X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fbus-proxyd%2Fbus-policy.c;h=151d679f6b85bee97833b4148bf71e1180d33485;hb=619d7a039f9f64ffa593634c2715838ffbc17be4;hp=d2eace940512645089192da8ae460fcddb197c6f;hpb=d5099efc47d4e6ac60816b5381a5f607ab03f06e;p=elogind.git diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c index d2eace940..151d679f6 100644 --- a/src/bus-proxyd/bus-policy.c +++ b/src/bus-proxyd/bus-policy.c @@ -24,6 +24,7 @@ #include "strv.h" #include "conf-files.h" #include "bus-internal.h" +#include "bus-message.h" #include "bus-policy.h" static void policy_item_free(PolicyItem *i) { @@ -39,6 +40,14 @@ static void policy_item_free(PolicyItem *i) { DEFINE_TRIVIAL_CLEANUP_FUNC(PolicyItem*, policy_item_free); +static void item_append(PolicyItem *i, PolicyItem **list) { + + PolicyItem *tail; + + LIST_FIND_TAIL(items, *list, tail); + LIST_INSERT_AFTER(items, *list, tail, i); +} + static int file_load(Policy *p, const char *path) { _cleanup_free_ char *c = NULL, *policy_user = NULL, *policy_group = NULL; @@ -330,9 +339,9 @@ static int file_load(Policy *p, const char *path) { } if (policy_category == POLICY_CATEGORY_DEFAULT) - LIST_PREPEND(items, p->default_items, i); + item_append(i, &p->default_items); else if (policy_category == POLICY_CATEGORY_MANDATORY) - LIST_PREPEND(items, p->default_items, i); + item_append(i, &p->mandatory_items); else if (policy_category == POLICY_CATEGORY_USER) { const char *u = policy_user; @@ -355,7 +364,8 @@ static int file_load(Policy *p, const char *path) { PolicyItem *first; first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid)); - LIST_PREPEND(items, first, i); + item_append(i, &first); + i->uid_valid = true; r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first); if (r < 0) { @@ -386,7 +396,8 @@ static int file_load(Policy *p, const char *path) { PolicyItem *first; first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid)); - LIST_PREPEND(items, first, i); + item_append(i, &first); + i->gid_valid = true; r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first); if (r < 0) { @@ -515,8 +526,36 @@ static int file_load(Policy *p, const char *path) { return -EINVAL; } + switch (i->class) { + case POLICY_ITEM_USER: + if (!streq(name, "*")) { + const char *u = name; + + r = get_user_creds(&u, &i->uid, NULL, NULL, NULL); + if (r < 0) + log_error("Failed to resolve user %s: %s", name, strerror(-r)); + else + i->uid_valid = true; + } + break; + case POLICY_ITEM_GROUP: + if (!streq(name, "*")) { + const char *g = name; + + r = get_group_creds(&g, &i->gid); + if (r < 0) + log_error("Failed to resolve group %s: %s", name, strerror(-r)); + else + i->gid_valid = true; + } + break; + default: + break; + } + i->name = name; name = NULL; + state = STATE_ALLOW_DENY; } else { log_error("Unexpected token (14) in %s:%u.", path, line); @@ -553,6 +592,161 @@ static int file_load(Policy *p, const char *path) { } } +static bool is_matching_name_request(sd_bus_message *m, const char *name, bool prefix) { + + char *n = NULL; + int r; + + if (!sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "RequestName")) + return false; + + r = sd_bus_message_read(m, "s", &n); + if (r < 0) + return false; + + r = sd_bus_message_rewind(m, true); + if (r < 0) + return false; + + if (prefix) + return startswith(name, n); + else + return streq_ptr(name, n); +} + +static bool is_matching_call(PolicyItem *i, sd_bus_message *m, const char *name) { + + if (i->message_type && (i->message_type != m->header->type)) + return false; + + if (i->path && (!m->path || !streq(i->path, m->path))) + return false; + + if (i->member && (!m->member || !streq(i->member, m->member))) + return false; + + if (i->interface && (!m->interface || !streq(i->interface, m->interface))) + return false; + + if (i->name && (!name || !streq(i->name, name))) + return false; + + return true; +} + +enum { + ALLOW, + DUNNO, + DENY, +}; + +static int is_permissive(PolicyItem *i) { + + return (i->type == POLICY_ITEM_ALLOW) ? ALLOW : DENY; +} + +static int check_policy_item(PolicyItem *i, sd_bus_message *m, const struct ucred *ucred) { + + switch (i->class) { + case POLICY_ITEM_SEND: + if ((m->bus->is_kernel && is_matching_call(i, m, m->destination)) || + (!m->bus->is_kernel && is_matching_call(i, m, m->sender))) + return is_permissive(i); + break; + + case POLICY_ITEM_RECV: + if ((m->bus->is_kernel && is_matching_call(i, m, m->sender)) || + (!m->bus->is_kernel && is_matching_call(i, m, m->destination))) + return is_permissive(i); + break; + + case POLICY_ITEM_OWN: + if (is_matching_name_request(m, i->name, false)) + return is_permissive(i); + break; + + case POLICY_ITEM_OWN_PREFIX: + if (is_matching_name_request(m, i->name, true)) + return is_permissive(i); + break; + + case