Compare commits
4 Commits
new-dialog
...
d4a2cb3749
Author | SHA1 | Date | |
---|---|---|---|
d4a2cb3749
|
|||
bd4cedf996
|
|||
2a1e94f054
|
|||
fb18484aa8 |
10
README.md
10
README.md
@@ -15,15 +15,19 @@ Traditional access control mechanisms in operating systems allow the same level
|
||||
- Install dependencies
|
||||
- libfuse3
|
||||
- Debian: `sudo apt install fuse3 libfuse3-dev`
|
||||
- zenity
|
||||
- Debian: `sudo apt install zenity`
|
||||
- Build tools
|
||||
- Debian: `sudo apt install gcc make pkg-config`
|
||||
- Build using `make`:
|
||||
- In the project directory: `make`
|
||||
- Use `make DEBUG=1` for testing.
|
||||
- Add `DEBUG=1` to show more compiler warnings.
|
||||
- Add `TEST=1` to also test the program.
|
||||
- Add `DIALOGUE=0` to not compile the dialogue program.
|
||||
- Resulting binaries should appear in the `build` directory.
|
||||
|
||||
## Installation
|
||||
|
||||
Currently, there is no installer implemented.
|
||||
|
||||
## Usage
|
||||
|
||||
`icfs <FUSE arguments> [target directory]`
|
||||
|
@@ -41,6 +41,7 @@
|
||||
#include "fuse_operations.h"
|
||||
#include "proc_operations.h"
|
||||
#include "sourcefs.h"
|
||||
#include "temp_permissions_table.h"
|
||||
#include "ui-socket.h"
|
||||
|
||||
static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
|
||||
@@ -67,6 +68,7 @@ static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
|
||||
cfg->negative_timeout = 0;
|
||||
fprintf(stderr, "%d\n", getpid());
|
||||
assert(get_mountpoint() != NULL);
|
||||
init_garbage_collector();
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
@@ -16,6 +16,8 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
|
||||
struct temp_process_permissions {
|
||||
// yes, this is a correct type for start time in jiffies (see
|
||||
@@ -27,6 +29,8 @@ struct temp_process_permissions {
|
||||
|
||||
map(pid_t, struct temp_process_permissions) temp_permissions_table;
|
||||
pthread_mutex_t temp_permissions_table_lock;
|
||||
pthread_t gc_thread;
|
||||
int is_gc_active = 0;
|
||||
|
||||
/**
|
||||
* Function to get the process creation time (in jiffies) from the proc
|
||||
@@ -72,6 +76,49 @@ unsigned long long get_process_creation_time(pid_t pid) {
|
||||
return creation_time;
|
||||
}
|
||||
|
||||
int is_valid(pid_t pid, struct temp_process_permissions *entry) {
|
||||
unsigned long long creation_time = get_process_creation_time(pid);
|
||||
if (creation_time == 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (creation_time != entry->creation_time) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
void *garbage_collector(void *arg) {
|
||||
(void)arg;
|
||||
|
||||
while (is_gc_active) {
|
||||
sleep(1);
|
||||
pthread_mutex_lock(&temp_permissions_table_lock);
|
||||
|
||||
vec(pid_t) blacklist;
|
||||
init(&blacklist);
|
||||
|
||||
for_each(&temp_permissions_table, pid, entry) {
|
||||
if (!is_valid(*pid, entry)) {
|
||||
push(&blacklist, *pid);
|
||||
for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }
|
||||
cleanup(&entry->allowed_files);
|
||||
for_each(&entry->denied_files, denied_file) { free(*denied_file); }
|
||||
cleanup(&entry->denied_files);
|
||||
}
|
||||
}
|
||||
|
||||
for_each(&blacklist, pid) { erase(&temp_permissions_table, *pid); }
|
||||
|
||||
cleanup(&blacklist);
|
||||
|
||||
pthread_mutex_unlock(&temp_permissions_table_lock);
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initializes the temporary permissions table.
|
||||
*
|
||||
@@ -82,6 +129,18 @@ int init_temp_permissions_table(void) {
|
||||
init(&temp_permissions_table);
|
||||
return 0;
|
||||
}
|
||||
/**
|
||||
* Starts the temporary permissions table garbage_collector.
|
||||
*
|
||||
* @return: 0 on success, -1 on failure (e.g. ENOMEM)
|
||||
*/
|
||||
int init_garbage_collector(void) {
|
||||
is_gc_active = 1;
|
||||
if (pthread_create(&gc_thread, NULL, garbage_collector, NULL) != 0) {
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Destroys the temporary permissions table.
|
||||
@@ -91,6 +150,11 @@ int init_temp_permissions_table(void) {
|
||||
* screwed.
|
||||
*/
|
||||
void destroy_temp_permissions_table(void) {
|
||||
if (is_gc_active) {
|
||||
is_gc_active = 0;
|
||||
pthread_join(gc_thread, NULL);
|
||||
}
|
||||
|
||||
// free the memory allocated for the table
|
||||
for_each(&temp_permissions_table, entry) {
|
||||
for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }
|
||||
|
@@ -13,6 +13,13 @@
|
||||
*/
|
||||
int init_temp_permissions_table(void);
|
||||
|
||||
/**
|
||||
* Starts the temporary permissions table garbage_collector.
|
||||
*
|
||||
* @return: 0 on success, -1 on failure (e.g. ENOMEM)
|
||||
*/
|
||||
int init_garbage_collector(void);
|
||||
|
||||
/**
|
||||
* Destroys the temporary permissions table.
|
||||
*
|
||||
|
@@ -210,4 +210,4 @@ fi
|
||||
sleep 0.5
|
||||
#lsof +f -- $(realpath ./protected)
|
||||
umount "$(realpath ./protected)"
|
||||
sleep 0.5
|
||||
sleep 2
|
||||
|
Reference in New Issue
Block a user