfs_test
@@ -56,12 +56,11 @@ default: $(TARGETS)
 
 .PHONY: clean
 
-icfs: $(BUILD_DIR)/main.o $(BUILD_DIR)/fuse_operations.o $(BUILD_DIR)/sourcefs.o $(BUILD_DIR)/ui-socket.o $(BUILD_DIR)/temp_permissions_table.o
+$(BUILD_DIR)/icfs: $(BUILD_DIR)/main.o $(BUILD_DIR)/fuse_operations.o $(BUILD_DIR)/sourcefs.o $(BUILD_DIR)/ui-socket.o $(BUILD_DIR)/temp_permissions_table.o $(BUILD_DIR)/perm_permissions_table.o
 	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $(BUILD_DIR)/icfs
 
-icfs_test: $(BUILD_DIR)/main.o $(BUILD_DIR)/fuse_operations.o $(BUILD_DIR)/sourcefs.o $(BUILD_DIR)/ui-socket.o
-	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $(BUILD_DIR)/icfs_test
-	# $(BUILD_DIR)/icfs_test # TODO: implement testing
+icfs_test: $(BUILD_DIR)/icfs
+	cd ./test && ./test.bash
 
 $(BUILD_DIR)/test_access_control.o: $(TESTS_DIR)/test_access_control.c
 	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
@@ -72,7 +71,7 @@ $(BUILD_DIR)/main.o: $(SOURCES_DIR)/main.c
 $(BUILD_DIR)/fuse_operations.o: $(SOURCES_DIR)/fuse_operations.c $(SOURCES_DIR)/fuse_operations.h
 	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
 
-$(BUILD_DIR)/sourcefs.o: $(SOURCES_DIR)/sourcefs.c $(SOURCES_DIR)/sourcefs.h
+$(BUILD_DIR)/sourcefs.o: $(SOURCES_DIR)/sourcefs.c $(SOURCES_DIR)/sourcefs.h $(SOURCES_DIR)/real_filename.h
 	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
 
 $(BUILD_DIR)/ui-socket.o: $(SOURCES_DIR)/ui-socket.c $(SOURCES_DIR)/ui-socket.h
@@ -81,5 +80,9 @@ $(BUILD_DIR)/ui-socket.o: $(SOURCES_DIR)/ui-socket.c $(SOURCES_DIR)/ui-socket.h
 $(BUILD_DIR)/temp_permissions_table.o: $(SOURCES_DIR)/temp_permissions_table.c $(SOURCES_DIR)/temp_permissions_table.h
 	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
 
+$(BUILD_DIR)/perm_permissions_table.o: $(SOURCES_DIR)/perm_permissions_table.c $(SOURCES_DIR)/perm_permissions_table.h
+	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $@
+
+
 clean:
 	rm $(BUILD_DIR)/*.o $(BUILD_DIR)/icfs*

src/access_t.h

@@ -0,0 +1,6 @@
+#ifndef ACCESS_T_H
+#define ACCESS_T_H
+
+typedef enum { DENY, ALLOW, ALLOW_TEMP, NDEF } access_t;
+
+#endif // !ACCESS_T_H

src/fuse_operations.c

@@ -11,6 +11,9 @@
   See the file LICENSE.
 */
 
+#include "real_filename.h"
+#include <assert.h>
+#include <stddef.h>
 #define FUSE_USE_VERSION 31
 
 #define _GNU_SOURCE
@@ -39,27 +42,59 @@
 #include "sourcefs.h"
 #include "ui-socket.h"
 
-// TODO: move this to other file
-const char *get_process_name_by_pid(const int pid) {
-  char *name = (char *)calloc(1024, sizeof(char));
-  if (name) {
-    sprintf(name, "/proc/%d/cmdline", pid);
-    FILE *f = fopen(name, "r");
-    if (f) {
-      size_t size;
-      size = fread(name, sizeof(char), 1024, f);
-      if (size > 0) {
-        if ('\n' == name[size - 1])
-          name[size - 1] = '\0';
-      }
-      fclose(f);
+char *get_process_name_by_pid(const int pid) {
+  char path[1024];
+  sprintf(path, "/proc/%d/exe", pid);
+
+  char *name = realpath(path, NULL);
+  if (name == NULL) {
+    fprintf(stderr, "Could not get process name by pid %d", pid);
+    perror("");
+  }
+
+  /*
+  size_t namelen = 32;
+  ssize_t readret = 0;
+  char *name = NULL;
+  while (namelen >= (size_t)readret && readret > 0) {
+    namelen *= 2;
+    name = calloc(namelen, sizeof(char));
+    if (name == NULL) {
+      free(path);
+      fprintf(stderr, "Could not get get process name by pid %d", pid);
+      perror("");
+      return NULL;
+    }
+    readret = readlink(path, name, namelen);
+    if (readret < 0) {
+      free(name);
+      free(path);
+      fprintf(stderr, "Couldn't get process name by pid %d", pid);
+      perror("");
+      return NULL;
+    }
+    if (namelen >= (size_t)readret) {
+      free(name);
     }
   }
-  return name;
-}
+  */
 
-// TODO: move this somewhere else
-const char *real_filename(const char *filename) { return filename; }
+  return name;
+
+  /*
+  FILE *file = fopen(path, "r");
+  if (file) {
+    size_t size = 0;
+    size = fread(path, sizeof(char), 1024, file);
+    if (size > 0) {
+      if ('\n' == path[size - 1]) {
+        path[size - 1] = '\0';
+      }
+    }
+    fclose(file);
+  }
+  */
+}
 
 static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
   (void)conn;
@@ -70,8 +105,8 @@ static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
      To make parallel_direct_writes valid, need either set cfg->direct_io
      in current function (recommended in high level API) or set fi->direct_io
      in xmp_create() or xmp_open(). */
-  // cfg->direct_io = 1;
-  // cfg->parallel_direct_writes = 1;
+  cfg->direct_io = 1;
+  cfg->parallel_direct_writes = 1;
 
   /* Pick up changes from lower filesystem right away. This is
      also necessary for better hardlink support. When the kernel
@@ -83,18 +118,20 @@ static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
   cfg->entry_timeout = 0;
   cfg->attr_timeout = 0;
   cfg->negative_timeout = 0;
+  fprintf(stderr, "%d\n", getpid());
+  assert(get_mountpoint() != NULL);
 
   return NULL;
 }
 
 static int xmp_getattr(const char *path, struct stat *stbuf,
-                       struct fuse_file_info *fi) {
+                       struct fuse_file_info *file_info) {
   int res;
 
   (void)path;
 
-  if (fi)
-    res = fstat(fi->fh, stbuf);
+  if (file_info)
+    res = fstat(file_info->fh, stbuf);
   else
     res = source_stat(path, stbuf);
   if (res == -1) {
@@ -106,17 +143,39 @@ static int xmp_getattr(const char *path, struct stat *stbuf,
 }
 
 static int xmp_access(const char *path, int mask) {
-  int res;
+  int res = -1;
 
-  res = access(path, mask);
-  if (res == -1)
+  // if mask is F_OK, then we don't need to check the permissions
+  // (is that possible?)
+
+  if (mask != F_OK) {
+    struct process_info proc_info;
+    struct fuse_context *context = fuse_get_context();
+
+    proc_info.PID = context->pid;
+    proc_info.name = get_process_name_by_pid(proc_info.PID);
+
+    // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
+
+    if (!interactive_access(path, proc_info, 0)) {
+      free((void *)proc_info.name);
+      return -EACCES;
+    }
+
+    free((void *)proc_info.name);
+  }
+
+  res = source_access(path, mask);
+
+  if (res == -1) {
     return -errno;
+  }
 
   return 0;
 }
 
 static int xmp_readlink(const char *path, char *buf, size_t size) {
-  int res;
+  int res = -1;
 
   res = readlink(path, buf, size - 1);
   if (res == -1)
@@ -243,28 +302,28 @@ static int xmp_mknod(const char *path, mode_t mode, dev_t rdev) {
 */
 
 static int xmp_mkdir(const char *path, mode_t mode) {
-  int res;
+  int res = -1;
 
   res = source_mkdir(path, mode);
-  if (res == -1)
+  if (res == -1) {
     return -errno;
+  }
 
   return 0;
 }
 
 static int xmp_unlink(const char *path) {
-  int res;
+  int res = -1;
   struct process_info pi;
   struct fuse_context *fc = fuse_get_context();
 
