miniroon

Simplistic macaroon-based authorization for Unix systems
git clone https://ccx.te2000.cz/git/miniroon
Log | Files | Refs

cmd_verify.c (3196B)


      1 #include <errno.h>
      2 #include <assert.h>
      3 #include <stdbool.h>
      4 #include <unistd.h>
      5 #include <sys/select.h>
      6 
      7 // for debug prints
      8 #include <stdio.h>
      9 
     10 #include <skalibs/types.h>
     11 #include <skalibs/strerr.h>
     12 #include <skalibs/djbunix.h>
     13 #include <skalibs/exec.h>
     14 #include <skalibs/netstring.h>
     15 #include <skalibs/uint64.h>
     16 #include <skalibs/stralloc.h>
     17 #include <skalibs/env.h>
     18 
     19 #include "errors.h"
     20 #include "verify_common.h"
     21 #include "bytebuffer.h"
     22 #include "netstring.h"
     23 #include "header.h"
     24 #include "caveats.h"
     25 #include "miniroon_data.h"
     26 #include "decode.h"
     27 #include "fd_util.h"
     28 
     29 /* declarations */
     30 void process_payload(const bytebuffer payload);
     31 void validate_and_exec(miniroon_data *data);
     32 void die_on_error(miniroon_error e);
     33 
     34 /* definitions */
     35 #include "die_impl.h"
     36 
     37 void validate_and_exec(miniroon_data *md) {
     38   miniroon_caveats_state state;
     39   miniroon_caveats_state_init(&state);
     40   // stralloc env_modif;
     41 
     42   for(size_t i=0; i < md->caveat_count; i++) {
     43     dbg_print_bb1("Validate[1] caveat", md->caveats[i]);
     44     miniroon_caveat_prepare(md->caveats[i], &state);
     45   }
     46   for(size_t i=0; i < md->caveat_count; i++) {
     47     dbg_print_bb1("Validate[2] caveat", md->caveats[i]);
     48     miniroon_caveat_validate(md->caveats[i], &state);
     49   }
     50 
     51   /* iff everything validated correctly */
     52   // TODO: pass unused argv from main() ?
     53   char cmd[] = "./run";
     54   const char *cmd_argv[2] = {cmd, 0};
     55   miniroon_caveats_state_exec(&state, cmd_argv);
     56 }
     57 
     58 void process_payload(const bytebuffer payload) {
     59   miniroon_data md;
     60   die_on_error(miniroon_decode(&md, payload));
     61   validate_and_exec(&md);
     62   strerr_dief1x(110, "Internal logic error, should not get here");
     63 }
     64 
     65 void read_payload(int payload_fd, const bytebuffer bb) {
     66   fd_block(payload_fd);
     67 
     68   ssize_t payload_read = fd_read(payload_fd, bb.data, bb.len);
     69   if(payload_read < 0 ) {
     70     strerr_dief1sys(111, "read(payload)");
     71   }
     72   if(payload_read != bb.len) {
     73     strerr_dief1x(111, "could not read whole payload");
     74   }
     75 }
     76 
     77 bool parse_fd(char const *arg, int *fd) {
     78   size_t arg_size = strlen(arg);
     79   return int_scan(arg, fd) == arg_size;
     80 }
     81 
     82 bool parse_size(char const *arg, size_t *size) {
     83   size_t arg_size = strlen(arg);
     84   return size_scan(arg, size) == arg_size;
     85 }
     86 
     87 int main (int argc, char const *const *argv)
     88 {
     89   if (argc != 3) {
     90     strerr_dieusage(100, USAGE);
     91   }
     92 
     93   int payload_fd;
     94   size_t payload_size;
     95 
     96   if(!parse_fd(argv[1], &payload_fd)) {
     97     strerr_dief1x(100, "could not parse payload fd");
     98   }
     99 
    100   if(!parse_size(argv[2], &payload_size)) {
    101     strerr_dief1x(100, "could not parse payload length");
    102   }
    103 
    104   char payload_data[payload_size];
    105   bytebuffer payload = {payload_data, payload_size};
    106   read_payload(payload_fd, payload);
    107   fd_close(payload_fd);
    108 
    109   dbg_print_bb1("Got payload", payload);
    110   process_payload(payload);
    111   strerr_dief1x(110, "Internal logic error, should not get here");
    112   return 110;
    113 }
    114 /*
    115 capability ```
    116 container/bzr.ccx/123456
    117 login/tty1/7890
    118 ```
    119 - secret
    120 - execline command
    121 - env allowlist (re?)
    122 - max execution count/id (uuidv7?)
    123 
    124 ```
    125 caphdr = [capv0;name;invoke-once]
    126 c1 = [caphdr;;h1=hmac(secret, caphdr)]
    127 c2 = [caphdr;[att1];h2=hmac(h1, att1)]
    128 c3 = [caphdr;[att1;att2];h3=hmac(h2, att2)]
    129 ```
    130 */
    131 
    132 /*  vim: sts=2 sw=2 et
    133 */