sockfs - a filesystem for reserved port permissions

Malcolm Beattie (mbeattie@sable.ox.ac.uk)
Tue, 16 Sep 1997 19:04:09 +0100 (BST)


Here's sockfs, a little pseudo-filesystem that lets you set the
owner/group/permissions for reserved ports just by using
chown/chgrp/chmod and ls. I wrote it a few weeks ago as an
exercise to see how modular filesystems worked and because it
struck me as being the "right" way to do reserved port permission
checking. I see that there are some other suggested solutions now
so I thought I ought to polish this up and release it.

The only patch necessary to the kernel itself is a tiny one which
(1) creates an exported function pointer
int (*prot_sock_ok)(unsigned int family, unsigned int port)
(2) changes the test in af_inet.c to add:
+ if (prot_sock_ok)
+ return prot_sock_ok(AF_INET, snum);
if (snum < PROT_SOCK && !suser())
return(-EACCES);

The sockfs filesystem is modular, can be built away from the
kernel and lets you do
# mount -t sockfs sockfs /sockfs
after which /sockfs/1, /sockfs/2, ... show up as 700 root-owned
zero-length files just as pid files do under /proc. You can then
use standard tools chown/chgrp/chmod on them: when a process
attempts to bind a reserved port, the kernel (via the prot_sock_ok
function which the filesystem module sets) checks whether the
process has write permission to the relevant file in /sockfs.

Since the whole thing is only 8K when the .tar.gz is uuencoded,
I thought I might as well include it here. Full instructions are
in the included README. The patch and filesystem were written for
a 2.0.29 kernel but I'd be very surprised if it didn't work OK for
pretty much any 2.0.x. There's nothing fancy about it.
Please let me know what you think.

------------------------------ cut here ------------------------------
begin 644 sockfs-a1.tar.gz
M'XL(`(S$'C0``^P\:W?;QK'Y2OR*C9+:I,0W)<J6;->R1"NL)=)'C\9I;@X*
M@DL2)@B@>$AF$_WWSLPN@,6#DM/&]KV]QK%%8I^S\Y[=60:NN9P%K6\^Y<-V
MV_M[>^P;QO;V]_;QDW5V=^E3/FW&^MAHM]OI]:"VL]?N?L/V/BE4\HF"T/`9
M^V8UX4886GQS.^X'GP.@S_L$@OY!Y'&_:7Z:.3KM=E_0NXS^G>Y>=U_2O[?;
MZ7:AJ-?I[G_#VI\&G.SS_YS^K6V-;3-F6T[TH86,D.$'J*/J8]=;^]9\$;+.
MTZ?[=79NV*9KK]@K@3-HT]*T[RS'M*,I9ULXB#X+FHNMM/"9F&+)?8?;S<6+
M0@W0(2PK7QFV[9IE-5"\#$J[N-/(YEBCX:B6R8+0C\R0B=7IL+85VR8H+8>'
M]!ZPYZQ]&+>WG)!AJ>%P^/:<G0Q>'UV?7>EO!Q?G1Z/!Z"K3DB#4'?>V,,;*
MC9R03T4YP#F;\AF[O#H:G1R=C4<##=M4MSW?#74"QUW6JI$36','.D%EG:EO
M-3'.=]R96C--G2=>F#)09APV,U:6O<X.QSS7#VO:KUH%$,9UA';*`<R*-6-5
MT8%]^YP=O=:'H\%53:M4?!Y&OH,P5%K;["\@.S`.,XV`$[:L(+!<)V"&[QMK
MYKA8:X6685L!G]8!!MMF$\-<(KO0)-_F:%!C``S5(&CL&7M[,;[2+\?';]BC
M1^S;`(6P6D-(8E`:@Z/CX\'E81:X.X+O1\Y<!]8PY8;-;JUPP3S?NK%L/H?U
MXP0!F[D^0[K%`-&T+YZG\^96C1@"(N3`_AF[_=(4Z*MHL57#`<W(]X&%&B]F
M060!'VSJ"Y4UC>4>FNT%@-,_3.JX#<C&D2U'G_MNY.E>M7S(.0QYSYB]PPR@
MU2K5/&*OAJ,3??Q&/Q^?#&H(<+;@M]_8+*%#?O`44[F2A$QW"=O>N(`/@MR+
M0H`>9J]*,:47MDT?Q)]BO?#6>&'I#@CY,J4+8#RI"JQ_<B$C9?-@P2R()R$5
MIT]0B8`NF-03'4&MV/8DFM5)2N`+C$MP9)N$*P^E!3Z:,SU<>S@U\HQ^>0UZ
M0C\_.AT>'\;U$PG;VZ/3@7XY_-N@A07NK&J[SKR6-B.E)M80%\U\SK,EQHUA
MV9FB&;!UMMNLT,TQ5MSF#I2-CLX'`-\[Y&B^,KVU'KJ`&5KR(VA<CQ==CDB?
