improving code and build system to be in line with gnunet access control model for...

diff --git a/configure.ac b/configure.ac
index 9dd33ef8f9f22b88759fd81d42b0dae5d56c4ef0..108fcebcf803dda49fb4813df7ea145e34c50e10 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -751,6 +751,28 @@ AC_ARG_WITH(sudo,
 AC_SUBST(SUDO_BINARY)
 
 
+# test for gnunetdns group name
+GNUNETDNS_GROUP=gnunetdns
+AC_MSG_CHECKING(for gnunetdns group name)
+AC_ARG_WITH(gnunetdns,
+  [  --with-gnunetdns=GRPNAME       name for gnunetdns group],
+  [AC_MSG_RESULT("$with_gnunetdns")
+   case $with_gnunetdns in
+   no)
+     GNUNETDNS_GROUP=gnunet
+     ;;
+   yes)
+     GNUNETDNS_GROUP=gnunetdns
+     ;;
+   *)
+     GNUNETDNS_GROUP=$with_gnunetdns
+    ;;
+   esac
+  ],
+  [AC_MSG_RESULT([gnunetdns])])
+AC_SUBST(GNUNETDNS_GROUP)
+
+
 # should 'make check' run tests?
 AC_MSG_CHECKING(whether to run tests)
 AC_ARG_ENABLE([testruns],

diff --git a/src/dht/dht.conf.in b/src/dht/dht.conf.in
index c73c05688f13c0bc82d4ec42d51a8ed0cfe57c41..17c13e93e7af1fa83514f286a3fc33bc99522622 100644 (file)
--- a/src/dht/dht.conf.in
+++ b/src/dht/dht.conf.in
@@ -9,6 +9,7 @@ ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
 BUCKET_SIZE = 4
 UNIXPATH = /tmp/gnunet-service-dht.sock
+# This could be relaxed...
 UNIX_MATCH_UID = YES
 UNIX_MATCH_GID = YES
 # DISABLE_SOCKET_FORWARDING = NO

diff --git a/src/dns/Makefile.am b/src/dns/Makefile.am
index f7376a111b18c640f99c156759d1e039d9c483d4..99e78d7d68b663ad8765e7075c18f4f82d5ff47a 100644 (file)
--- a/src/dns/Makefile.am
+++ b/src/dns/Makefile.am
@@ -20,8 +20,11 @@ HIJACKBIN = gnunet-helper-hijack-dns gnunet-helper-dns
 install-exec-hook:
        $(SUDO_BINARY) chown root:root $(bindir)/gnunet-helper-hijack-dns || true
        $(SUDO_BINARY) chmod u+s $(bindir)/gnunet-helper-hijack-dns || true
-       $(SUDO_BINARY) chown root:root $(bindir)/gnunet-helper-dns || true
-       $(SUDO_BINARY) chmod u+s $(bindir)/gnunet-helper-dns || true
+       $(SUDO_BINARY) chown root $(bindir)/gnunet-helper-dns || true
+       $(SUDO_BINARY) chgrp $(GNUNETDNS_GROUP) $(bindir)/gnunet-helper-dns || true
+       $(SUDO_BINARY) chmod 4750 $(bindir)/gnunet-helper-dns || true
+       $(SUDO_BINARY) chgrp $(GNUNETDNS_GROUP) $(bindir)/gnunet-service-dns-new || true
+       $(SUDO_BINARY) chmod 2755 $(bindir)/gnunet-helper-dns || true
 else
 install-exec-hook:
 endif

diff --git a/src/dns/dns.conf.in b/src/dns/dns.conf.in
index cd1c2e6e3e54736b2cfc8f10c5f81ca277ff39c5..a99f7fec36bf3f5a0dfe82d2a5c0b60fa98b796c 100644 (file)
--- a/src/dns/dns.conf.in
+++ b/src/dns/dns.conf.in
@@ -5,10 +5,9 @@ HOSTNAME = localhost
 HOME = $SERVICEHOME
 CONFIG = $DEFAULTCONFIG
 BINARY = gnunet-service-dns
-ACCEPT_FROM = 127.0.0.1;
-ACCEPT_FROM6 = ::1;
 UNIXPATH = /tmp/gnunet-service-dns.sock
-
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
 PROVIDE_EXIT = YES
 IFNAME = gnunet-dns
 

diff --git a/src/dv/dv.conf.in b/src/dv/dv.conf.in
index fa647e31c4a182bf1b3a7806d63c25df8dc8ed1d..93278df7cc4371e066bb15bd82ed17481744ed6b 100644 (file)
--- a/src/dv/dv.conf.in
+++ b/src/dv/dv.conf.in
@@ -9,6 +9,8 @@ HOME = $SERVICEHOME
 HOSTNAME = localhost
 @UNIXONLY@ PORT = 2571
 UNIXPATH = /tmp/gnunet-service-dv.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
 # ACCEPT_FROM =
 # ACCEPT_FROM6 =
 # REJECT_FROM =