   // ask the user for the permission for deleting the file
   pi.PID = fc->pid;
-  pi.UID = fc->uid;
   pi.name = get_process_name_by_pid(pi.PID);
 
   // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
 
-  if (!interactive_access(real_filename(path), pi)) {
+  if (!interactive_access(path, pi, 0)) {
     free(pi.name);
     return -EACCES;
   }
@@ -304,6 +363,28 @@ static int xmp_rename(const char *from, const char *to, unsigned int flags) {
   if (flags)
     return -EINVAL;
 
+  struct process_info pi;
+  struct fuse_context *fc = fuse_get_context();
+
+  pi.PID = fc->pid;
+  pi.name = get_process_name_by_pid(pi.PID);
+
+  // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
+
+  if (!interactive_access(from, pi, 0)) {
+    free(pi.name);
+    return -EACCES;
+  }
+
+  // the "to" file may exist and the process needs to get persmission to modify
+  // it
+  if (source_access(to, F_OK) == 0 && !interactive_access(to, pi, 0)) {
+    free(pi.name);
+    return -EACCES;
+  }
+
+  free(pi.name);
+
   res = source_rename(from, to);
   if (res == -1)
     return -errno;
@@ -313,6 +394,21 @@ static int xmp_rename(const char *from, const char *to, unsigned int flags) {
 
 static int xmp_link(const char *from, const char *to) {
   int res;
+  struct process_info pi;
+  struct fuse_context *fc = fuse_get_context();
+
+  pi.PID = fc->pid;
+  pi.name = get_process_name_by_pid(pi.PID);
+
+  // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
+  if (!interactive_access(from, pi, 0)) {
+    free(pi.name);
+    return -EACCES;
+  }
+
+  // no need to check the access to the "to" file, see link(2)
+
+  free(pi.name);
 
   res = source_link(from, to);
   if (res == -1)
@@ -323,6 +419,19 @@ static int xmp_link(const char *from, const char *to) {
 
 static int xmp_chmod(const char *path, mode_t mode, struct fuse_file_info *fi) {
   int res;
+  struct process_info pi;
+  struct fuse_context *fc = fuse_get_context();
+
+  pi.PID = fc->pid;
+  pi.name = get_process_name_by_pid(pi.PID);
+
+  // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
+  if (!interactive_access(path, pi, 0)) {
+    free(pi.name);
+    return -EACCES;
+  }
+
+  free(pi.name);
 
   if (fi)
     res = fchmod(fi->fh, mode);
@@ -334,9 +443,26 @@ static int xmp_chmod(const char *path, mode_t mode, struct fuse_file_info *fi) {
   return 0;
 }
 
+/**
+ * This filesystem is not designed for multiuser operation (e.g. with
+ * allow_other) so there is little point in having chown implemnted
+ */
 static int xmp_chown(const char *path, uid_t uid, gid_t gid,
                      struct fuse_file_info *fi) {
   int res;
+  struct process_info pi;
+  struct fuse_context *fc = fuse_get_context();
+
+  pi.PID = fc->pid;
+  pi.name = get_process_name_by_pid(pi.PID);
+
+  // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
+  if (!interactive_access(path, pi, 0)) {
+    free(pi.name);
+    return -EACCES;
+  }
+
+  free(pi.name);
 
   if (fi)
     res = fchown(fi->fh, uid, gid);
@@ -382,17 +508,16 @@ static int xmp_utimens(const char *path, const struct timespec ts[2],
 
 static int xmp_create(const char *path, mode_t mode,
                       struct fuse_file_info *fi) {
-  int fd;
+  int fd = -1;
   struct process_info pi;
   struct fuse_context *fc = fuse_get_context();
 
   pi.PID = fc->pid;
-  pi.UID = fc->uid;
   pi.name = get_process_name_by_pid(pi.PID);
 
   // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
 
-  if (!interactive_access(real_filename(path), pi)) {
+  if (!interactive_access(path, pi, GRANT_PERM)) {
     free(pi.name);
     return -EACCES;
   }
@@ -413,11 +538,10 @@ static int xmp_open(const char *path, struct fuse_file_info *fi) {
   struct fuse_context *fc = fuse_get_context();
 
   pi.PID = fc->pid;
-  pi.UID = fc->uid;
   pi.name = get_process_name_by_pid(pi.PID);
 
   // fprintf(stderr, "%s, %d\n", path, ask_access(path, pi));
-  if (!interactive_access(real_filename(path), pi)) {
+  if (!interactive_access(path, pi, 0)) {
     free(pi.name);
     return -EACCES;
   }
@@ -660,7 +784,7 @@ static off_t xmp_lseek(const char *path, off_t off, int whence,
 static const struct fuse_operations xmp_oper = {
     .init = xmp_init,
     .getattr = xmp_getattr,
-    // .access = xmp_access,
+    .access = xmp_access,
     .readlink = xmp_readlink,
     .opendir = xmp_opendir,
     .readdir = xmp_readdir,
@@ -676,7 +800,7 @@ static const struct fuse_operations xmp_oper = {
     .chown = xmp_chown,
     .truncate = xmp_truncate,
 #ifdef HAVE_UTIMENSAT
-// .utimens = xmp_utimens,
+//  .utimens = xmp_utimens,
 #endif
     .create = xmp_create,
     .open = xmp_open,

src/gui/Makefile

@@ -0,0 +1,69 @@
+SHELL=/bin/bash
+
+# configurable options
+
+SOURCES_DIR := .
+TESTS_DIR := .
+BUILD_DIR := .
+
+CC := gcc
+CXX := g++
+
+
+# dependencies
+
+PACKAGE_NAMES := gtk4 libadwaita-1
+
+ifeq ($(TEST), 1)
+	#	PACKAGE_NAMES += check # TODO: use check?
+endif
+
+
+# set up cflags and libs
+
+CFLAGS := -D_FILE_OFFSET_BITS=64
+LDFLAGS :=
+
+CFLAGS += $(shell pkg-config --cflags $(PACKAGE_NAMES))
+LDFLAGS += $(shell pkg-config --libs $(PACKAGE_NAMES))
+
+ifeq ($(DEBUG),1)
+	CFLAGS += -O0 -pedantic -g -Wall -Wextra -Wcast-align \
+						-Wcast-qual -Wdisabled-optimization -Wformat=2 \
+						-Winit-self -Wlogical-op -Wmissing-declarations \
+						-Wmissing-include-dirs -Wredundant-decls -Wshadow \
+						-Wsign-conversion -Wstrict-overflow=5 \
+						-Wswitch-default -Wundef -Wno-unused
+	LDFLAGS += 
+else
+	CFLAGS += -O3
+	LDFLAGS +=
+endif
+
+
+# set up targets 
+
+TARGETS := $(BUILD_DIR)/zenity
+
+ifeq ($(TEST), 1)
+	TARGETS += zenity_test
+endif
+
+
+# build!
+
+default: $(TARGETS)
+
+.PHONY: clean zenity_test
+
+zenity_test: $(BUILD_DIR)/zenity
+	./zenity 666 cat /home/fedir Downloads
+
+$(BUILD_DIR)/zenity: $(BUILD_DIR)/zenity.o
+	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $(BUILD_DIR)/zenity
+
+$(BUILD_DIR)/zenity.o: $(SOURCES_DIR)/zenity-clone.c
+	$(CC) $(CFLAGS) -c $< $(LDFLAGS) -o $(BUILD_DIR)/zenity.o
+
+clean:
+	rm $(BUILD_DIR)/*.o $(BUILD_DIR)/zenity