M&]-2BK&49(FBP?5A^:%2%BN?NM1+I'1B(KH>0GA]=J925@I>6RTC@<H6S8M%
MQ"Y0V"EG%&6*T%IA85)@Y`M,67!\?7$!-D"_&IX/U!$RQ%-*EW*Z3KN[*VK4
M405NI+ZE\JYX099'SB"E)"KP:UP<@$HS%[&F)M5)FKA]('4HSO.M9,F+,2BT
MX6@L-&P%%*$3+JM;PFX<@%:>2AHZ$7A"/ON3'?V/LX4"0',IPH;*M4"72WWX
M^F1XP7[#;Q?7IV/Q[1U\.U2;Q\3HLIU4QV9:$/4?"39S7:D8H)3[0`XP+MAX
M`@RX/)3+E>;I0#4<&0W^!Z]8<-U&+9Y9S/R>MO-<VX\Q+:5HHL;WH0E\#B.R
M0\30[\9"@@3`0?S]KN!Z@.\36K.U;BX,9UZJQA/U:H''Z+-M_%NN)XJB45`;
M)<)0XNR4RA)6<]]'A0,?\5P2</2:)+0$WZ&P/-!0<0-D[W]/^OXM3OP\[![/
M(K@=AD84`!$,_08<N"EX!D=75Q?Z]?"$5K%1``"G2<]8'C:.=GKO://L:/.'
M1B,/9?-P4L*2OK%0_1%R$H]Q)Q6_'O`0)\KS4^HAE1G66]\*^0.6-7':8B&9
M6B01&X9$YXI<G0U^#PFA3>Z1:#4AVS)IO`CT*;^1QBQR"DT`V?K)X%B_OASH
MQ^-K#(DJF7!'>/A)%%4CM*;Q21[D#'BI(I.NF^NA7?V5:96<!U*7)1D-%!<J
M^(R+$F=3+:!)H0"]CKA<.'FR4+L[+"H]XBT=0YPJXKM$G0EO*PUBMIET^HKQ
M:$&)(<_&P5@^3$JU$7HUQ4!V*8+F*LQ?9Z>OW^IO!A>CP5FLT`IA5S;(P:"H
M*O5L^Y#E0S%1LK,C-,U]>@`'NU>T[VF@.!87@]/8L;B4+L:/\$TU2HB'#:P4
M<WK"-O=)0UU(SO;4"(TZ0U52J9"L04OPL)TP"4<DJPLD9-4%,VR<:!U'_Z`H
M%%L:N[9W*BT45JJ5#7D`0;;S6.XT&"%GX+:[_IKB5R7RWC@3"NMPE!76#4(O
MG-B,PYJKT"=6&%!M4K<RYH#WTO!'-%#\%93E4I4B$5*50R:ZQ)KSL(JTR=I2
MB:B\JBI@#GHS="6E*IU!Z)32I$R+%=&7PH+REM-B)7LOJ:(/)B6,B<&:'JR#
MD*]$W"@WS.(@\E=5RPG=Q.1RP.2TZRQ12<B8R#6Z'"%51&0EDWTIVCTI,)JF
M;*.,QN>#\Q1NG\\M@,\7@26!6GVD@BE"0[FC!5B\/ANDT(@-.`481P3-41!3
MN2I>R0%3P*_1CD-;0"8A"-:KT)A4VXKYC,<""$A>39L;3N05YBW:FTWJ=(G1
M<J$BW<>(G(_#B-R;^]+;NA_]Q/N]]-'T#/!I__`Y[M__9]W]7K+_O[^[U\':
M3J_]=?__<SR-1D-L_C>ZS7:S^[0EM]);(`3$%<U%<WPQK%Q%G%URCW7Z\.^@
M\^2@VZ6S`&UG9^>A`7*==]L'W5W1^>5+UN@][=4[;;9#G_OLY4N-?0<Z!:10
MZ/N3P>75Q?@GVFQAU4Y[^X>_U32FL=:VUF#;E4N8@H,Y:C?`6/6DF9QP-@&5
M/66A"Y(+XAJPM1LQP^?"X",QF;;SGW1O-IN@'+9;\"<%./&1*F@YM1UM!Z#$
M::`U_V!R#]PZ527!=#B9Z$W3N3<07UI@IL*%$;*0!V$3!VAI.U+5'H]'KX>G
M%`-J._P#*"2'/72*<,_N_R$,+%26LHS+'ZZO3L8_CL"&7[ZI]-**B^._ZG%E
