X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fbus-proxyd%2Fbus-policy.c;h=13322ea514bb0ab9db4a47d04e427c7997cddf95;hb=affc3d834347076e8616948978e70ed1fca84db4;hp=227742ba745a7b1266201b8232249dafd676b0c3;hpb=080edb3484dc3ecf8d914526fdd3090b40fdf5b6;p=elogind.git diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c index 227742ba7..13322ea51 100644 --- a/src/bus-proxyd/bus-policy.c +++ b/src/bus-proxyd/bus-policy.c @@ -24,6 +24,7 @@ #include "strv.h" #include "conf-files.h" #include "bus-internal.h" +#include "bus-message.h" #include "bus-policy.h" static void policy_item_free(PolicyItem *i) { @@ -94,8 +95,7 @@ static int file_load(Policy *p, const char *path) { if (r == -EISDIR) return r; - log_error("Failed to load %s: %s", path, strerror(-r)); - return r; + return log_error_errno(r, "Failed to load %s: %m", path); } q = c; @@ -104,10 +104,8 @@ static int file_load(Policy *p, const char *path) { int t; t = xml_tokenize(&q, &name, &xml_state, &line); - if (t < 0) { - log_error("XML parse failure in %s: %s", path, strerror(-t)); - return t; - } + if (t < 0) + return log_error_errno(t, "XML parse failure in %s: %m", path); switch (state) { @@ -357,7 +355,7 @@ static int file_load(Policy *p, const char *path) { r = get_user_creds(&u, &i->uid, NULL, NULL, NULL); if (r < 0) { - log_error("Failed to resolve user %s, ignoring policy: %s", u, strerror(-r)); + log_error_errno(r, "Failed to resolve user %s, ignoring policy: %m", u); free(i); } else { PolicyItem *first; @@ -389,7 +387,7 @@ static int file_load(Policy *p, const char *path) { r = get_group_creds(&g, &i->gid); if (r < 0) { - log_error("Failed to resolve group %s, ignoring policy: %s", g, strerror(-r)); + log_error_errno(r, "Failed to resolve group %s, ignoring policy: %m", g); free(i); } else { PolicyItem *first; @@ -532,7 +530,7 @@ static int file_load(Policy *p, const char *path) { r = get_user_creds(&u, &i->uid, NULL, NULL, NULL); if (r < 0) - log_error("Failed to resolve user %s: %s", name, strerror(-r)); + log_error_errno(r, "Failed to resolve user %s: %m", name); else i->uid_valid = true; } @@ -543,7 +541,7 @@ static int file_load(Policy *p, const char *path) { r = get_group_creds(&g, &i->gid); if (r < 0) - log_error("Failed to resolve group %s: %s", name, strerror(-r)); + log_error_errno(r, "Failed to resolve group %s: %m", name); else i->gid_valid = true; } @@ -591,6 +589,294 @@ static int file_load(Policy *p, const char *path) { } } +enum { + DENY, + ALLOW, + DUNNO, +}; + +static const char *verdict_to_string(int v) { + switch (v) { + + case DENY: + return "DENY"; + case ALLOW: + return "ALLOW"; + case DUNNO: + return "DUNNO"; + } + + return NULL; +} + +struct policy_check_filter { + PolicyItemClass class; + uid_t uid; + gid_t gid; + int message_type; + const char *name; + const char *interface; + const char *path; + const char *member; +}; + +static int is_permissive(PolicyItem *i) { + + assert(i); + + return (i->type == POLICY_ITEM_ALLOW) ? ALLOW : DENY; +} + +static int check_policy_item(PolicyItem *i, const struct policy_check_filter *filter) { + + assert(i); + assert(filter); + + switch (i->class) { + case POLICY_ITEM_SEND: + case POLICY_ITEM_RECV: + + if (i->name && !streq_ptr(i->name, filter->name)) + break; + + if ((i->message_type != 0) && (i->message_type != filter->message_type)) + break; + + if (i->path && !streq_ptr(i->path, filter->path)) + break; + + if (i->member && !streq_ptr(i->member, filter->member)) + break; + + if (i->interface && !streq_ptr(i->interface, filter->interface)) + break; + + return is_permissive(i); + + case POLICY_ITEM_OWN: + assert(filter->name); + + if (streq(i->name, "*") || streq(i->name, filter->name)) + return is_permissive(i); + break; + + case POLICY_ITEM_OWN_PREFIX: + assert(filter->name); + + if (streq(i->name, "*") || service_name_startswith(filter->name, i->name)) + return is_permissive(i); + break; + + case POLICY_ITEM_USER: + if (filter->uid != (uid_t) -1) + if ((streq_ptr(i->name, "*") || (i->uid_valid && i->uid == filter->uid))) + return is_permissive(i); + break; + + case POLICY_ITEM_GROUP: + if (filter->gid != (gid_t) -1) + if ((streq_ptr(i->name, "*") || (i->gid_valid && i->gid == filter->gid))) + return is_permissive(i); + break; + + case POLICY_ITEM_IGNORE: + default: + break; + } + + return DUNNO; +} + +static int check_policy_items(PolicyItem *items, const struct policy_check_filter *filter) { + + PolicyItem *i; + int verdict = DUNNO; + + assert(filter); + + /* Check all policies in a set - a broader one might be followed by a more specific one, + * and the order of rules in policy definitions matters */ + LIST_FOREACH(items, i, items) { + int v; + + if (i->class != filter->class && + !(i->class == POLICY_ITEM_OWN_PREFIX && filter->class == POLICY_ITEM_OWN)) + continue; + + v = check_policy_item(i, filter); + if (v != DUNNO) + verdict = v; + } + + return verdict; +} + +static int policy_check(Policy *p, const struct policy_check_filter *filter) { + + PolicyItem *items; + int verdict, v; + + assert(p); + assert(filter); + + assert(IN_SET(filter->class, POLICY_ITEM_SEND, POLICY_ITEM_RECV, POLICY_ITEM_OWN, POLICY_ITEM_USER, POLICY_ITEM_GROUP)); + + /* + * The policy check is implemented by the following logic: + * + * 1. Check default items + * 2. Check group items + * 3. Check user items + * 4. Check mandatory items + * + * Later rules override earlier rules. + */ + + verdict = check_policy_items(p->default_items, filter); + + if (filter->gid != (gid_t) -1) { + items = hashmap_get(p->group_items, UINT32_TO_PTR(filter->gid)); + if (items) { + v = check_policy_items(items, filter); + if (v != DUNNO) + verdict = v; + } + } + + if (filter->uid != (uid_t) -1) { + items = hashmap_get(p->user_items, UINT32_TO_PTR(filter->uid)); + if (items) { + v = check_policy_items(items, filter); + if (v != DUNNO) + verdict = v; + } + } + + v = check_policy_items(p->mandatory_items, filter); + if (v != DUNNO) + verdict = v; + + return verdict; +} + +bool policy_check_own(Policy *p, uid_t uid, gid_t gid, const char *name) { + + struct policy_check_filter filter = { + .class = POLICY_ITEM_OWN, + .uid = uid, + .gid = gid, + .name = name, + }; + + int verdict; + + assert(p); + assert(name); + + verdict = policy_check(p, &filter); + + log_full(LOG_AUTH | (verdict != ALLOW ? LOG_WARNING : LOG_DEBUG), + "Ownership permission check for uid=" UID_FMT " gid=" GID_FMT" name=%s: %s", + uid, gid, strna(name), strna(verdict_to_string(verdict))); + + return verdict == ALLOW; +} + +bool policy_check_hello(Policy *p, uid_t uid, gid_t gid) { + + struct policy_check_filter filter = { + .uid = uid, + .gid = gid, + }; + int verdict; + + assert(p); + + filter.class = POLICY_ITEM_USER; + verdict = policy_check(p, &filter); + + if (verdict != DENY) { + int v; + + filter.class = POLICY_ITEM_GROUP; + v = policy_check(p, &filter); + if (v != DUNNO) + verdict = v; + } + + log_full(LOG_AUTH | (verdict != ALLOW ? LOG_WARNING : LOG_DEBUG), + "Hello permission check for uid=" UID_FMT " gid=" GID_FMT": %s", + uid, gid, strna(verdict_to_string(verdict))); + + return verdict == ALLOW; +} + +bool policy_check_recv(Policy *p, + uid_t uid, + gid_t gid, + int message_type, + const char *name, + const char *path, + const char *interface, + const char *member) { + + struct policy_check_filter filter = { + .class = POLICY_ITEM_RECV, + .uid = uid, + .gid = gid, + .message_type = message_type, + .name = name, + .interface = interface, + .path = path, + .member = member, + }; + + int verdict; + + assert(p); + + verdict = policy_check(p, &filter); + + log_full(LOG_AUTH | (verdict != ALLOW ? LOG_WARNING : LOG_DEBUG), + "Recieve permission check for uid=" UID_FMT " gid=" GID_FMT" message=%s name=%s interface=%s path=%s member=%s: %s", + uid, gid, bus_message_type_to_string(message_type), strna(name), strna(path), strna(interface), strna(member), strna(verdict_to_string(verdict))); + + return verdict == ALLOW; +} + +bool policy_check_send(Policy *p, + uid_t uid, + gid_t gid, + int message_type, + const char *name, + const char *path, + const char *interface, + const char *member) { + + struct policy_check_filter filter = { + .class = POLICY_ITEM_SEND, + .uid = uid, + .gid = gid, + .message_type = message_type, + .name = name, + .interface = interface, + .path = path, + .member = member, + }; + + int verdict; + + assert(p); + + verdict = policy_check(p, &filter); + + log_full(LOG_AUTH | (verdict != ALLOW ? LOG_WARNING : LOG_DEBUG), + "Send permission check for uid=" UID_FMT " gid=" GID_FMT" message=%s name=%s interface=%s path=%s member=%s: %s", + uid, gid, bus_message_type_to_string(message_type), strna(name), strna(path), strna(interface), strna(member), strna(verdict_to_string(verdict))); + + return verdict == ALLOW; +} + int policy_load(Policy *p, char **files) { char **i; int r; @@ -605,10 +891,8 @@ int policy_load(Policy *p, char **files) { char **j; r = conf_files_list(&l, ".conf", NULL, *i, NULL); - if (r < 0) { - log_error("Failed to get configuration file list: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to get configuration file list: %m"); STRV_FOREACH(j, l) file_load(p, *j); @@ -704,8 +988,8 @@ static void dump_items(PolicyItem *items, const char *prefix) { user = uid_to_name(i->uid); - printf("%sUser: %s\n", - prefix, strna(user)); + printf("%sUser: %s (%d)\n", + prefix, strna(user), i->uid); } if (i->gid_valid) { @@ -713,9 +997,10 @@ static void dump_items(PolicyItem *items, const char *prefix) { group = gid_to_name(i->gid); - printf("%sGroup: %s\n", - prefix, strna(group)); + printf("%sGroup: %s (%d)\n", + prefix, strna(group), i->gid); } + printf("%s-\n", prefix); } } @@ -730,7 +1015,7 @@ static void dump_hashmap_items(Hashmap *h) { } } -noreturn void policy_dump(Policy *p) { +void policy_dump(Policy *p) { printf("%s Default Items:\n", draw_special_char(DRAW_ARROW)); dump_items(p->default_items, "\t"); @@ -743,8 +1028,6 @@ noreturn void policy_dump(Policy *p) { printf("%s Mandatory Items:\n", draw_special_char(DRAW_ARROW)); dump_items(p->mandatory_items, "\t"); - - exit(0); } static const char* const policy_item_type_table[_POLICY_ITEM_TYPE_MAX] = {