da21d85025
This patch adds support for Unix98 pseudo terminals, that is, posix_openpt(3), grantpt(3), unlockpt(3), /dev/ptmx, and /dev/pts/. The latter is implemented with a new pseudo file system, PTYFS. In effect, this patch adds secure support for unprivileged pseudo terminal allocation, allowing programs such as tmux(1) to be used by non-root users as well. Test77 has been extended with new tests, and no longer needs to run as root. The new functionality is optional. To revert to the old behavior, remove the "ptyfs" entry from /etc/fstab. Technical nodes: o The reason for not implementing the NetBSD /dev/ptm approach is that implementing the corresponding ioctl (TIOCPTMGET) would require adding a number of extremely hairy exceptions to VFS, including the PTY driver having to create new file descriptors for its own device nodes. o PTYFS is required for Unix98 PTYs in order to avoid that the PTY driver has to be aware of old-style PTY naming schemes and even has to call chmod(2) on a disk-backed file system. PTY cannot be its own PTYFS since a character driver may currently not also be a file system. However, PTYFS may be subsumed into a DEVFS in the future. o The Unix98 PTY behavior differs somewhat from NetBSD's, in that slave nodes are created on ptyfs only upon the first call to grantpt(3). This approach obviates the need to revoke access as part of the grantpt(3) call. o Shutting down PTY may leave slave nodes on PTYFS, but once PTY is restarted, these leftover slave nodes will be removed before they create a security risk. Unmounting PTYFS will make existing PTY slaves permanently unavailable, and absence of PTYFS will block allocation of new Unix98 PTYs until PTYFS is (re)mounted. Change-Id: I822b43ba32707c8815fd0f7d5bb7a438f51421c1
113 lines
2.9 KiB
C
113 lines
2.9 KiB
C
/* ptyfs.c - communication to PTYFS */
|
|
|
|
#include <minix/driver.h>
|
|
#include <minix/ds.h>
|
|
|
|
#include "ptyfs.h"
|
|
|
|
/*
|
|
* Perform synchronous communication with PTYFS, if PTYFS is actually running.
|
|
* This function is expected to return only once PTYFS has acknowledged
|
|
* processing the request, in order to avoid race conditions between PTYFS and
|
|
* userland. The function must always fail when PTYFS is not available for any
|
|
* reason. Return OK on success, or an IPC-level error on failure.
|
|
*/
|
|
static int
|
|
ptyfs_sendrec(message * m_ptr)
|
|
{
|
|
endpoint_t endpt;
|
|
|
|
/*
|
|
* New pseudoterminals are created sufficiently rarely that we need not
|
|
* optimize this by for example caching the PTYFS endpoint, especially
|
|
* since caching brings along new issues, such as having to reissue the
|
|
* request if the cached endpoint turns out to be outdated (e.g., when
|
|
* ptyfs is unmounted and remounted for whatever reason).
|
|
*/
|
|
if (ds_retrieve_label_endpt("ptyfs", &endpt) != OK)
|
|
return EDEADSRCDST; /* ptyfs is not available */
|
|
|
|
return ipc_sendrec(endpt, m_ptr);
|
|
}
|
|
|
|
/*
|
|
* Add or update a node on PTYFS, with the given node index and attributes.
|
|
* Return OK on success, or an error code on failure. Errors may include
|
|
* communication failures and out-of-memory conditions.
|
|
*/
|
|
int
|
|
ptyfs_set(unsigned int index, mode_t mode, uid_t uid, gid_t gid, dev_t dev)
|
|
{
|
|
message m;
|
|
int r;
|
|
|
|
memset(&m, 0, sizeof(m));
|
|
|
|
m.m_type = PTYFS_SET;
|
|
m.m_pty_ptyfs_req.index = index;
|
|
m.m_pty_ptyfs_req.mode = mode;
|
|
m.m_pty_ptyfs_req.uid = uid;
|
|
m.m_pty_ptyfs_req.gid = gid;
|
|
m.m_pty_ptyfs_req.dev = dev;
|
|
|
|
if ((r = ptyfs_sendrec(&m)) != OK)
|
|
return r;
|
|
|
|
return m.m_type;
|
|
}
|
|
|
|
/*
|
|
* Remove a node from PTYFS. Return OK on success, or an error code on
|
|
* failure. The function succeeds even if no node existed for the given index.
|
|
*/
|
|
int
|
|
ptyfs_clear(unsigned int index)
|
|
{
|
|
message m;
|
|
int r;
|
|
|
|
memset(&m, 0, sizeof(m));
|
|
|
|
m.m_type = PTYFS_CLEAR;
|
|
m.m_pty_ptyfs_req.index = index;
|
|
|
|
if ((r = ptyfs_sendrec(&m)) != OK)
|
|
return r;
|
|
|
|
return m.m_type;
|
|
}
|
|
|
|
/*
|
|
* Obtain the file name for the PTYFS node with the given index, and store it
|
|
* in the given 'name' buffer which consists of 'size' bytes. On success,
|
|
* return OK, with the file name stored as a null-terminated string. The
|
|
* returned name does not include the PTYFS mount path. On failure, return an
|
|
* error code. Among other reasons, the function fails if no node is allocated
|
|
* for the given index, and if the name does not fit in the given buffer.
|
|
*/
|
|
int
|
|
ptyfs_name(unsigned int index, char * name, size_t size)
|
|
{
|
|
message m;
|
|
int r;
|
|
|
|
memset(&m, 0, sizeof(m));
|
|
|
|
m.m_type = PTYFS_NAME;
|
|
m.m_pty_ptyfs_req.index = index;
|
|
|
|
if ((r = ptyfs_sendrec(&m)) != OK)
|
|
return r;
|
|
|
|
if (m.m_type != OK)
|
|
return m.m_type;
|
|
|
|
/* Ensure null termination, and make sure the string fits. */
|
|
m.m_ptyfs_pty_name.name[sizeof(m.m_ptyfs_pty_name.name) - 1] = 0;
|
|
if (strlen(m.m_ptyfs_pty_name.name) >= size)
|
|
return ENAMETOOLONG;
|
|
|
|
strlcpy(name, m.m_ptyfs_pty_name.name, size);
|
|
return OK;
|
|
}
|