src/gui/zenity-clone.c

@@ -0,0 +1,153 @@
+#include "gio/gio.h"
+#include "glib-object.h"
+#include "glib.h"
+#include <adwaita.h>
+#include <gtk/gtk.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#define YES 0
+#define NO 1
+#define PERM 2
+
+int exit_code = 0;
+gboolean is_permanent = false;
+GtkEntryBuffer *entry_buffer = NULL;
+GtkWidget *checkbox = NULL;
+
+static void negative_response(GtkWindow *window) {
+  fprintf(stdout, "%s", gtk_entry_buffer_get_text(entry_buffer));
+  exit_code = (gtk_check_button_get_active(GTK_CHECK_BUTTON(checkbox)))
+                  ? YES | PERM
+                  : YES;
+  gtk_window_close(window);
+}
+
+static void positive_response(GtkWindow *window) {
+  fprintf(stdout, "%s", gtk_entry_buffer_get_text(entry_buffer));
+  exit_code = (gtk_check_button_get_active(GTK_CHECK_BUTTON(checkbox)))
+                  ? NO | PERM
+                  : NO;
+  gtk_window_close(window);
+}
+
+static void on_check_button_toggled(GtkToggleButton *button,
+                                    gpointer user_data) {
+  gboolean active = gtk_toggle_button_get_active(button);
+}
+
+static void on_activate(GtkApplication *app, gpointer user_data) {
+  // Create the main window
+  AdwWindow *window = ADW_WINDOW(adw_window_new());
+  gtk_window_set_application(GTK_WINDOW(window), app);
+  gtk_window_set_title(GTK_WINDOW(window), "icfs");
+  // gtk_window_set_default_size(GTK_WINDOW(window), 300, 150);
+
+  AdwStatusPage *content = ADW_STATUS_PAGE(adw_status_page_new());
+  adw_status_page_set_title(content, "Allow access?");
+
+  char *description = NULL;
+  asprintf(
+      &description,
+      "Allow process <tt>%s</tt> with PID <tt>%s</tt> to access <tt>%s</tt>",
+      g_object_get_data(G_OBJECT(app), "accessing_name"),
+      g_object_get_data(G_OBJECT(app), "accessing_pid"),
+      g_object_get_data(G_OBJECT(app), "access_dir"));
+  adw_status_page_set_description(content, description);
+  free(description);
+
+  entry_buffer = gtk_entry_buffer_new(
+      g_object_get_data(G_OBJECT(app), "access_dir"),
+      strlen(g_object_get_data(G_OBJECT(app), "access_dir")));
+
+  GtkWidget *entry = gtk_entry_new();
+  gtk_entry_set_buffer(GTK_ENTRY(entry), entry_buffer);
+  gtk_entry_set_placeholder_text(GTK_ENTRY(entry), "Enter filename");
+  gtk_widget_set_hexpand(entry, TRUE);
+
+  // Create a prefix label and box
+  GtkWidget *entry_box = gtk_box_new(GTK_ORIENTATION_HORIZONTAL, 0);
+  GtkWidget *prefix_label =
+      gtk_label_new(g_object_get_data(G_OBJECT(app), "root_folder"));
+  gtk_box_append(GTK_BOX(entry_box), prefix_label);
+  gtk_box_append(GTK_BOX(entry_box), entry);
+
+  checkbox = gtk_check_button_new_with_label("Permanent");
+  gtk_check_button_set_active(GTK_CHECK_BUTTON(checkbox), false);
+  // gtk_widget_set_halign(checkbox, GTK_ALIGN_CENTER);
+
+  GtkWidget *yes_button = gtk_button_new_with_label("Yes");
+  gtk_widget_set_hexpand(yes_button, TRUE);
+  g_signal_connect_swapped(yes_button, "clicked", G_CALLBACK(positive_response),
+                           window);
+
+  GtkWidget *no_button = gtk_button_new_with_label("No");
+  gtk_widget_set_hexpand(no_button, TRUE);
+  g_signal_connect_swapped(no_button, "clicked", G_CALLBACK(negative_response),
+                           window);
+
+  GtkWidget *button_box = gtk_box_new(GTK_ORIENTATION_HORIZONTAL, 6);
+  gtk_box_append(GTK_BOX(button_box), yes_button);
+  gtk_box_append(GTK_BOX(button_box), no_button);
+  gtk_widget_set_halign(button_box, GTK_ALIGN_FILL);
+
+  // Combine everything in a box
+  GtkWidget *box = gtk_box_new(GTK_ORIENTATION_VERTICAL, 12);
+  gtk_box_append(GTK_BOX(box), GTK_WIDGET(content));
+  gtk_box_append(GTK_BOX(box), entry_box);
+  gtk_box_append(GTK_BOX(box), checkbox);
+  gtk_box_append(GTK_BOX(box), button_box);
+  gtk_widget_set_margin_top(GTK_WIDGET(box), 12);
+  gtk_widget_set_margin_bottom(GTK_WIDGET(box), 12);
+  gtk_widget_set_margin_start(GTK_WIDGET(box), 12);
+  gtk_widget_set_margin_end(GTK_WIDGET(box), 12);
+
+  // g_signal_connect(window, "response", G_CALLBACK(gtk_window_close), window);
+
+  // Show the dialog
+  adw_window_set_content(window, box);
+  gtk_window_present(GTK_WINDOW(window));
+}
+
+static int on_command_line(GApplication *app, GApplicationCommandLine *cmdline,
+                           gpointer user_data) {
+  gchar **argv;
+  gint argc;
+
+  argv = g_application_command_line_get_arguments(cmdline, &argc);
+
+  // Handle your arguments here
+  if (argc >= 4) {
+    fprintf(stderr, "%s\n", argv[1]);
+    g_object_set_data_full(G_OBJECT(app), "accessing_pid", g_strdup(argv[1]),
+                           g_free);
+    g_object_set_data_full(G_OBJECT(app), "accessing_name", g_strdup(argv[2]),
+                           g_free);
+    g_object_set_data_full(G_OBJECT(app), "root_folder", g_strdup(argv[3]),
+                           g_free);
+    g_object_set_data_full(G_OBJECT(app), "access_dir", g_strdup(argv[4]),
+                           g_free);
+  }
+
+  g_strfreev(argv);
+
+  // Activate the application
+  g_application_activate(app);
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  // Create a new application
+  AdwApplication *app = adw_application_new("com.example.zenityclone",
+                                            G_APPLICATION_HANDLES_COMMAND_LINE);
+
+  g_signal_connect(app, "command-line", G_CALLBACK(on_command_line), NULL);
+  g_signal_connect(app, "activate", G_CALLBACK(on_activate), NULL);
+
+  // Run the application
+  int status = g_application_run(G_APPLICATION(app), argc, argv);
+  g_object_unref(app);
+
+  return (status == 0) ? exit_code : status;
+}

src/main.c

@@ -15,9 +15,10 @@
 #define _GNU_SOURCE
 
 #include <fuse3/fuse.h>
-
 #include <stdio.h>
 #include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
 
 #include "fuse_operations.h"
 #include "sourcefs.h"
@@ -26,25 +27,36 @@
 const char *mountpoint = NULL;
 
 int main(int argc, char *argv[]) {
+  if (argc < 3) {
+    fprintf(stderr, "Usage: icfs <FUSE arguments> [target directory] [path to "
+                    "the permanent permissions database\n");
+    return EXIT_FAILURE;
+  }
+
+  // if umask != 0, the filesystem will create files with more restrictive
+  // permissions than it's caller reqested
   umask(0);
 
