Active-session device access manager
revoke/grant acl upon active session state change
+106
-17
+6
-13
src/main.rs
+6
-13
src/main.rs
···
72
72
log::error!(
73
73
syspath:% = syspath.display(),
74
74
devnode:% = devnode.display(),
75
-
device_entity:? = device_entity,
76
75
uid = uid,
77
76
access = access_mode.as_str(),
78
77
error = e.to_string().as_str();
···
86
85
log::error!(
87
86
syspath:% = syspath.display(),
88
87
devnode:% = devnode.display(),
89
-
device_entity:? = device_entity,
90
-
grant_entity:? = grant_entity,
91
88
uid = uid,
92
89
access = access_mode.as_str(),
93
90
error = e.to_string().as_str();
···
102
99
log::info!(
103
100
syspath:% = syspath.display(),
104
101
devnode:% = devnode.display(),
105
-
device_entity:? = device_entity,
106
-
grant_entity:? = grant_entity,
107
102
uid = uid,
108
103
access = access_mode.as_str();
109
104
"removed device grant"
···
157
152
self.device_entities.push(entity);
158
153
log::info!(
159
154
syspath:% = syspath.display(),
160
-
devnode:% = devnode.display(),
161
-
device_entity:? = entity;
155
+
devnode:% = devnode.display();
162
156
"inserted managed device"
163
157
);
164
158
entity
···
166
160
167
161
let uids = session::active_local_session_uids(&self.world, &self.session_entities);
168
162
for uid in uids {
169
-
if let Some(grant_entity) = grant::entity_by_device_uid(
163
+
if grant::entity_by_device_uid(
170
164
&self.world,
171
165
&self.grant_entities,
172
166
device_entity,
173
167
uid,
174
-
) {
168
+
)
169
+
.is_some()
170
+
{
175
171
log::debug!(
176
172
syspath:% = syspath.display(),
177
-
device_entity:? = device_entity,
178
-
grant_entity:? = grant_entity;
173
+
uid = uid;
179
174
"device grant already exists"
180
175
);
181
176
} else {
···
223
218
self.grant_entities.push(grant_entity);
224
219
log::info!(
225
220
syspath:% = syspath.display(),
226
-
device_entity:? = device_entity,
227
-
grant_entity:? = grant_entity,
228
221
uid = uid,
229
222
access = rule.access.as_str();
230
223
"inserted device grant"
+100
-4
src/session.rs
+100
-4
src/session.rs
···
36
36
self.world
37
37
.entity_mut(entity)
38
38
.insert(ecs::ActiveState(state));
39
+
40
+
if !self
41
+
.world
42
+
.get::<ecs::Done>(entity)
43
+
.is_some_and(|done| done.0)
44
+
|| !self
45
+
.world
46
+
.get::<ecs::IsLocal>(entity)
47
+
.is_some_and(|is_local| is_local.0)
48
+
{
49
+
return;
50
+
}
51
+
52
+
let Some(uid) = self.world.get::<ecs::Uid>(entity).map(|uid| uid.0) else {
53
+
return;
54
+
};
55
+
56
+
if state != session_core_v1::ActiveState::Active {
57
+
self.revoke_acl(uid);
58
+
return;
59
+
}
60
+
61
+
for device_entity in self.device_entities.iter().copied() {
62
+
if grant::entity_by_device_uid(
63
+
&self.world,
64
+
&self.grant_entities,
65
+
device_entity,
66
+
uid,
67
+
)
68
+
.is_some()
69
+
{
70
+
continue;
71
+
}
72
+
73
+
let Some(syspath) = self
74
+
.world
75
+
.get::<ecs::Syspath>(device_entity)
76
+
.map(|syspath| syspath.0.clone())
77
+
else {
78
+
continue;
79
+
};
80
+
let Some(devnode) = self
81
+
.world
82
+
.get::<ecs::Devnode>(device_entity)
83
+
.map(|devnode| devnode.0.clone())
84
+
else {
85
+
continue;
86
+
};
87
+
let Some(access_mode) = self
88
+
.world
89
+
.get::<ecs::AccessMode>(device_entity)
90
+
.map(|access_mode| access_mode.0)
91
+
else {
92
+
continue;
93
+
};
94
+
95
+
let mut acl = match acl::PosixACL::read_acl(&devnode) {
96
+
Ok(acl) => acl,
97
+
Err(e) => {
98
+
log::error!(
99
+
syspath:% = syspath.display(),
100
+
devnode:% = devnode.display(),
101
+
uid = uid,
102
+
access = access_mode.as_str(),
103
+
error = e.to_string().as_str();
104
+
"failed to read device acl"
105
+
);
106
+
continue;
107
+
}
108
+
};
109
+
110
+
let acl_rule = match access_mode {
111
+
config::AccessMode::Read => acl::ACL_READ,
112
+
config::AccessMode::Write => acl::ACL_WRITE,
113
+
config::AccessMode::ReadWrite => acl::ACL_READ | acl::ACL_WRITE,
114
+
};
115
+
acl.set(acl::Qualifier::User(uid), acl_rule);
116
+
if let Err(e) = acl.write_acl(&devnode) {
117
+
log::error!(
118
+
syspath:% = syspath.display(),
119
+
devnode:% = devnode.display(),
120
+
uid = uid,
121
+
access = access_mode.as_str(),
122
+
error = e.to_string().as_str();
123
+
"failed to write device acl"
124
+
);
125
+
continue;
126
+
}
127
+
128
+
let grant_entity =
129
+
ecs::insert_grant(&mut self.world, device_entity, access_mode, uid);
130
+
self.grant_entities.push(grant_entity);
131
+
log::info!(
132
+
syspath:% = syspath.display(),
133
+
devnode:% = devnode.display(),
134
+
uid = uid,
135
+
access = access_mode.as_str();
136
+
"inserted device grant"
137
+
);
138
+
}
39
139
}
40
140
session_core_session::Event::IsLocal { is_local } => {
41
141
self.world
···
102
202
log::error!(
103
203
syspath:% = syspath.display(),
104
204
devnode:% = devnode.display(),
105
-
device_entity:? = device_entity,
106
205
uid = uid,
107
206
access = access_mode.as_str(),
108
207
error = e.to_string().as_str();
···
122
221
log::error!(
123
222
syspath:% = syspath.display(),
124
223
devnode:% = devnode.display(),
125
-
device_entity:? = device_entity,
126
224
uid = uid,
127
225
access = access_mode.as_str(),
128
226
error = e.to_string().as_str();
···
138
236
log::info!(
139
237
syspath:% = syspath.display(),
140
238
devnode:% = devnode.display(),
141
-
device_entity:? = device_entity,
142
-
grant_entity:? = grant_entity,
143
239
uid = uid,
144
240
access = access_mode.as_str();
145
241
"inserted device grant"