jlcyr/ABSEC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added supplemental groups check

Browse Source
This commit is contained in:
Jean-Luc Cyr
2019-01-15 14:14:22 -05:00
parent 823bd9094d
commit 2fb12410ea
1 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod_absec.c
+23
View File
@@ -303,6 +303,8 @@ static authn_status authn_check_absec(request_rec *r, const char* user, const ch
//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////
// Validate ressource access // Validate ressource access
// request_rec contain user/pass if basic auth
// it could also contain cookies if cookies based auth
static authz_status authz_check_absec(request_rec *r, const char *require_args, const void *parsed_require_args) static authz_status authz_check_absec(request_rec *r, const char *require_args, const void *parsed_require_args)
{ {
char *user = r->user; char *user = r->user;
@@ -362,6 +364,8 @@ static authz_status authz_check_absec(request_rec *r, const char *require_args,
ap_rprintf(r, "Fichier propriétaire<br/>\r\n"); ap_rprintf(r, "Fichier propriétaire<br/>\r\n");
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : Fichier propriétaire<br/>\r\n"); ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : Fichier propriétaire<br/>\r\n");
return AUTHZ_GRANTED; return AUTHZ_GRANTED;
} else {
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : No user access %d", pw->pw_uid);
} }
// If file is group readable and primary group match return content // If file is group readable and primary group match return content
@@ -369,6 +373,25 @@ static authz_status authz_check_absec(request_rec *r, const char *require_args,
ap_rprintf(r, "Fichier groupe<br/>\r\n"); ap_rprintf(r, "Fichier groupe<br/>\r\n");
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : Fichier groupe<br/>\r\n"); ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : Fichier groupe<br/>\r\n");
return AUTHZ_GRANTED; return AUTHZ_GRANTED;
} else {
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : No group access %d", pw->pw_gid);
}
// check supplemental groups
gid_t grouplist[16];
int grouplistsize = 16;
int groupreturn;
groupreturn = getgrouplist(user, pw->pw_gid, grouplist, &grouplistsize);
if (groupreturn >= 0) {
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : liste groups (%d)", grouplistsize);
for (int i=0; i<grouplistsize; i++) {
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : group %d", grouplist[i]);
// If file is group readable and match a supplemental group return content
if ((fperm.st_gid==grouplist[i]) && (fperm.st_mode & 0070 & permmask)) {
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : Fichier group supp");
return AUTHZ_GRANTED;
}
}
} }
ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : DENIED<br/>\r\n"); ap_log_rerror("mod_absec.c", 282, 1, APLOG_ERR, APR_SUCCESS, r, "authz_check_absec : DENIED<br/>\r\n");