-  mountpoint = realpath(argv[argc - 1], NULL);
+  // ui socket should always be initialized before anything else, since it
+  // handles the setuid bits!
+  int ret = init_ui_socket(argv[argc - 1]);
+  if (ret != 0) {
+    fprintf(stderr, "Could not initalize ui-socket.\n");
+    exit(EXIT_FAILURE);
+  }
 
-  int ret = source_init(mountpoint);
+  mountpoint = realpath(argv[argc - 2], NULL);
+
+  ret = source_init(mountpoint);
   if (ret != 0) {
     perror("source_init");
     exit(EXIT_FAILURE);
   }
 
-  ret = init_ui_socket();
-  if (ret != 0) {
-    perror("init_ui_socket");
-    exit(EXIT_FAILURE);
-  }
+  ret = fuse_main(argc - 1, argv, get_fuse_operations(), NULL);
 
-  ret = fuse_main(argc, argv, get_fuse_operations(), NULL);
-
-  free(mountpoint);
+  free((void *)mountpoint);
+  source_destroy();
   destroy_ui_socket();
   return ret;
 }

src/perm_permissions_table.c

@@ -0,0 +1,262 @@
+/*
+  ICFS: Interactively Controlled File System
+  Copyright (C) 2024-2025  Fedir Kovalov
+
+  This program can be distributed under the terms of the GNU GPLv2.
+  See the file LICENSE.
+*/
+
+#include "perm_permissions_table.h"
+#include "access_t.h"
+#include "process_info.h"
+#include <fcntl.h>
+#include <pthread.h>
+#include <sqlite3.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/fsuid.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+sqlite3 *perm_database = NULL;
+const char *const table_name = "permissions";
+// one row corresponds to a permission to access one file for one executable
+const int column_count = 3;
+const char *const schema[] = {"executable", "filename", "mode"};
+const char *const types[] = {"TEXT", "TEXT", "INTEGER"};
+uid_t ruid, euid, current_pid;
+pthread_mutex_t uid_switch = PTHREAD_MUTEX_INITIALIZER;
+
+void set_db_fsuid() {
+  pthread_mutex_lock(&uid_switch);
+  if (current_pid == ruid)
+    return;
+
+  int status = -1;
+
+  status = setfsuid(ruid);
+  if (status < 0) {
+    fprintf(stderr, "Couldn't set uid to %d.\n", ruid);
+    exit(status);
+  }
+  pthread_mutex_unlock(&uid_switch);
+}
+
+void set_real_fsuid() {
+  pthread_mutex_lock(&uid_switch);
+  if (current_pid == ruid)
+    return;
+
+  int status = -1;
+
+  status = setfsuid(ruid);
+  if (status < 0) {
+    fprintf(stderr, "Couldn't set uid to %d.\n", euid);
+    exit(status);
+  }
+  pthread_mutex_unlock(&uid_switch);
+}
+
+static int check_table_col_schema(void *notused, int argc, char **argv,
+                                  char **colname) {
+  (void)notused;
+  (void)colname;
+  if (argc < 3) {
+    fprintf(stderr, "Unexpected amount of arguments given to the callback.\n");
+    return 1;
+  }
+  int column_num = atoi(argv[0]);
+  if (column_num >= column_count) {
+    fprintf(stderr, "Table contains unexpected amount of columns.\n");
+    return 1;
+  }
+
+  if (strcmp(schema[column_num], argv[1]) == 0 &&
+      strcmp(types[column_num], argv[2]) == 0) {
+    return 0;
+  }
+  fprintf(stderr, "Column %d does not conform to the schema.\n", column_num);
+  return 1;
+}
+
+static int set_flag(void *flag, int argc, char **argv, char **colname) {
+  (void)argc;
+  (void)argv;
+  (void)colname;
+  *(int *)flag = 1;
+  return 0;
+}
+
+int create_database_schema() {
+  fprintf(stderr, "Creating table 'permissions'.\n");
+  const char *create_query =
+      "CREATE TABLE permissions(executable TEXT NOT "
+      "NULL, filename TEXT NOT NULL, mode INTEGER NOT NULL);";
+  char *err = NULL;
+  int ret = sqlite3_exec(perm_database, create_query, NULL, NULL, &err);
+
+  if (ret != SQLITE_OK) {
+    fprintf(stderr, "sqlite3 error: %s\n", err);
+    sqlite3_free(err);
+    return 1;
+  }
+
+  fprintf(stderr, "Database created successfully\n");
+  return 0;
+}
+
+/**
+ * Ensures that the database schema is correct.
+ *
+ * @return: 0 if the schema is correct, 1 if the schema could not be corrected.
+ */
+int ensure_database_schema() {
+  // Check for the table.
+  int result = sqlite3_table_column_metadata(
+      perm_database, NULL, table_name, NULL, NULL, NULL, NULL, NULL, NULL);
+  if (result == SQLITE_ERROR) {
+    fprintf(stderr, "Table '%s' does not exist.\n", table_name);
+    if (create_database_schema()) {
+      fprintf(stderr, "Table could not be created.\n");
+      return 1;
+    }
+    return 0;
+  } else if (result != SQLITE_OK) {
+    fprintf(stderr, "Database metadata could not be retrieved.\n");
+    return 1;
+  }
+
+  const char *pragma = "PRAGMA table_info(permissions);";
+  char *err = NULL;
+  int ret =
+      sqlite3_exec(perm_database, pragma, check_table_col_schema, NULL, &err);
+
+  if (ret != SQLITE_OK) {
+    fprintf(stderr, "sqlite3 error: %s\n", err);
+    sqlite3_free(err);
+    return 1;
+  }
+
+  fprintf(stderr, "Schema is correct.\n");
+  return 0;
+}
+
+/**
+ * Initializes the permanent permissions table.
+ *
+ * @param db_filename: The filename of the permissions sqlite3 database
+ * @return: 0 on success, -1 on failure
+ */
+int init_perm_permissions_table(const char *db_filename) {
+  // we don't want the group and others to access the db
+  umask(0077);
+  ruid = getuid();
+  euid = geteuid();
+  fprintf(stderr, "Running with uid: %d, gid: %d\n", euid, getegid());
+
+  if (sqlite3_open_v2(db_filename, &perm_database,
+                      SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE |
+                          SQLITE_OPEN_FULLMUTEX,
+                      NULL)) {
+    perror("Can't open permanent permissions database");
+    return -1;
+  }
+  umask(0);
+  if (ensure_database_schema()) {
+    fprintf(stderr, "Database schema is not correct.\n");
+    return -1;
+  }
+
+  int status = seteuid(ruid);
+  if (status < 0) {
+    fprintf(stderr, "Couldn't set euid to ruid during database setup.\n");
+    exit(status);
+  }
+
+  return 0;
+}
+
+/**
+ * Destroys the permanent permissions table.
+ */
+void destroy_perm_permissions_table() { sqlite3_close(perm_database); }
+
+/**
+ * Checks if the process has a permanent access to the file.
+ *
+ * @param filename: The file that the process is trying to access
+ * @pram pi: The process information
+ * @return: access status - ALLOW, DENY or NDEF in case if no information was
+ * found
+ */
+access_t check_perm_access(const char *filename, struct process_info pi) {
+
+  char *query = NULL;
+  int ret = asprintf(&query,
+                     "SELECT * FROM %s WHERE executable = \'%s\' "
+                     "AND filename = \'%s\' AND mode = TRUE;",
+                     table_name, pi.name, filename);
+
+  if (ret < 0) {
+    // If asprintf fails, the contents of query are undefined (see man
+    // asprintf). That does not explicitly rule out that query will be a valid
+    // pointer. But the risk of freeing a non-allocated pointer is too much to
+    // justify preparing for this.
+    fprintf(stderr, "Could not create query on access check");
+    perror("");
+    return NDEF;
+  }
+
+  char *sqlite_error = NULL;
+  int flag = 0;
+  ret = sqlite3_exec(perm_database, query, set_flag, &flag, &sqlite_error);
+  free((void *)query);
+  if (ret != SQLITE_OK) {
+    fprintf(stderr, "SQLite returned an error: %s\n", sqlite_error);
+    sqlite3_free(sqlite_error);
+    return NDEF;
+  }
+
+  if (flag) {
+    return ALLOW;
+  }
+  return NDEF;
+}
+
+/**
+ * Gives permanent access to the process to the file.
+ *
+ * @param filename: The file that the process is trying to access
+ * @param pi: The process information
+ * @return: 0 on success, 1 on failure
+ */
+int give_perm_access(const char *filename, struct process_info pi) {
+  char *query = NULL;
+  int ret = asprintf(&query, "INSERT INTO %s VALUES (\'%s\', \'%s\', TRUE);",
+                     table_name, pi.name, filename);
+
+  if (ret < 0) {
+    // If asprintf fails, the contents of query are undefined (see man
+    // asprintf). That does not explicitly rule out that query will be a valid
+    // pointer. But the risk of freeing a non-allocated pointer is too much to
+    // justify preparing for this.
+    fprintf(stderr, "Could not create query on rule insertion");
+    perror("");
+    return 1;
+  }
+
+  char *sqlite_error = NULL;
+  ret = sqlite3_exec(perm_database, query, NULL, NULL, &sqlite_error);
+  free(query);
+  if (ret != SQLITE_OK) {
+    fprintf(stderr, "SQLite returned an error: %s\n", sqlite_error);
+    sqlite3_free(sqlite_error);
+    free(query);
+    return 1;
+  }
+
+  return 0;
+}

