Compare commits
	
		
			4 Commits
		
	
	
		
			new-dialog
			...
			d4a2cb3749
		
	
	| Author | SHA1 | Date | |
|---|---|---|---|
| 
						
						
							
						
						d4a2cb3749
	
				 | 
					
					
						|||
| 
						
						
							
						
						bd4cedf996
	
				 | 
					
					
						|||
| 
						
						
							
						
						2a1e94f054
	
				 | 
					
					
						|||
| fb18484aa8 | 
							
								
								
									
										10
									
								
								README.md
									
									
									
									
									
								
							
							
						
						
									
										10
									
								
								README.md
									
									
									
									
									
								
							@@ -15,15 +15,19 @@ Traditional access control mechanisms in operating systems allow the same level
 | 
			
		||||
- Install dependencies
 | 
			
		||||
  - libfuse3
 | 
			
		||||
    - Debian: `sudo apt install fuse3 libfuse3-dev`
 | 
			
		||||
  - zenity
 | 
			
		||||
    - Debian: `sudo apt install zenity`
 | 
			
		||||
  - Build tools
 | 
			
		||||
    - Debian: `sudo apt install gcc make pkg-config`
 | 
			
		||||
- Build using `make`:
 | 
			
		||||
  - In the project directory: `make`
 | 
			
		||||
  - Use `make DEBUG=1` for testing.
 | 
			
		||||
  - Add `DEBUG=1` to show more compiler warnings.
 | 
			
		||||
  - Add `TEST=1` to also test the program.
 | 
			
		||||
  - Add `DIALOGUE=0` to not compile the dialogue program.
 | 
			
		||||
- Resulting binaries should appear in the `build` directory.
 | 
			
		||||
 | 
			
		||||
## Installation
 | 
			
		||||
 | 
			
		||||
Currently, there is no installer implemented.
 | 
			
		||||
 | 
			
		||||
## Usage
 | 
			
		||||
 | 
			
		||||
`icfs <FUSE arguments> [target directory]`
 | 
			
		||||
 
 | 
			
		||||
@@ -41,6 +41,7 @@
 | 
			
		||||
#include "fuse_operations.h"
 | 
			
		||||
#include "proc_operations.h"
 | 
			
		||||
#include "sourcefs.h"
 | 
			
		||||
#include "temp_permissions_table.h"
 | 
			
		||||
#include "ui-socket.h"
 | 
			
		||||
 | 
			
		||||
static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
 | 
			
		||||
@@ -67,6 +68,7 @@ static void *xmp_init(struct fuse_conn_info *conn, struct fuse_config *cfg) {
 | 
			
		||||
  cfg->negative_timeout = 0;
 | 
			
		||||
  fprintf(stderr, "%d\n", getpid());
 | 
			
		||||
  assert(get_mountpoint() != NULL);
 | 
			
		||||
  init_garbage_collector();
 | 
			
		||||
 | 
			
		||||
  return NULL;
 | 
			
		||||
}
 | 
			
		||||
 
 | 
			
		||||
@@ -16,6 +16,8 @@
 | 
			
		||||
#include <stdio.h>
 | 
			
		||||
#include <string.h>
 | 
			
		||||
#include <sys/types.h>
 | 
			
		||||
#include <time.h>
 | 
			
		||||
#include <unistd.h>
 | 
			
		||||
 | 
			
		||||
struct temp_process_permissions {
 | 
			
		||||
  // yes, this is a correct type for start time in jiffies (see
 | 
			
		||||
@@ -27,6 +29,8 @@ struct temp_process_permissions {
 | 
			
		||||
 | 
			
		||||
map(pid_t, struct temp_process_permissions) temp_permissions_table;
 | 
			
		||||
pthread_mutex_t temp_permissions_table_lock;
 | 
			
		||||
pthread_t gc_thread;
 | 
			
		||||
int is_gc_active = 0;
 | 
			
		||||
 | 
			
		||||
/**
 | 
			
		||||
 * Function to get the process creation time (in jiffies) from the proc
 | 
			
		||||
@@ -72,6 +76,49 @@ unsigned long long get_process_creation_time(pid_t pid) {
 | 
			
		||||
  return creation_time;
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
int is_valid(pid_t pid, struct temp_process_permissions *entry) {
 | 
			
		||||
  unsigned long long creation_time = get_process_creation_time(pid);
 | 
			
		||||
  if (creation_time == 0) {
 | 
			
		||||
    return 0;
 | 
			
		||||
  }
 | 
			
		||||
 | 
			
		||||
  if (creation_time != entry->creation_time) {
 | 
			
		||||
    return 0;
 | 
			
		||||
  }
 | 
			
		||||
 | 
			
		||||
  return 1;
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
void *garbage_collector(void *arg) {
 | 
			