POLICY_ITEM_USER: + if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "Hello") && + (streq_ptr(i->name, "*") || (i->uid_valid && i->uid == ucred->uid))) + return is_permissive(i); + break; + + case POLICY_ITEM_GROUP: + if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "Hello") && + (streq_ptr(i->name, "*") || (i->gid_valid && i->gid == ucred->gid))) + return is_permissive(i); + break; + + case POLICY_ITEM_IGNORE: + default: + break; + } + + return DUNNO; +} + +static int check_policy_items(PolicyItem *items, sd_bus_message *m, const struct ucred *ucred) { + + PolicyItem *i; + int r, ret = DUNNO; + + /* Check all policies in a set - a broader one might be followed by a more specific one, + * and the order of rules in policy definitions matters */ + LIST_FOREACH(items, i, items) { + r = check_policy_item(i, m, ucred); + if (r != DUNNO) + ret = r; + } + + return ret; +} + +bool policy_check(Policy *p, sd_bus_message *m, const struct ucred *ucred) { + + PolicyItem *items; + int r; + + /* + * The policy check is implemented by the following logic: + * + * 1. Check mandatory items. If the message matches any of these, it is decisive. + * 2. See if the passed ucred match against the user/group hashmaps. A matching entry is also decisive. + * 3. Consult the defaults if non of the above matched with a more specific rule. + * 4. If the message isn't caught be the defaults either, reject it. + */ + + r = check_policy_items(p->mandatory_items, m, ucred); + if (r != DUNNO) + return r == ALLOW; + + if (ucred->pid > 0) { + items = hashmap_get(p->user_items, UINT32_TO_PTR(ucred->uid)); + if (items) { + r = check_policy_items(items, m, ucred); + if (r != DUNNO) + return r == ALLOW; + } + + items = hashmap_get(p->group_items, UINT32_TO_PTR(ucred->gid)); + if (items) { + r = check_policy_items(items, m, ucred); + if (r != DUNNO) + return r == ALLOW; + } + } + + r = check_policy_items(p->default_items, m, ucred); + if (r != DUNNO) + return r == ALLOW; + + return false; +} + int policy_load(Policy *p, char **files) { char **i; int r; @@ -620,64 +814,64 @@ void policy_free(Policy *p) { p->user_items = p->group_items = NULL; } -static void dump_items(PolicyItem *i, const char *prefix) { +static void dump_items(PolicyItem *items, const char *prefix) { + + PolicyItem *i; - if (!i) + if (!items) return; if (!prefix) prefix = ""; - printf("%sType: %s\n" - "%sClass: %s\n", - prefix, policy_item_type_to_string(i->type), - prefix, policy_item_class_to_string(i->class)); + LIST_FOREACH(items, i, items) { - if (i->interface) - printf("%sInterface: %s\n", - prefix, i->interface); + printf("%sType: %s\n" + "%sClass: %s\n", + prefix, policy_item_type_to_string(i->type), + prefix, policy_item_class_to_string(i->class)); - if (i->member) - printf("%sMember: %s\n", - prefix, i->member); + if (i->interface) + printf("%sInterface: %s\n", + prefix, i->interface); - if (i->error) - printf("%sError: %s\n", - prefix, i->error); + if (i->member) + printf("%sMember: %s\n", + prefix, i->member); - if (i->path) - printf("%sPath: %s\n", - prefix, i->path); + if (i->error) + printf("%sError: %s\n", + prefix, i->error); - if (i->name) - printf("%sName: %s\n", - prefix, i->name); + if (i->path) + printf("%sPath: %s\n", + prefix, i->path); - if (i->message_type != 0) - printf("%sMessage Type: %s\n", - prefix, bus_message_type_to_string(i->message_type)); + if (i->name) + printf("%sName: %s\n", + prefix, i->name); - if (i->uid_valid) { - _cleanup_free_ char *user; + if (i->message_type != 0) + printf("%sMessage Type: %s\n", + prefix, bus_message_type_to_string(i->message_type)); - user = uid_to_name(i->uid); + if (i->uid_valid) { + _cleanup_free_ char *user; - printf("%sUser: %s\n", - prefix, strna(user)); - } + user = uid_to_name(i->uid); - if (i->gid_valid) { - _cleanup_free_ char *group; + printf("%sUser: %s (%d)\n", + prefix, strna(user), i->uid); + } - group = gid_to_name(i->gid); + if (i->gid_valid) { + _cleanup_free_ char *group; - printf("%sGroup: %s\n", - prefix, strna(group)); - } + group = gid_to_name(i->gid); - if (i->items_next) { - printf("%s%s\n", prefix, draw_special_char(DRAW_DASH)); - dump_items(i->items_next, prefix); + printf("%sGroup: %s (%d)\n", + prefix, strna(group), i->gid); + } } } @@ -692,7 +886,7 @@ static void dump_hashmap_items(Hashmap *h) { } } -noreturn void policy_dump(Policy *p) { +void policy_dump(Policy *p) { printf("%s Default Items:\n", draw_special_char(DRAW_ARROW)); dump_items(p->default_items, "\t"); @@ -705,8 +899,6 @@ noreturn void policy_dump(Policy *p) { printf("%s Mandatory Items:\n", draw_special_char(DRAW_ARROW)); dump_items(p->mandatory_items, "\t"); - - exit(0); } static const char* const policy_item_type_table[_POLICY_ITEM_TYPE_MAX] = {