src/perm_permissions_table.h

@@ -0,0 +1,47 @@
+/*
+  ICFS: Interactively Controlled File System
+  Copyright (C) 2024-2025  Fedir Kovalov
+
+  This program can be distributed under the terms of the GNU GPLv2.
+  See the file LICENSE.
+*/
+
+#ifndef PERM_PERMISSION_TABLE_H
+#define PERM_PERMISSION_TABLE_H
+
+#include "access_t.h"
+#include "process_info.h"
+
+/**
+ * Initializes the permanent permissions table.
+ *
+ * @param db_filename: The filename of the permissions sqlite3 database
+ * @return: 0 on success, -1 on failure (e.g. ENOMEM)
+ */
+int init_perm_permissions_table(const char *db_filename);
+
+/**
+ * Destroys the permanent permissions table.
+ */
+void destroy_perm_permissions_table();
+
+/**
+ * Checks if the process has a permanent access to the file.
+ *
+ * @param filename: The file that the process is trying to access
+ * @pram pi: The process information
+ * @return: access status - ALLOW, DENY or NDEF in case if no information was
+ * found
+ */
+access_t check_perm_access(const char *filename, struct process_info pi);
+
+/**
+ * Gives permanent access to the process to the file.
+ *
+ * @param filename: The file that the process is trying to access
+ * @param pi: The process information
+ * @return: 0 on success, -1 on failure
+ */
+int give_perm_access(const char *filename, struct process_info pi);
+
+#endif // #ifdef PERM_PERMISSION_TABLE_H

src/process_info.h

@@ -1,3 +1,10 @@
+/*
+  ICFS: Interactively Controlled File System
+  Copyright (C) 2024-2025  Fedir Kovalov
+
+  This program can be distributed under the terms of the GNU GPLv2.
+  See the file LICENSE.
+*/
 
 #ifndef PROCESS_INFO_H
 #define PROCESS_INFO_H
@@ -5,8 +12,7 @@
 #include <sys/types.h>
 struct process_info {
   pid_t PID;
-  const char *name;
-  uid_t UID;
+  char *name;
 };
 
 #endif // PROCESS_INFO_H

src/real_filename.h

@@ -0,0 +1,7 @@
+#ifndef REAL_FILENAME_H
+#define REAL_FILENAME_H
+
+const char *real_filename(const char *filename);
+const char *get_mountpoint(void);
+
+#endif // !REAL_FILENAME_H

src/sourcefs.c

@@ -10,14 +10,14 @@
 
 #include "sourcefs.h"
 #include <dirent.h>
-#include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
-#include <sys/stat.h>
 #include <unistd.h>
 
 static struct source_files_handle {
+  const char *mountpoint;
   int root_fd;
 } handle;
 
@@ -30,9 +30,19 @@ const char *source_filename_translate(const char *filename) {
 }
 
 int source_init(const char *root_path) {
+  handle.mountpoint = malloc(strlen(root_path) + 1);
+  if (handle.mountpoint == NULL) {
+    perror("Malloc failed");
+    return -1;
+  }
+
+  strcpy(handle.mountpoint, root_path);
+
   int root_fd = open(root_path, O_PATH);
 
   if (root_fd == -1) {
+    fprintf(stderr, "Could not initialize source file system at %s", root_path);
+    perror("");
     return -1;
   }
 
@@ -41,6 +51,32 @@ int source_init(const char *root_path) {
   return 0;
 }
 
+void source_destroy(void) { free(handle.mountpoint); }
+
+const char *get_mountpoint(void) { return handle.mountpoint; }
+
+const char *real_filename(const char *filename) {
+  const char *mountpoint = get_mountpoint();
+  // Calculate required length
+  size_t len1 = strlen(mountpoint);
+  size_t len2 = strlen(filename);
+  size_t total_len = len1 + len2;
+
+  // Allocate memory (+1 for null terminator)
+  char *result = malloc(total_len + 1);
+  if (result == NULL) {
+    fprintf(stderr, "Memory allocation failed");
+    perror("");
+    return NULL;
+  }
+
+  // Copy strings
+  strcpy(result, mountpoint);
+  strcat(result, filename);
+
+  return result;
+}
+
 int source_mkdir(const char *filename, mode_t mode) {
   const char *relative_filename = source_filename_translate(filename);
   return mkdirat(handle.root_fd, relative_filename, mode);
@@ -66,6 +102,11 @@ int source_symlink(const char *target, const char *linkpath) {
   return symlinkat(target, handle.root_fd, relative_linkpath);
 }
 
+int source_access(const char *filename, int mode) {
+  const char *relative_filename = source_filename_translate(filename);
+  return faccessat(handle.root_fd, relative_filename, mode, 0);
+}
+
 DIR *source_opendir(const char *filename) {
   const char *relative_filename = source_filename_translate(filename);
   int fd = openat(handle.root_fd, relative_filename, 0);

src/sourcefs.h

@@ -19,6 +19,7 @@
  * @return 0 on success, -1 on failure.
  */
 int source_init(const char *root_path);
+void source_destroy(void);
 
 /* All of the functions below are designed to behave exactly as their non-source
  * counterparts. */
@@ -47,6 +48,8 @@ int source_chown(const char *filename, uid_t owner, gid_t group);
 
 int source_truncate(const char *filename, off_t length);
 
+int source_access(const char *filename, int mode);
+
 /* `open` and `create` are designed to correspond to fuse operations, not the
  * libc's `open(2)`. Both of them actually call `openat`. */
 

src/temp_permissions_table.c

@@ -7,6 +7,7 @@
 */
 
 #include "temp_permissions_table.h"
+#include "access_t.h"
 #include "cc.h"
 #include "process_info.h"
 #include <pthread.h>
@@ -18,6 +19,7 @@ struct temp_process_permissions {
   // proc_pid_stat(5))
   unsigned long long creation_time;
   vec(char *) allowed_files;
+  vec(char *) denied_files;
 };
 
 map(pid_t, struct temp_process_permissions) temp_permissions_table;
@@ -33,8 +35,8 @@ pthread_mutex_t temp_permissions_table_lock;
  * never really equal to 0, it exceptionally unlikely.
  */
 unsigned long long get_process_creation_time(pid_t pid) {
-  char path[32];
-  FILE *fp;
+  char path[256];
+  FILE *fp = NULL;
   unsigned long long creation_time = 0;
 