		||||
  (void)arg;
 | 
			
		||||
 | 
			
		||||
  while (is_gc_active) {
 | 
			
		||||
    sleep(1);
 | 
			
		||||
    pthread_mutex_lock(&temp_permissions_table_lock);
 | 
			
		||||
 | 
			
		||||
    vec(pid_t) blacklist;
 | 
			
		||||
    init(&blacklist);
 | 
			
		||||
 | 
			
		||||
    for_each(&temp_permissions_table, pid, entry) {
 | 
			
		||||
      if (!is_valid(*pid, entry)) {
 | 
			
		||||
        push(&blacklist, *pid);
 | 
			
		||||
        for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }
 | 
			
		||||
        cleanup(&entry->allowed_files);
 | 
			
		||||
        for_each(&entry->denied_files, denied_file) { free(*denied_file); }
 | 
			
		||||
        cleanup(&entry->denied_files);
 | 
			
		||||
      }
 | 
			
		||||
    }
 | 
			
		||||
 | 
			
		||||
    for_each(&blacklist, pid) { erase(&temp_permissions_table, *pid); }
 | 
			
		||||
 | 
			
		||||
    cleanup(&blacklist);
 | 
			
		||||
 | 
			
		||||
    pthread_mutex_unlock(&temp_permissions_table_lock);
 | 
			
		||||
  }
 | 
			
		||||
 | 
			
		||||
  return NULL;
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
/**
 | 
			
		||||
 * Initializes the temporary permissions table.
 | 
			
		||||
 *
 | 
			
		||||
@@ -82,6 +129,18 @@ int init_temp_permissions_table(void) {
 | 
			
		||||
  init(&temp_permissions_table);
 | 
			
		||||
  return 0;
 | 
			
		||||
}
 | 
			
		||||
/**
 | 
			
		||||
 * Starts the temporary permissions table garbage_collector.
 | 
			
		||||
 *
 | 
			
		||||
 * @return: 0 on success, -1 on failure (e.g. ENOMEM)
 | 
			
		||||
 */
 | 
			
		||||
int init_garbage_collector(void) {
 | 
			
		||||
  is_gc_active = 1;
 | 
			
		||||
  if (pthread_create(&gc_thread, NULL, garbage_collector, NULL) != 0) {
 | 
			
		||||
    return -1;
 | 
			
		||||
  }
 | 
			
		||||
  return 0;
 | 
			
		||||
}
 | 
			
		||||
 | 
			
		||||
/**
 | 
			
		||||
 * Destroys the temporary permissions table.
 | 
			
		||||
@@ -91,6 +150,11 @@ int init_temp_permissions_table(void) {
 | 
			
		||||
 * screwed.
 | 
			
		||||
 */
 | 
			
		||||
void destroy_temp_permissions_table(void) {
 | 
			
		||||
  if (is_gc_active) {
 | 
			
		||||
    is_gc_active = 0;
 | 
			
		||||
    pthread_join(gc_thread, NULL);
 | 
			
		||||
  }
 | 
			
		||||
 | 
			
		||||
  // free the memory allocated for the table
 | 
			
		||||
  for_each(&temp_permissions_table, entry) {
 | 
			
		||||
    for_each(&entry->allowed_files, allowed_file) { free(*allowed_file); }
 | 
			
		||||
 
 | 
			
		||||
@@ -13,6 +13,13 @@
 | 
			
		||||
 */
 | 
			
		||||
int init_temp_permissions_table(void);
 | 
			
		||||
 | 
			
		||||
/**
 | 
			
		||||
 * Starts the temporary permissions table garbage_collector.
 | 
			
		||||
 *
 | 
			
		||||
 * @return: 0 on success, -1 on failure (e.g. ENOMEM)
 | 
			
		||||
 */
 | 
			
		||||
int init_garbage_collector(void);
 | 
			
		||||
 | 
			
		||||
/**
 | 
			
		||||
 * Destroys the temporary permissions table.
 | 
			
		||||
 *
 | 
			
		||||
 
 | 
			
		||||
@@ -210,4 +210,4 @@ fi
 | 
			
		||||
sleep 0.5
 | 
			
		||||
#lsof +f -- $(realpath ./protected)
 | 
			
		||||
umount "$(realpath ./protected)"
 | 
			
		||||
sleep 0.5
 | 
			
		||||
sleep 2
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user