MI:,5F`=I;GDWNRUC1FJT:1:89^]@]^E!N[V!>8H#Y#KO/3W8ZZ?,T^GNUOML
M!S^>$.MH$AF^X7NZY9JAK2_<PJD*&HCM6K+-"*SP^P]B1-<=8D2&G,1I7]X@
M8PXNAPP4K0"/2(!C)+L@U$]Z?83Z2>])`K4(:P/H)`P@%57$.WHPNL-O"3(H
MJ0;+Q@L$%7P!)*#<"5!AQ\+86&8.A>3V09WAT&C?E(DW';<(6,1H5;F33UWO
MRCD`_H/-#DJ(WS_H=@YZ_7N(G_3-]^LF&@<QV'V""(2_4F$D!X`X1FAZ>/:7
M*[7,55FQ[T8A'17N9,N%ZLHT%X>+Z!T8MF4$HC86'N+&?:)K9W]?PE5Y5PW#
MM9ZX#O;4"LQ:G2J6EFWK,R-8.W$)LNP_(NZOX7T'WC,4K<=S,6`X50N0#D(P
M5?4`Y6?#T9N'_1!I_R\&1R?G@T]D8QXX_V_W^OU<_D=WK[WWU?Y_C@<I(*-6
ML#P81$*,Z2V,#FMDCG13IU?$G.E!JE!W@58X#%2R!JIF;4/F`/6Z6H"6!&Z?
M^\8*%2:=7`7N++P%DWM(MA<MI<]!?$+?FH#$,@N"86?:`EC`Z;=F:QH("L%L
M@]8-%V!!:3/$G='+Z>B:G7*'^X;-WD83&X*Q,\OD3L"9`7-C2;"`U4S$0-CE
M-4)Q*:%@K]$AH"VI0\8MJ/<3A'7J#'=,P%X#I#YS/6PE#D<-9\ULB->3QDV(
M!06Z89T&\P(>3=V&@MW;A64N*,Z_#0B,@`.BG#DL1'-O'0P%Z=@75Y^E$,#`
M#>CK<V#5&V&H,-LB;$S=E6$Y&FWD5*TF;\8[Y(DU$*?A'72"=FM-]N."._'N
M15V;6CXW0]QNX`Z@GY?-16,;GL=!F*IXT#A%M'3KK%?7>&@VZ\PW"&FVM>2T
M+J"W"6@H#(GEZ'&)029K]G9X4@.T74$?!4\^]VP#&M)8(JLDY4IF+KBYI#$G
M%BA-9ZYE(`V:;.C`,,8TY@^Y]RL[9HB`.00:;2"`?X;#X6=VN#IR'G4-H"^G
MA<(?#1#BNP`5[MC@0M?H"Q!1!0\HZP%VP-U*8V)S7#3VCC$!DL)7'C$!]D40
MJD"D<9X;MER<>(OA]HR&/$L0`8SO,5'#$#AV?4"'@5M',+?"0!+\)@@CUU(G
MN0H`SPP37`V<6IS\;QY/K`4":F1N^]98!P">05LGZ4PTA;ITA=D%AVME'$[+
M(A+@PG"7E[CC=N%RD"VV,`0"`>DF80U:XHA$.$GD>!M'F;L:!1',OQ;M#-MU
M>`FS23_==)V9-8]`#\4J`"99&#<Q0TONTP03`8N`T`BW7F4QF`)("HJ*P&%T
MINS24)[D*HV&4Q-J3-^%)5&'5MP122,8E0Z&<GTD$)0`XR.&0F)-P7[*TL26
M";(?;L@94S[%]0]'EU='9V='5\/Q2-.JG1H;?`A]X(.T.VAI=Z4R<Z*<R8@X
M:Y@->-``+B!5F#27PAJ`KC0!;-"R37;D>38Q/8B):;L!,@SN16BI?1*;$X@F
MTK(RD8QX2=3<`@>L8`',F(.V"T+J*UQ+!E"AB`8+-[*GJ*=@-LP(`N</1G39
M*L*A@>M0_-3^AKURD=E!C^-0'^2\=3:,!PL7EK-L)M;/G+)6%/BMP#=;Y#`F
M-0+*AM<!1[LU<]W6Q/`S&R^`Z&Z-7?!)9,&XRBI%\A)B!Z(`.0ZNP0(T55%*
M5L9ZPC61;Z/T%K0-:(5QGI:DMS1'J%.6%JHMRT&Z5WLU7`$E:4FV3:@;&P&<
M$/>[DH6MC&5BR#F]`<`VJF-W`OIL#<'T:L(0U<2`0`>A\F$"\/4I(P#5G<Q.