   // Construct the path to the process's status file
@@ -72,22 +74,30 @@ unsigned long long get_process_creation_time(pid_t pid) {
  *
  * @return: 0 on success, -1 on failure (e.g. ENOMEM)
  */
-int init_temp_permissions_table() {
+int init_temp_permissions_table(void) {
   pthread_mutex_init(&temp_permissions_table_lock, PTHREAD_MUTEX_DEFAULT);
   init(&temp_permissions_table);
+  return 0;
 }
 
 /**
  * Destroys the temporary permissions table.
  *
- * @note: the table is guranteed to be destroyed if it is already initialized
+ * @note: the table is guranteed to be destroyed if it is already initialized.
+ * It does not indicate any errors whatsoever. If something goes wrong - you are
+ * screwed.
  */
-void destroy_temp_permissions_table() {
+void destroy_temp_permissions_table(void) {
   // free the memory allocated for the table
   for_each(&temp_permissions_table, entry) {
     for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }
     cleanup(&entry->allowed_files);
   }
+  for_each(&temp_permissions_table, entry) {
+    for_each(&entry->denied_files, denied_file) { free(*denied_file); }
+    cleanup(&entry->denied_files);
+  }
+
   cleanup(&temp_permissions_table);
   pthread_mutex_destroy(&temp_permissions_table_lock);
 }
@@ -97,10 +107,10 @@ void destroy_temp_permissions_table() {
  *
  * @param filename: The file that the process is trying to access
  * @pram pid: PID of the process
- * @return: 0 if access is denied, 1 if access is allowed
+ * @return: access status - ALLOW, DENY or NDEF in case if no information was
+ * found is avaliable
  */
-
-int check_temp_access_noparent(const char *filename, pid_t pid) {
+access_t check_temp_access_noparent(const char *filename, pid_t pid) {
   // TODO: more efficient locking
   pthread_mutex_lock(&temp_permissions_table_lock);
   struct temp_process_permissions *permission_entry =
@@ -110,22 +120,28 @@ int check_temp_access_noparent(const char *filename, pid_t pid) {
     if (process_creation_time == 0) {
       perror("Could not retrieve process creation time");
       pthread_mutex_unlock(&temp_permissions_table_lock);
-      return 0;
+      return NDEF;
     }
 
     if (process_creation_time == permission_entry->creation_time) {
       // the process is the same as the one that was granted temporary access
       // to the file
+      for_each(&permission_entry->denied_files, denied_file) {
+        if (strncmp(*denied_file, filename, strlen(filename)) == 0) {
+          pthread_mutex_unlock(&temp_permissions_table_lock);
+          return DENY;
+        }
+      }
       for_each(&permission_entry->allowed_files, allowed_file) {
         if (strncmp(*allowed_file, filename, strlen(filename)) == 0) {
           pthread_mutex_unlock(&temp_permissions_table_lock);
-          return 1;
+          return ALLOW;
         }
       }
     }
   }
   pthread_mutex_unlock(&temp_permissions_table_lock);
-  return 0;
+  return NDEF;
 }
 
 /**
@@ -164,31 +180,36 @@ pid_t get_parent_pid(pid_t pid) {
  *
  * @param filename: The file that the process is trying to access
  * @pram pi: The process information
- * @return: 0 if access is denied, 1 if access is allowed
+ * @return: access status - ALLOW, DENY or NDEF in case if no information was
+ * found. Does not return ALLOW_TEMP.
  * @note: In case one of the parent processes is killed while this function
  * execution the result is not guranteed to be correct. It should only lead to
  * false negatives, though.
  */
-int check_temp_access(const char *filename, struct process_info pi) {
+access_t check_temp_access(const char *filename, struct process_info pi) {
   pid_t current_pid = pi.PID;
   while (current_pid != 0) {
-    if (check_temp_access_noparent(filename, current_pid)) {
-      return 1;
+    access_t access = check_temp_access_noparent(filename, current_pid);
+    if (access != NDEF) {
+      return access;
     }
     current_pid = get_parent_pid(current_pid);
   }
 
-  return 0;
+  return NDEF;
 }
 
 /**
- * Gives temporary access to the process to the file.
+ * Sets temporary access mode of the process to the file.
  *
  * @param filename: The file that the process is trying to access
  * @param pi: The process information
- * @return: 0 on success, -1 on failure (e.g. ENOMEM)
+ * @param mode: Kind of access rule to be set - SET_DENY to deny access, and
+ * SET_ALLOW to allow access.
+ * @return: 0 on success, -1 on failure.
  */
-int give_temp_access(const char *filename, struct process_info pi) {
+int set_temp_access(const char *filename, struct process_info pi,
+                    set_mode_t mode) {
   pthread_mutex_lock(&temp_permissions_table_lock);
   struct temp_process_permissions *permission_entry =
       get(&temp_permissions_table, pi.PID);
@@ -206,7 +227,13 @@ int give_temp_access(const char *filename, struct process_info pi) {
     if (process_creation_time == permission_entry->creation_time) {
       // the process is the same as the one that was granted temporary access
       // to the file
-      push(&permission_entry->allowed_files, strdup(filename));
+      if (mode == SET_ALLOW) {
+        push(&permission_entry->allowed_files, strdup(filename));
+      }
+      if (mode == SET_DENY) {
+        push(&permission_entry->denied_files, strdup(filename));
+      }
+
       pthread_mutex_unlock(&temp_permissions_table_lock);
       return 0;
     }
@@ -222,10 +249,15 @@ int give_temp_access(const char *filename, struct process_info pi) {
 
   new_permission_entry.creation_time = get_process_creation_time(pi.PID);
   init(&new_permission_entry.allowed_files);
-  push(&new_permission_entry.allowed_files, strdup(filename));
+  init(&new_permission_entry.denied_files);
+  if (mode == SET_ALLOW) {
+    push(&new_permission_entry.allowed_files, strdup(filename));
+  }
+  if (mode == SET_DENY) {
+    push(&new_permission_entry.denied_files, strdup(filename));
+  }
 
   insert(&temp_permissions_table, pi.PID, new_permission_entry);
-  printf("temp_permissions_table size: %ld\n", size(&temp_permissions_table));
 
   pthread_mutex_unlock(&temp_permissions_table_lock);
   return 0;

src/temp_permissions_table.h

@@ -2,6 +2,7 @@
 #ifndef TEMP_PERMISSIONS_TABLE_H
 #define TEMP_PERMISSIONS_TABLE_H
 
+#include "access_t.h"
 #include "process_info.h"
 
 /**
@@ -9,31 +10,43 @@
  *
  * @return: 0 on success, -1 on failure (e.g. ENOMEM)
  */
-int init_temp_permissions_table();
+int init_temp_permissions_table(void);
 
 /**
  * Destroys the temporary permissions table.
  *
- * @note: the table is guranteed to be destroyed if it is already initialized
+ * @note: the table is guranteed to be destroyed if it is already initialized.
+ * It does not indicate any errors whatsoever. If something goes wrong - you are
+ * screwed.
  */
-void destroy_temp_permissions_table();
+void destroy_temp_permissions_table(void);
 
 /**
- * Checks if the process has a temporary access to the file.
+ * Checks if the process or any of it's parents have temporary access to the
+ * file.
+ *
+ * @param filename: The file that the process is trying to access
+ * @pram pi: The process information
+ * @return: access status - ALLOW, DENY or NDEF in case if no information was
+ * found. Does not return ALLOW_TEMP.
+ * @note: In case one of the parent processes is killed while this function
+ * execution the result is not guranteed to be correct. It should only lead to
+ * false negatives, though.
+ */
+access_t check_temp_access(const char *filename, struct process_info pi);
+
+typedef enum { SET_DENY, SET_ALLOW } set_mode_t;
+
+/**
+ * Sets temporary access mode of the process to the file.
  *
  * @param filename: The file that the process is trying to access
  * @param pi: The process information
- * @return: 0 if access is denied, 1 if access is allowed
+ * @param mode: Kind of access rule to be set - SET_DENY to deny access, and
+ * SET_ALLOW to allow access.
+ * @return: 0 on success, -1 on failure.
  */
-int check_temp_access(const char *filename, struct process_info pi);
-
-/**
- * Gives temporary access to the process to the file.
- *
- * @param filename: The file that the process is trying to access
- * @param pi: The process information
- * @return: 0 on success, -1 on failure (e.g. ENOMEM)
- */
-int give_temp_access(const char *filename, struct process_info pi);
+int set_temp_access(const char *filename, struct process_info pi,
+                    set_mode_t mode);
 
