X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fdbus-job.c;h=3f7a28a734b4d1ac1bc1c8af3ad4f1f519158701;hb=ac45dec934b0932d03fbd498a3c6e8e90a01813f;hp=6489348fb26d1dba56c5d8d2050e165b84f1cae4;hpb=556089dc57b10a12a03edd3d3e90ca17398ad206;p=elogind.git diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c index 6489348fb..3f7a28a73 100644 --- a/src/core/dbus-job.c +++ b/src/core/dbus-job.c @@ -24,11 +24,27 @@ #include "selinux-access.h" #include "job.h" #include "dbus-job.h" -#include "dbus-client-track.h" +#include "dbus.h" static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType); static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState); +static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) { + int r; + + if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) + return 0; /* One of the job owners is calling us */ + + r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN); + if (r < 0) + return r; + if (r == 0) + return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action"); + + /* Root has called us */ + return 0; +} + static int property_get_unit( sd_bus *bus, const char *path, @@ -52,7 +68,7 @@ static int property_get_unit( return sd_bus_message_append(reply, "(so)", j->unit->id, p); } -static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { +int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Job *j = userdata; int r; @@ -60,7 +76,11 @@ static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, s assert(message); assert(j); - r = selinux_unit_access_check(j->unit, bus, message, "stop", error); + r = verify_sys_admin_or_owner_sync(message, j, error); + if (r < 0) + return r; + + r = selinux_unit_access_check(j->unit, message, "stop", error); if (r < 0) return r; @@ -71,7 +91,7 @@ static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, s const sd_bus_vtable bus_job_vtable[] = { SD_BUS_VTABLE_START(0), - SD_BUS_METHOD("Cancel", NULL, NULL, method_cancel, 0), + SD_BUS_METHOD("Cancel", NULL, NULL, bus_job_method_cancel, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), SD_BUS_VTABLE_PROPERTY_CONST), @@ -79,53 +99,10 @@ const sd_bus_vtable bus_job_vtable[] = { SD_BUS_VTABLE_END }; -static int foreach_client(Job *j, int (*send_message)(sd_bus *bus, const char *name, Job *j)) { - BusTrackedClient *one_destination = NULL; - Iterator i; - sd_bus *b; - unsigned n, m; - int r, ret; - - assert(j); - assert(send_message); - - n = set_size(j->manager->subscribed); - m = set_size(j->subscribed); - - if (n <= 0 && m <= 0) - return 0; - - if (n == 1 && m == 0) - one_destination = set_first(j->manager->subscribed); - else if (n == 0 && m == 1) - one_destination = set_first(j->subscribed); - else - one_destination = NULL; - - if (one_destination) - return send_message(one_destination->bus, isempty(one_destination->name) ? NULL : one_destination->name, j); - - ret = 0; - - /* Send to everybody */ - SET_FOREACH(b, j->manager->private_buses, i) { - r = send_message(b, NULL, j); - if (r < 0) - ret = r; - } - - if (j->manager->api_bus) { - r = send_message(j->manager->api_bus, NULL, j); - if (r < 0) - ret = r; - } - - return ret; -} - -static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_new_signal(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *p = NULL; + Job *j = userdata; int r; assert(bus); @@ -137,10 +114,10 @@ static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { r = sd_bus_message_new_signal( bus, + &m, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", - "JobNew", - &m); + "JobNew"); if (r < 0) return r; @@ -148,11 +125,12 @@ static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { if (r < 0) return r; - return sd_bus_send_to(bus, m, destination, NULL); + return sd_bus_send(bus, m, NULL); } -static int send_changed_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_changed_signal(sd_bus *bus, void *userdata) { _cleanup_free_ char *p = NULL; + Job *j = userdata; assert(bus); assert(j); @@ -174,16 +152,17 @@ void bus_job_send_change_signal(Job *j) { j->in_dbus_queue = false; } - r = foreach_client(j, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal); + r = bus_foreach_bus(j->manager, j->clients, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j); if (r < 0) log_debug("Failed to send job change signal for %u: %s", j->id, strerror(-r)); j->sent_dbus_new_signal = true; } -static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_removed_signal(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *p = NULL; + Job *j = userdata; int r; assert(bus); @@ -193,13 +172,12 @@ static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { if (!p) return -ENOMEM; - r = sd_bus_message_new_signal( bus, + &m, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", - "JobRemoved", - &m); + "JobRemoved"); if (r < 0) return r; @@ -207,7 +185,7 @@ static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { if (r < 0) return r; - return sd_bus_send_to(bus, m, destination, NULL); + return sd_bus_send(bus, m, NULL); } void bus_job_send_removed_signal(Job *j) { @@ -218,7 +196,7 @@ void bus_job_send_removed_signal(Job *j) { if (!j->sent_dbus_new_signal) bus_job_send_change_signal(j); - r = foreach_client(j, send_removed_signal); + r = bus_foreach_bus(j->manager, j->clients, send_removed_signal, j); if (r < 0) log_debug("Failed to send job remove signal for %u: %s", j->id, strerror(-r)); }