4 Commits

5 changed files with 81 additions and 4 deletions

View File

@@ -15,15 +15,19 @@ Traditional access control mechanisms in operating systems allow the same level
- Install dependencies
- libfuse3
- Debian: `sudo apt install fuse3 libfuse3-dev`
- zenity
- Debian: `sudo apt install zenity`
- Build tools
- Debian: `sudo apt install gcc make pkg-config`
- Build using `make`:
- In the project directory: `make`
- Use `make DEBUG=1` for testing.
- Add `DEBUG=1` to show more compiler warnings.
- Add `TEST=1` to also test the program.
- Add `DIALOGUE=0` to not compile the dialogue program.
- Resulting binaries should appear in the `build` directory.
## Installation
Currently, there is no installer implemented.
## Usage
`icfs <FUSE arguments> [target directory]`

View File

@@ -41,6 +41,7 @@
#include "fuse_operations.h"
#include "proc_operations.h"
#include "sourcefs.h"
#include "temp_permissions_table.h"
#include "ui-socket.h"
static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
@@ -67,6 +68,7 @@ static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
cfg->negative_timeout = 0;
fprintf(stderr, "%d\n", getpid());
assert(get_mountpoint() != NULL);
init_garbage_collector();
return NULL;
}

View File

@@ -16,6 +16,8 @@
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
struct temp_process_permissions {
// yes, this is a correct type for start time in jiffies (see
@@ -27,6 +29,8 @@ struct temp_process_permissions {
map(pid_t, struct temp_process_permissions) temp_permissions_table;
pthread_mutex_t temp_permissions_table_lock;
pthread_t gc_thread;
int is_gc_active = 0;
/**
* Function to get the process creation time (in jiffies) from the proc
@@ -72,6 +76,49 @@ unsigned long long get_process_creation_time(pid_t pid) {
return creation_time;
}
int is_valid(pid_t pid, struct temp_process_permissions *entry) {
unsigned long long creation_time = get_process_creation_time(pid);
if (creation_time == 0) {
return 0;
}
if (creation_time != entry->creation_time) {
return 0;
}
return 1;
}
void *garbage_collector(void *arg) {
(void)arg;
while (is_gc_active) {
sleep(1);
pthread_mutex_lock(&temp_permissions_table_lock);
vec(pid_t) blacklist;
init(&blacklist);
for_each(&temp_permissions_table, pid, entry) {
if (!is_valid(*pid, entry)) {
push(&blacklist, *pid);
for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }
cleanup(&entry->allowed_files);
for_each(&entry->denied_files, denied_file) { free(*denied_file); }
cleanup(&entry->denied_files);
}
}
for_each(&blacklist, pid) { erase(&temp_permissions_table, *pid); }
cleanup(&blacklist);
pthread_mutex_unlock(&temp_permissions_table_lock);
}
return NULL;
}
/**
* Initializes the temporary permissions table.
*
@@ -82,6 +129,18 @@ int init_temp_permissions_table(void) {
init(&temp_permissions_table);
return 0;
}
/**
* Starts the temporary permissions table garbage_collector.
*
* @return: 0 on success, -1 on failure (e.g. ENOMEM)
*/
int init_garbage_collector(void) {
is_gc_active = 1;
if (pthread_create(&gc_thread, NULL, garbage_collector, NULL) != 0) {
return -1;
}
return 0;
}
/**
* Destroys the temporary permissions table.
@@ -91,6 +150,11 @@ int init_temp_permissions_table(void) {
* screwed.
*/
void destroy_temp_permissions_table(void) {
if (is_gc_active) {
is_gc_active = 0;
pthread_join(gc_thread, NULL);
}
// free the memory allocated for the table
for_each(&temp_permissions_table, entry) {
for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }

View File

@@ -13,6 +13,13 @@
*/
int init_temp_permissions_table(void);
/**
* Starts the temporary permissions table garbage_collector.
*
* @return: 0 on success, -1 on failure (e.g. ENOMEM)
*/
int init_garbage_collector(void);
/**
* Destroys the temporary permissions table.
*

View File

@@ -210,4 +210,4 @@ fi
sleep 0.5
#lsof +f -- $(realpath ./protected)
umount "$(realpath ./protected)"
sleep 0.5
sleep 2