M(FYTY.1%7H'O*RY8JPJQ%H;*?#8#T*B_%/0%PA\%0O9`*$#&IUP9\'%`8`H^
MAB:D@02]F<`?LNU]+`OZ]P?W%N6JGC(6C4#Z``<)I<ZA%4DZNT*W&U+LA?B2
MLK219#2`P_D4[)-8R;D$DTU='N#>Q*WK$[I`D!'1!K,AO$5]$J.06F_1*K9B
M_>`Z(;*T<(L6B$737:V`D&!F.6I+0YPE"!R"?@(\KM:)OI,G<:A["3E6B*RR
M6P-/*E1X!%:7T`^XA*G6CXPUJY*5_V"L/)O7:3*0D8G,UPQ:2AR8C`@!#R#F
M,9`["HA;!2E$4QJ"A$,43VO$G2`$I/6=1&:DMM"TZ\NCTX&F_21=RBDWD8.,
M4$+>0!48TT;8<?0^;PTGC,=J!.':!N.<MYPQJUFH+H2^CH3"ENH:_E@V\U<P
M$\U0TP`9I;.4CBV4>,Z8:.0R$;PYO4X*71H\T)(N,)!HXOHK9%JQ4.`923+$
M(J'S.Z!>@#`F)$B.<)]WM'0@&]T2&,A=62G4LADS_'FT@J^`\9%[RZ2ERT*8
M"/(!:ZD^\=R%R2<\;$IP1.=&?%H:?\@^VI`8A+(XIZ[L8J?5R#P@7`'P/-!;
M.&'E[FN3Q5P!F@,0#[Y(':SHW!>>B+D@PKE"P:%!F%LWW,F[P)B91TX<BI-T
M/E'H#=D<':@6^3?2=BEFONBUHG`+#Y2*A8=HV5:XCE4=K>A`.$_$2>0F5?'H
M",$`[_L#-R/R*^L82T36E#[Q`!:7%82@_M<UVMS$C%W2FK$#6H`-[2AM@PK/
MQ@@:0#+1FDA+E`6BCQU\=R#8"KFY<"S30)@/\BR`JDXNK_^&[`&.2W.3)R@0
MU:*S8,M!UB55A-O`W5UYF@;N6""HN7!MPK:AP2)U<%GG^$&K%`G.H+2OA;M7
M5W7SE-OHJ<JS540[58H35B&U1>%*1$OPGQ^WMP(M0$GE2#+?F*,48/(SCA#/
M@')-O@.>16(HDKC8N%L8:-`=)\90":TGX'P6X3ICJYU$M:H?9Z"^]J0@"U:0
M.Y$4[*'!!0X*T-'!@5-NQZC-F0H`I=A*UT>>'H+82ZTC-8,T'D@PH(G)561*
M:TJ'U$C'U+Y(!)7I6BL-QH@82$5"O+89\9J6WTN(MW!>!LCM3?=#TS";T5+K
M]'$C$;KC?BQM(7[I79?_/8_<_Z.C\2]S_X?U^^U>>O^GO8?W?]J[_:_[?Y_C
MV7#_1_+#?W[_IY`T14F]:)T@H,CEN-75_`A\%;DX=7P'S>[K>%Q5.AZ:R<@K
M#`?^:X#[,D#@;<KEKV=;;-<.2U,S\MEG-(=22!D:E"M6J>!%$QN\BR5K)!$^
MWB91JG&U4(LYA+D:VK!0J@H8JL?]X7N^<\!M"'LV3TNG7YNK085[^3('++`'
M+C'8;5@N6BE$T\8V8.0XQI299J*5.$B=X>D&UHCTN13WY2@N5!&B'Y71@!`3
MKVR"0*0!*M*P@0F#.<A-0&3(<X@6K$/#B:_Y7A2?YLHBIZPT#F;SB%Z6$,]?