 #endif // !TEMP_PERMISSIONS_TABLE_H

src/ui-socket.c

@@ -6,14 +6,16 @@
   See the file LICENSE.
 */
 
+#include "access_t.h"
 #include <stddef.h>
 #include <sys/types.h>
 #include <time.h>
 #define _GNU_SOURCE
 #include "cc.h"
+#include "perm_permissions_table.h"
+#include "real_filename.h"
 #include "temp_permissions_table.h"
 #include "ui-socket.h"
-#include <errno.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -22,11 +24,22 @@
 #include <sys/un.h>
 #include <unistd.h>
 
-int init_ui_socket() {
-  char line[256];
-  FILE *fp;
+#define ZENITY_YES 0
+#define ZENITY_NO 1
+#define ZENITY_PERM 2
 
-  init_temp_permissions_table();
+int init_ui_socket(const char *perm_permissions_db_filename) {
+  FILE *fp = NULL;
+
+  if (init_temp_permissions_table()) {
+    fprintf(stderr, "Could not initialize temporary permissions table.\n");
+    return 1;
+  }
+
+  if (init_perm_permissions_table(perm_permissions_db_filename)) {
+    fprintf(stderr, "Could not initialize permanent permissions table.\n");
+    return 1;
+  }
 
   // Test if Zenity is installed (get version)
   fp = popen("zenity --version", "r");
@@ -35,34 +48,39 @@ int init_ui_socket() {
     return 1;
   }
 
-  while (fgets(line, sizeof(line), fp))
-    printf("%s", line);
   pclose(fp);
   return 0;
 }
 
-void destroy_ui_socket() { destroy_temp_permissions_table(); }
+void destroy_ui_socket(void) {
+  destroy_temp_permissions_table();
+  destroy_perm_permissions_table();
+}
 
 /**
  * Asks the user if the process should be allowed to access the file using the
  * GUI
  *
  * @param filename: The file that the process is trying to access
- * @pram pi: The process information
- * @return: 0 if access is denied, 1 if access is allowed, 2 if access is allwed
- * for the runtime of the process
+ * @param pi: The process information
+ * @return: access status - ALLOW, DENY or ALLOW_TEMP
+ * allowed for the runtime of the process
  */
-int ask_access(const char *filename, struct process_info pi) {
+access_t ask_access(const char *filename, struct process_info proc_info) {
+  FILE *fp = NULL;
+  char *command = NULL;
+  int ret = asprintf(&command, "zenity \"%d\" \"%s\" \"%s\" \"%s\"",
+                     proc_info.PID, proc_info.name, filename, get_mountpoint());
 
-  FILE *fp;
-  size_t command_len =
-      139 + sizeof(pid_t) * 8 + strlen(pi.name) + strlen(filename);
-  char *command = (char *)malloc(command_len);
-  snprintf(command, command_len,
-           "zenity --question --extra-button \"Allow this time\" --title "
-           "\"Allow Access?\" --text \"Allow process "
-           "<tt>%s</tt> with PID <tt>%d</tt> to access <tt>%s</tt>\"",
-           pi.name, pi.PID, filename);
+  if (ret < 0) {
+    // If asprintf fails, the contents of command are undefined (see man
+    // asprintf). That does not explicitly rule out that command will be a valid
+    // pointer. But the risk of freeing a non-allocated pointer is too much to
+    // justify preparing for this.
+    fprintf(stderr, "Could not create query on rule insertion");
+    perror("");
+    return 1;
+  }
 
   // Zenity Question Message Popup
   fp = popen(command, "r");
@@ -70,44 +88,35 @@ int ask_access(const char *filename, struct process_info pi) {
 
   if (fp == NULL) {
     perror("Pipe returned a error");
-    return -1;
+    return DENY;
   }
 
-  // if the user clicks the "Allow this time" button, `zenity` will only
-  // write it to `stdout`, but the exit code will still be `1`. So, we need
-  // to manually check the output.
-  char buffer[1024];
-  while (fgets(buffer, sizeof(buffer), fp)) {
-    printf("%s", buffer);
-    if (strcmp(buffer, "Allow this time\n") == 0) {
-      pclose(fp);
-      return 2;
-    }
+  str(char) zenity_output;
+  init(&zenity_output);
+
+  size_t total_read = 0;
+  char line[1024]; // Buffer to read individual lines
+
+  // Read the command output line by line
+  while (fgets(line, sizeof(line), fp)) {
+    size_t line_len = strlen(line);
+    push_fmt(&zenity_output, line);
   }
 
   int zenity_exit_code = WEXITSTATUS(pclose(fp));
-  // zenity returns 1 on "No" >:(
-  if (zenity_exit_code == 0) {
-    return 1;
+  fprintf(stderr, "zenity wrote out %s\n", first(&zenity_output));
+  fprintf(stderr, "zenity returned %d\n", zenity_exit_code);
+
+  cleanup(&zenity_output);
+
+  if (zenity_exit_code == (ZENITY_YES | ZENITY_PERM)) {
+    return ALLOW;
+  }
+  if (zenity_exit_code == ZENITY_YES) {
+    return ALLOW_TEMP;
   }
 
-  return 0;
-}
-
-/**
- * Checks if the process has a permanent access to the file.
- *
- * @param filename: The file that the process is trying to access
- * @pram pi: The process information
- * @return: 0 if access is denied, 1 if access is allowed
- */
-int check_perm_access(const char *filename, struct process_info pi) {
-  perror("Not implemented");
-  return 0;
-}
-int give_perm_access(const char *filename, struct process_info pi) {
-  perror("Not implemented");
-  return -1;
+  return DENY;
 }
 
 /**
@@ -118,26 +127,67 @@ int give_perm_access(const char *filename, struct process_info pi) {
  *
  * @param filename: The file that the process is trying to access
  * @pram pi: The process information
+ * @param opts: options (GRANT_TEMP, GRANT_PERM)
  * @return: 0 if access is denied, 1 if access is allowed
  */
-int interactive_access(const char *filename, struct process_info pi) {
+int interactive_access(const char *filename, struct process_info proc_info,
+                       int opts) {
+  char *real_path = real_filename(filename);
 
-  if (check_temp_access(filename, pi) || check_perm_access(filename, pi)) {
-    // access was already granted before
+  access_t access = check_temp_access(real_path, proc_info);
+  if (access == ALLOW) {
+    free(real_path);
+    return 1;
+  }
+  if (access == DENY) {
+    free(real_path);
+    return 0;
+  }
+
+  access = check_perm_access(real_path, proc_info);
+  if (access == ALLOW) {
+    free(real_path);
+    return 1;
+  }
+  if (access == DENY) {
+    free(real_path);
+    return 0;
+  }
+
+  // if noth GRANT_TEMP and GRANT_PERM are selected, then only permanent
+  // permissions are granted
+
+  if (opts & GRANT_PERM) {
+    give_perm_access(real_path, proc_info);
+    free(real_path);
+    return 1;
+  }
+  if (opts & GRANT_TEMP) {
+    set_temp_access(real_path, proc_info, SET_ALLOW);
+    free(real_path);
     return 1;
   }
 