diff --git a/src/transport/transport.conf.in b/src/transport/transport.conf.in
index 213e8f5f087f2e3e422a45116082d3195aec8f94..ff81ff0880372121c26858dec8b0d58216311afb 100644 (file)
--- a/src/transport/transport.conf.in
+++ b/src/transport/transport.conf.in
@@ -12,6 +12,7 @@ ACCEPT_FROM6 = ::1;
 PLUGINS = tcp
 UNIXPATH = /tmp/gnunet-service-transport.sock
 BLACKLIST_FILE = $SERVICEHOME/blacklist
+# This could possibly be relaxed
 UNIX_MATCH_UID = YES
 UNIX_MATCH_GID = YES
 # DISABLE_SOCKET_FORWARDING = NO

diff --git a/src/util/service.c b/src/util/service.c
index 8235830c99dd463274ee765e3d68d47b76cb8278..243e7daa9572d00e5797dca4c421627983e4b8dd 100644 (file)
--- a/src/util/service.c
+++ b/src/util/service.c
@@ -501,14 +501,18 @@ struct GNUNET_SERVICE_Context
   int require_found;
 
   /**
-   * Do we require a matching UID for UNIX domain socket
-   * connections?
+   * Do we require a matching UID for UNIX domain socket connections?
+   * GNUNET_NO means that the UID does not have to match (however,
+   * "match_gid" may still impose other access control checks).
    */
   int match_uid;
 
   /**
-   * Do we require a matching GID for UNIX domain socket
-   * connections?
+   * Do we require a matching GID for UNIX domain socket connections?
+   * Ignored if "match_uid" is GNUNET_YES.  Note that this is about
+   * checking that the client's UID is in our group OR that the
+   * client's GID is our GID.  If both "match_gid" and "match_uid" are
+   * "GNUNET_NO", all users on the local system have access.
    */
   int match_gid;
 
@@ -617,15 +621,50 @@ check_access (void *cls, const struct GNUNET_CONNECTION_Credentials *uc,
 #ifndef WINDOWS
   case AF_UNIX:
     ret = GNUNET_OK;            /* always OK for now */
-    if ((sctx->match_uid == GNUNET_YES) || (sctx->match_gid == GNUNET_YES))
-      ret = GNUNET_NO;
-    if ((uc != NULL) &&
-        ((sctx->match_uid != GNUNET_YES) || (uc->uid == geteuid ()) ||
-         (uc->uid == getuid ())) && ((sctx->match_gid != GNUNET_YES) ||
-                                     (uc->gid == getegid ()) ||
-                                     (uc->gid == getgid ())))
-      ret = GNUNET_YES;
-    else
+    if (sctx->match_uid == GNUNET_YES) 
+    {
+      /* UID match required */
+      ret = (uc != NULL) && (uc->uid == geteuid ());
+    }
+    else if (sctx->match_gid == GNUNET_YES) 
+    {
+      /* group match required */
+      if (uc == NULL) 
+      {
+       /* no credentials, group match not possible */
+       ret = GNUNET_NO;
+      }
+      else
+      {
+       struct group *grp;
+       unsigned int i;
+
+       if (uc->gid != getegid())
+       {
+         /* default group did not match, but maybe the user is in our group, let's check */
+         grp = getgrgid (getegid ());
+         if (NULL == grp)
+         {
+           GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "getgrgid");
+           return GNUNET_NO;
+         }
+         ret = GNUNET_NO;
+         for (i=0; NULL != grp->gr_mem[i]; i++)
+         {
+           struct passwd *nam = getpwnam (grp->gr_mem[i]);
+           if (NULL == nam)
+             continue; /* name in group that is not in user DB !? */
+           if (nam->pw_uid == uc->uid)
+           {
+             /* yes, uid is in our group, allow! */
+             ret = GNUNET_YES;
+             break;
+           }
+         }
+       }
+      }
+    }
+    if (GNUNET_NO == ret)
       LOG (GNUNET_ERROR_TYPE_WARNING, _("Access denied to UID %d / GID %d\n"),
            (uc == NULL) ? -1 : uc->uid, (uc == NULL) ? -1 : uc->gid);
     break;

diff --git a/src/vpn/vpn.conf.in b/src/vpn/vpn.conf.in
index 411ad3fb97f0bc51af8059733c7dd6fb2c639830..f5eb2244754a637d9dff16ffff91680f4b0080ef 100644 (file)
--- a/src/vpn/vpn.conf.in
+++ b/src/vpn/vpn.conf.in
@@ -8,6 +8,8 @@ BINARY = gnunet-service-vpn
 ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
 UNIXPATH = /tmp/gnunet-service-vpn.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
 
 IPV6ADDR = 1234::1
 IPV6PREFIX = 32