ME12NEH"`(O?@3F@93Y5--G,QE-7+JK"+9\P+0Q$3EE5,2C@$:.B8,193<BL1
M2T+M!\6*$FT^AUCE.OVWRU+IA0!5EG*(S\C21PB/2J*O(O/'B4R<93&Z/G]U
M_9IUVK_+>F:O60@3"G^]NB9R6%F<VFKAA43%J,;?*&..C.4DFOTL@/BE_-:6
M56?O,9,/EH$QK+AEF>A?*U!VWAW<'6(3"$A8DT*Q9I/Q?T`0%L/=2BXX(;2-
M%S/=<P/E>A.EJ12O5TB@J_%RMII;=3QRD@`J-TAJ[)G(*%1SG"LBAQF_*=.*
M`N0)W)`+%Q!]SA<$(DW>V3PYSM[]9+,K-Q/2Y.S&<]8MR\[.C%C/)&M7WE/B
M"E*6[GQ8\"KRS.%EZHHVE?>-!A54D`_>_P)M'K<?LQU6M=B?@"O%=1'HVY(I
MP)7*'6XT`L-5+5%9AB,8;.=]7<[>>%]7X20>K<1[_3KNL"#NJIGSR5J*R@PN
M[]0\\';I]:3-3B+Z6!D_$35'(C(X`.70Y_Q&GP=`CFS"?RH=9N:>T7>`C':R
M5P[ST4U"#&*!WD3N=^_>L3&*D#P2!;.WHBT_VFFS`CR/7?\9&4%FFQ!^\6[!
M,V`!C2!]]$B48/(0WM&E,]B?V[]@P>/F8[6^@_54W8FK:S5,!D;JRZ4!S0%2
M)1=:WJI.J[%`W*#"W&&Z$5])[@QH%<D/,&6CP5Y@0A..CBGBA&$PI<!3.#Z^
M"<:GZ]+0]BF1>.YB-EP4QM+"MF-NH[>=YX3F]`[4(];^,(.G#4]^@+M[+G<K
MS=+%4<:Y)!5=#;Z/*Q-$Q/W_#"0X`+0,1W\].CO48'`07,N+:$@EBYGXX^[+
M;D;(>"\^9O@D<SP0_[/N_FX2_[?;]/L?W<[7^/^S/%?CMR?#B^>Y(TMMK%\=
M79P.KMC!\^0<``K'K_YR"03#0OJ!$%=H1*@[5^J^K\;=:YI&&_Q:!2?YNW<[
M_?LA"/D4FHB):X=B._WR^A6\73[__GN\12S/@VIXOT%L*23M6Q=8TZ0CQR^-
MN_^&1\G_IQV;3S''0_G_O7Z2_]_9Z^RC_.]V>E_E_W,\8O\O(;_<\/N8_3[P
M:QS,.-7/AJ/K=V1/]=>7^@])&%.H*/Q.SRSWZSUJWFWAYX'H+(-^TR=S/4"Y
M;`8>@#G9F^4:O!U?7.FOAE>7K-//UKP^.A^>_23J=A6GT<86&;\NN6U>N*U.
M/J"TYWCC&]RL:N>:/7N6F[P&'D^';@@],(V\KEX^$<Z`O]V2'?OP/@B413X(
M`\V5]77RUP@V_8*0!`"OPY<L_C<19-QE\1_?Y&.=9$-#_8$F=*[Q`*\B;I'3
M85Y%W`$7QWD5<8$;0V=Y$>+W;S$>?E37#3^Q4/*#3A]Y(R-WG2#]32?QLT61
MS.?:BE,"M\3O]DPL2@"XX;XU6\M$P-Q&0HQA]5=[($C0A*`?4^*<3`3`;0]*
M*G0A)A!Y%F4Y"!"*(`C8G4YHC;6\T<`X'F@;,TQOE;D&<8YB(;^QB=TIK=1T
M5Q[>P,0$0D.:^GJ2XYN<!*;W8#`SDI(3MIF(R93LA$QN`NFN%`.%W^R",.S_
MW/V\3_U(^T]Y/9]JC@?L?Z?=0?^_U]_K[W7!\&/^?[_[U?Y_EF=NFJSQKW;N
M8`5!(`C`\-VGF!<8@X+HTJDZ=,E(JN,>2DLH%;/W;S;;(.K2*8C_`V41<5P1
M8=S9G;K'`@'.B<YCVU[S@3"G3W3K_TSIUA=Z[EKUW[?*EP)>1).^:.YK@31O
M+*77NKJ7G]O!LE([/RL/[5&;;'_=V77JHK;]>3`:6O3)<CWN6MT\XJZQF:W2
M>;)(14/TSS?5>Z[Y%ZHCXJ.H]:IZ)BEA-</HKWO[2,4DC-U&I[T%E>R4N\('
D%&WN#R64=;WE<+]^%P$``````````````/"]&QI_K$@`>```
`
end
------------------------------ cut here ------------------------------

--Malcolm

-- 
Malcolm Beattie <mbeattie@sable.ox.ac.uk>
Unix Systems Programmer
Oxford University Computing Services