X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fdbus-job.c;h=09f5739315bb7bc138342bdc2bb16385c20b7aa0;hb=f1f00dbb7f3741b30d4a26b1a8b65ec46ff1fde3;hp=8c12b52b648a73749c93c7c5f878520afe4bdd27;hpb=39abcaee3e905f41efcb8b11ff4ff013f552620c;p=elogind.git diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c index 8c12b52b6..09f573931 100644 --- a/src/core/dbus-job.c +++ b/src/core/dbus-job.c @@ -24,11 +24,27 @@ #include "selinux-access.h" #include "job.h" #include "dbus-job.h" -#include "dbus-client-track.h" +#include "dbus.h" static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType); static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState); +static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) { + int r; + + if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) + return 0; /* One of the job owners is calling us */ + + r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN); + if (r < 0) + return r; + if (r == 0) + return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action"); + + /* Root has called us */ + return 0; +} + static int property_get_unit( sd_bus *bus, const char *path, @@ -52,7 +68,7 @@ static int property_get_unit( return sd_bus_message_append(reply, "(so)", j->unit->id, p); } -static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { +int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Job *j = userdata; int r; @@ -60,7 +76,11 @@ static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, s assert(message); assert(j); - r = selinux_unit_access_check(j->unit, bus, message, "stop", error); + r = verify_sys_admin_or_owner_sync(message, j, error); + if (r < 0) + return r; + + r = mac_selinux_unit_access_check(j->unit, message, "stop", error); if (r < 0) return r; @@ -71,61 +91,18 @@ static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, s const sd_bus_vtable bus_job_vtable[] = { SD_BUS_VTABLE_START(0), - SD_BUS_METHOD("Cancel", NULL, NULL, method_cancel, 0), - SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), 0), - SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, 0), - SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), 0), + SD_BUS_METHOD("Cancel", NULL, NULL, bus_job_method_cancel, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("State", "s", property_get_state, offsetof(Job, state), SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE), SD_BUS_VTABLE_END }; -static int foreach_client(Job *j, int (*send_message)(sd_bus *bus, const char *name, Job *j)) { - BusTrackedClient *one_destination = NULL; - Iterator i; - sd_bus *b; - unsigned n, m; - int r, ret; - - assert(j); - assert(send_message); - - n = set_size(j->manager->subscribed); - m = set_size(j->subscribed); - - if (n <= 0 && m <= 0) - return 0; - - if (n == 1 && m == 0) - one_destination = set_first(j->manager->subscribed); - else if (n == 0 && m == 1) - one_destination = set_first(j->subscribed); - else - one_destination = NULL; - - if (one_destination) - return send_message(one_destination->bus, isempty(one_destination->name) ? NULL : one_destination->name, j); - - ret = 0; - - /* Send to everybody */ - SET_FOREACH(b, j->manager->private_buses, i) { - r = send_message(b, NULL, j); - if (r < 0) - ret = r; - } - - if (j->manager->api_bus) { - r = send_message(j->manager->api_bus, NULL, j); - if (r < 0) - ret = r; - } - - return ret; -} - -static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_new_signal(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *p = NULL; + Job *j = userdata; int r; assert(bus); @@ -137,10 +114,10 @@ static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { r = sd_bus_message_new_signal( bus, + &m, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", - "JobNew", - &m); + "JobNew"); if (r < 0) return r; @@ -148,11 +125,12 @@ static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { if (r < 0) return r; - return sd_bus_send_to(bus, m, destination, NULL); + return sd_bus_send(bus, m, NULL); } -static int send_changed_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_changed_signal(sd_bus *bus, void *userdata) { _cleanup_free_ char *p = NULL; + Job *j = userdata; assert(bus); assert(j); @@ -174,16 +152,17 @@ void bus_job_send_change_signal(Job *j) { j->in_dbus_queue = false; } - r = foreach_client(j, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal); + r = bus_foreach_bus(j->manager, j->clients, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j); if (r < 0) log_debug("Failed to send job change signal for %u: %s", j->id, strerror(-r)); j->sent_dbus_new_signal = true; } -static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_removed_signal(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *p = NULL; + Job *j = userdata; int r; assert(bus); @@ -193,13 +172,12 @@ static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { if (!p) return -ENOMEM; - r = sd_bus_message_new_signal( bus, + &m, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", - "JobRemoved", - &m); + "JobRemoved"); if (r < 0) return r; @@ -207,7 +185,7 @@ static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { if (r < 0) return r; - return sd_bus_send_to(bus, m, destination, NULL); + return sd_bus_send(bus, m, NULL); } void bus_job_send_removed_signal(Job *j) { @@ -218,7 +196,7 @@ void bus_job_send_removed_signal(Job *j) { if (!j->sent_dbus_new_signal) bus_job_send_change_signal(j); - r = foreach_client(j, send_removed_signal); + r = bus_foreach_bus(j->manager, j->clients, send_removed_signal, j); if (r < 0) log_debug("Failed to send job remove signal for %u: %s", j->id, strerror(-r)); }