-  int user_response = ask_access(filename, pi);
-  if (user_response == 1) {
-    // user said "yes"
-    give_perm_access(filename, pi);
-    return 1;
-  } else if (user_response == 2) {
-    // user said "yes, but only this time"
-    give_temp_access(filename, pi);
+  access_t user_response = ask_access(real_path, proc_info);
+  if (user_response == ALLOW) {
+    give_perm_access(real_path, proc_info);
+    free(real_path);
     return 1;
   }
 
-  // otherwise "no"
+  if (user_response == ALLOW_TEMP) {
+    set_temp_access(real_path, proc_info, SET_ALLOW);
+    free(real_path);
+    return 1;
+  }
+
+  if (user_response == DENY) {
+    set_temp_access(real_path, proc_info, SET_DENY);
+    free(real_path);
+    return 0;
+  }
+
+  free(real_path);
+  // deny on unknown options.
   return 0;
 }

src/ui-socket.h

@@ -21,7 +21,7 @@
  *
  * @return: 0 on success, -1 on faliure.
  */
-int init_ui_socket(void);
+int init_ui_socket(const char *perm_permissions_db_filename);
 
 /**
  * Close the GUI communication.
@@ -36,8 +36,13 @@ void destroy_ui_socket(void);
  *
  * @param filename: The file that the process is trying to access
  * @pram pi: The process information
+ * @param opts: options (GRANT_TEMP, GRANT_PERM)
  * @return: 0 if access is denied, 1 if access is allowed
  */
-int interactive_access(const char *filename, struct process_info pi);
+int interactive_access(const char *filename, struct process_info pi, int opts);
+
+#define GRANT_TEMP 1
+#define GRANT_PERM 2
+// #define TABLE_ONLY 4 // NOTE: Add this in the future?
 
 #endif // !UI_SOCKET_H

test/mock/zenity

@@ -20,4 +20,4 @@ else
   fi
 fi
 
-exit -1 # TODO: call actual zenity here
+exit 255 # TODO: call actual zenity here

test/test.bash

@@ -2,9 +2,10 @@
 
 # clean what was left from previous tests
 
+rm -f ./.pt.db
 rm -rf ./protected
 mkdir protected
-touch ./protected/do-not-remove ./protected/should-be-removed ./protected/truth ./protected/perm000 ./protected/perm777 ./protected/this-name-is-wrong
+touch ./protected/do-not-remove ./protected/should-be-removed ./protected/truth ./protected/perm000 ./protected/perm777 ./protected/should-be-renamed ./protected/do-not-rename
 chmod 777 ./protected/perm777 ./protected/perm000
 echo "Free code, free world." >./protected/motto
 
@@ -15,31 +16,48 @@ PATH="$(realpath ./mock/):$PATH"
 # mount the filesystem
 
 echo "Run $(date -u +%Y-%m-%dT%H:%M:%S) "
-valgrind -s ../build/icfs -o default_permissions ./protected &
+if [[ $1 == "--setuid" ]]; then
+  echo "Setting the setuid bit..."
+  echo "root privilieges are required to create a special user and set correct ownership of the executable."
+  id -u icfs &>/dev/null || sudo useradd --system --user-group icfs
+  sudo chown icfs: ../build/icfs && sudo chmod 4777 ../build/icfs
+  chmod g+w . # needed for icfs to be able to create the database
+  echo "Valgrind will not be used due to setuid compatibility issues."
+  ../build/icfs -o default_permissions ./protected ./.pt.db &
+  sleep 1
+else
+  echo "Database protection will not be tested due to the lack of setuid capabilites."
+  echo "To test it, run this script with '--setuid'."
+  valgrind -s ../build/icfs -o default_permissions ./protected ./.pt.db &
+  sleep 5
+fi
 
-sleep 1
+#valgrind -s ../build/icfs -o default_permissions ./protected &
+
+# WARN: please don't use `>` or `>>` operators. They force **this script** to open the file, **not the program you are trying to run**. This is probably not what you mean when you want to test a specific program's access.
+# WARN: avoid using touch, since it generates errors because setting times is not implemented in icfs **yet**.
 
 # create files
 
 zenity --set-fake-response no
-touch ./protected/should-not-exist 2>/dev/null &&
-  echo "[ICFS-TEST]: touch can create protected/should-not-exist despite access being denied!" ||
-  echo "[ICFS-TEST]: OK" # EACCESS
+truncate -s 0 ./protected/should-exist-anyway 2>/dev/null &&
+  echo "[ICFS-TEST]: OK" ||
+  echo "[ICFS-TEST]: truncate cannot create protected/should-exist despite access being permitted!" # OK
 
 zenity --set-fake-response yes_tmp
-touch ./protected/should-exist 2>/dev/null &&
+truncate -s 0 ./protected/should-exist 2>/dev/null &&
   echo "[ICFS-TEST]: OK" ||
-  echo "[ICFS-TEST]: touch cannot create protected/should-exist despite access being permitted!" # OK
+  echo "[ICFS-TEST]: truncate cannot create protected/should-exist despite access being permitted!" # OK
 
 # write to files
 
 zenity --set-fake-response no
-echo "Linux is a cancer that attaches itself in an intellectual property sense to everything it touches." >./protected/truth 2>/dev/null &&
+sed -e 'a\'"Linux is a cancer that attaches itself in an intellectual property sense to everything it touches." "./protected/truth" 2>/dev/null &&
   echo "[ICFS-TEST]: echo can write to protected/lie despite access being denied!" ||
   echo "[ICFS-TEST]: OK" # EACCESS
 
 zenity --set-fake-response yes_tmp
-echo "Sharing knowledge is the most fundamental act of friendship. Because it is a way you can give something without loosing something." >./protected/truth 2>/dev/null &&
+sed -e 'a\'"Sharing knowledge is the most fundamental act of friendship. Because it is a way you can give something without loosing something." "./protected/truth" 2>/dev/null &&
   echo "[ICFS-TEST]: OK" ||
   echo "[ICFS-TEST]: echo cannot write to protected/truth despite access being permitted!" # OK
 
@@ -70,11 +88,11 @@ rm ./protected/should-be-removed >/dev/null 2>/dev/null &&
 # rename files
 
 zenity --set-fake-response no
-mv ./protected/truth ./protected/lie 2>/dev/null &&
+mv ./protected/do-not-rename ./protected/terrible-name 2>/dev/null &&
   echo "[ICFS-TEST]: mv can rename protected/truth despite access being denied!" ||
   echo "[ICFS-TEST]: OK" # EACCESS
 zenity --set-fake-response yes_tmp
-mv ./protected/this-name-is-wrong ./protected/this-name-is-correct 2>/dev/null &&
+mv ./protected/should-be-renamed ./protected/great-name 2>/dev/null &&
   echo "[ICFS-TEST]: OK" ||
   echo "[ICFS-TEST]: mv cannot rename should-be-removed to renamed-file despite access being permitted!" # OK
 
@@ -89,6 +107,25 @@ chmod 000 ./protected/perm000 2>/dev/null &&
   echo "[ICFS-TEST]: OK" ||
   echo "[ICFS-TEST]: chmod cannot change permissions of protected/perm000 despite access being permitted!" # OK
 
+# test permanent permissions
+
+zenity --set-fake-response yes
+cat ./protected/motto >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: OK" ||
+  echo "[ICFS-TEST]: echo cannot read protected/motto despite access being permitted!" # OK
+
+zenity --set-fake-response no # this should be ignored
+cat ./protected/motto >/dev/null 2>/dev/null &&
+  echo "[ICFS-TEST]: OK" ||
+  echo "[ICFS-TEST]: echo cannot read protected/motto despite access being permitted!" # OK
+
+# test database access
+if [[ -r "./.pt.db" || -w "./.pt.db" ]]; then
+  echo "[ICFS-TEST]: permanent permissions is accessible!"
+else
+  echo "[ICFS-TEST]: OK"
+fi
+
 # unmount
 
 sleep 0.5