Finish initial conversion of mod_authz_owner

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/authz-dev@354979 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/aaa/mod_authz_core.c b/modules/aaa/mod_authz_core.c
index 2973875a6f9bed50eace769233ad760e0747d258..5d98c07297411bfdf0958b168b99cb8ace853855 100644 (file)
--- a/modules/aaa/mod_authz_core.c
+++ b/modules/aaa/mod_authz_core.c
@@ -58,12 +58,12 @@
    anymore?
 - Determine of merge_authz_dir_config is even 
    necessary and remove if not
-- Split the authz type from the arguments when the
+X- Split the authz type from the arguments when the
    authz provider is registered and store the type
    in ->provider_name and the arguments in ->requirement
-- Move the check for METHOD_MASK out of the authz 
+X- Move the check for METHOD_MASK out of the authz 
    providers and into the provider vector
-- Change the status code to AUTHZ_DENIED, AUTHZ_GRANTED
+X- Change the status code to AUTHZ_DENIED, AUTHZ_GRANTED
    and AUTHZ_GENERAL_ERROR   
 - Determine if setting the AUTHZ_PROVIDER_NAME_NOTE note
    is even necessary.  This was used in authn to support

diff --git a/modules/aaa/mod_authz_owner.c b/modules/aaa/mod_authz_owner.c
index c5d0727c74aefdd2dc7c07870f5d7b1e2078a990..09e7374da4227c126ae6b2f8aa12e27ecf5793db 100644 (file)
--- a/modules/aaa/mod_authz_owner.c
+++ b/modules/aaa/mod_authz_owner.c
@@ -33,6 +33,8 @@ typedef struct {
     int authoritative;
 } authz_owner_config_rec;
 
+APR_DECLARE_OPTIONAL_FN(char*, authz_owner_get_file_group, (request_rec *r));
+
 static void *create_authz_owner_dir_config(apr_pool_t *p, char *d)
 {
     authz_owner_config_rec *conf = apr_palloc(p, sizeof(*conf));
@@ -224,60 +226,125 @@ static int check_file_owner(request_rec *r)
     return HTTP_UNAUTHORIZED;
 }
 #endif
+
 static authz_status fileowner_check_authorization(request_rec *r,
                                              const char *require_args)
 {
-#if !APR_HAS_USER
-    if ((required_owner & ~1) && conf->authoritative) {
-        break;
-    }
+    char *reason = NULL;
+    apr_status_t status = 0;
 
-    required_owner |= 1; /* remember the requirement */
+#if !APR_HAS_USER
     reason = "'Require file-owner' is not supported on this platform.";
-    continue;
+    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                  "Authorization of user %s to access %s failed, reason: %s",
+                  r->user, r->uri, reason ? reason : "unknown");
+    return AUTHZ_DENIED;
 #else  /* APR_HAS_USER */
     char *owner = NULL;
     apr_finfo_t finfo;
 
-    if ((required_owner & ~1) && conf->authoritative) {
-        break;
-    }
-
-    required_owner |= 1; /* remember the requirement */
-
     if (!r->filename) {
         reason = "no filename available";
-        continue;
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return AUTHZ_DENIED;
     }
 
     status = apr_stat(&finfo, r->filename, APR_FINFO_USER, r->pool);
     if (status != APR_SUCCESS) {
         reason = apr_pstrcat(r->pool, "could not stat file ",
                                 r->filename, NULL);
-        continue;
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return AUTHZ_DENIED;
     }
 
     if (!(finfo.valid & APR_FINFO_USER)) {
         reason = "no file owner information available";
-        continue;
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return AUTHZ_DENIED;
     }
 
     status = apr_uid_name_get(&owner, finfo.user, r->pool);
     if (status != APR_SUCCESS || !owner) {
         reason = "could not get name of file owner";
-        continue;
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return AUTHZ_DENIED;
     }
 
     if (strcmp(owner, r->user)) {
         reason = apr_psprintf(r->pool, "file owner %s does not match.",
                                 owner);
-        continue;
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return AUTHZ_DENIED;
     }
 
     /* this user is authorized */
-    return OK;
+    return AUTHZ_GRANTED;
 #endif /* APR_HAS_USER */
+}
+
+static char *authz_owner_get_file_group(request_rec *r)
+{
+    char *reason = NULL;
+
+    /* file-group only figures out the file's group and lets
+    * other modules do the actual authorization (against a group file/db).
+    * Thus, these modules have to hook themselves after
+    * mod_authz_owner and of course recognize 'file-group', too.
+    */
+#if !APR_HAS_USER
+    return NULL;
+#else  /* APR_HAS_USER */
+    char *group = NULL;
+    apr_finfo_t finfo;
+    apr_status_t status = 0;
+
+    if (!r->filename) {
+        reason = "no filename available";
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return NULL;
     }
+
+    status = apr_stat(&finfo, r->filename, APR_FINFO_GROUP, r->pool);
+    if (status != APR_SUCCESS) {
+        reason = apr_pstrcat(r->pool, "could not stat file ",
+                                r->filename, NULL);
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return NULL;
+    }
+
+    if (!(finfo.valid & APR_FINFO_GROUP)) {
+        reason = "no file group information available";
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return NULL;
+    }
+
+    status = apr_gid_name_get(&group, finfo.group, r->pool);
+    if (status != APR_SUCCESS || !group) {
+        reason = "could not get name of file group";
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                      "Authorization of user %s to access %s failed, reason: %s",
+                      r->user, r->uri, reason ? reason : "unknown");
+        return NULL;
+    }
+
+    return group;
+#endif /* APR_HAS_USER */
 }
 
 static const authz_provider authz_fileowner_provider =
@@ -287,10 +354,10 @@ static const authz_provider authz_fileowner_provider =
 
 static void register_hooks(apr_pool_t *p)
 {
+    APR_REGISTER_OPTIONAL_FN(authz_owner_get_file_group);
+
     ap_register_provider(p, AUTHZ_PROVIDER_GROUP, "file-owner", "0",
                          &authz_fileowner_provider);
-
-    ap_hook_auth_checker(check_file_owner, NULL, NULL, APR_HOOK_MIDDLE);
 }
 
 module AP_MODULE_DECLARE_DATA authz_owner_module =