mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-09-19 15:58:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Kernel: Make LocalSocket do chown/chmod through VFS

Browse source 
This ensures that all the permissions checks are made against the
provided credentials. Previously we were just calling through directly
to the inode setters, which did no security checks!
This commit is contained in:
Andreas Kling 2022-08-21 16:22:34 +02:00
commit 8d0bd3f225
Notes: sideshowbarker 2024-07-17 08:05:44 +09:00
1 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

24
Kernel/Net/LocalSocket.cpp
View file

@ -445,25 +445,25 @@ ErrorOr<void> LocalSocket::ioctl(OpenFileDescription& description, unsigned requ
return EINVAL; return EINVAL;
} }
ErrorOr<void> LocalSocket::chmod(Credentials const&, OpenFileDescription&, mode_t mode) ErrorOr<void> LocalSocket::chmod(Credentials const& credentials, OpenFileDescription& description, mode_t mode)
{ {
// FIXME: Use the credentials. if (m_inode) {
if (auto custody = description.custody())
auto inode = m_inode.strong_ref(); return VirtualFileSystem::the().chmod(credentials, *custody, mode);
if (inode) VERIFY_NOT_REACHED();
return inode->chmod(mode); }
m_prebind_mode = mode & 0777; m_prebind_mode = mode & 0777;
return {}; return {};
} }
ErrorOr<void> LocalSocket::chown(Credentials const& credentials, OpenFileDescription&, UserID uid, GroupID gid) ErrorOr<void> LocalSocket::chown(Credentials const& credentials, OpenFileDescription& description, UserID uid, GroupID gid)
{ {
// FIXME: Use the credentials. if (m_inode) {
if (auto custody = description.custody())
auto inode = m_inode.strong_ref(); return VirtualFileSystem::the().chown(credentials, *custody, uid, gid);
if (inode) VERIFY_NOT_REACHED();
return inode->chown(uid, gid); }
if (!credentials.is_superuser() && (credentials.euid() != uid || !credentials.in_group(gid))) if (!credentials.is_superuser() && (credentials.euid() != uid || !credentials.in_group(gid)))
return set_so_error(EPERM); return set_so_error(EPERM);