driverd: fix use-after-free error when maintaining match lists

[elogind.git] / src / bus-driverd / bus-driverd.c

diff --git a/src/bus-driverd/bus-driverd.c b/src/bus-driverd/bus-driverd.c
index b9c87d1bf33f332bc32cb6c6a7b30222b5ad5319..0f792038c4e0a147a03d07394731357d3ebd64d9 100644 (file)
--- a/src/bus-driverd/bus-driverd.c
+++ b/src/bus-driverd/bus-driverd.c
@@ -51,6 +51,7 @@
 #include "def.h"
 #include "unit-name.h"
 #include "bus-control.h"
+#include "cgroup-util.h"
 
 #define CLIENTS_MAX 1024
 #define MATCHES_MAX 1024
@@ -92,7 +93,7 @@ static void match_free(Match *m) {
                 first = hashmap_get(m->client->matches, m->match);
                 LIST_REMOVE(matches, first, m);
                 if (first)
-                        assert_se(hashmap_replace(m->client->matches, m->match, first) >= 0);
+                        assert_se(hashmap_replace(m->client->matches, first->match, first) >= 0);
                 else
                         hashmap_remove(m->client->matches, m->match);
 
@@ -346,7 +347,7 @@ static int driver_remove_match(sd_bus *bus, sd_bus_message *message, void *userd
 
         m = hashmap_get(c->matches, normalized);
         if (!m) {
-                r = sd_bus_error_setf(error, SD_BUS_ERROR_MATCH_RULE_NOT_FOUND, "Match rule \"%s\" not found.");
+                r = sd_bus_error_setf(error, SD_BUS_ERROR_MATCH_RULE_NOT_FOUND, "Match rule \"%s\" not found.", normalized);
                 goto finish;
         }
 
@@ -537,7 +538,7 @@ static int driver_list_queued_owners(sd_bus *bus, sd_bus_message *m, void *userd
                 if (!streq(name->name, arg0))
                         continue;
 
-                if (asprintf(&n, ":1.%llu", (unsigned long long) name->id) < 0)
+                if (asprintf(&n, ":1.%llu", (unsigned long long) name->owner_id) < 0)
                         return -ENOMEM;
 
                 r = strv_push(&owners, n);
@@ -555,17 +556,17 @@ static int driver_list_queued_owners(sd_bus *bus, sd_bus_message *m, void *userd
 }
 
 static int driver_name_has_owner(sd_bus *bus, sd_bus_message *m, void *userdata, sd_bus_error *error) {
-        char *arg0;
+        const char *name;
         int r;
 
-        r = sd_bus_message_read(m, "s", &arg0);
+        r = sd_bus_message_read(m, "s", &name);
         if (r < 0)
                 return r;
 
-        assert_return(service_name_is_valid(arg0), -EINVAL);
+        assert_return(service_name_is_valid(name), -EINVAL);
 
-        r = sd_bus_get_owner(bus, arg0, 0, NULL);
-        if (r < 0 && r != -ENOENT)
+        r = sd_bus_get_owner(bus, name, 0, NULL);
+        if (r < 0 && r != -ENOENT && r != -ENXIO)
                 return r;
 
         return sd_bus_reply_method_return(m, "b", r >= 0);
@@ -599,7 +600,7 @@ static int driver_request_name(sd_bus *bus, sd_bus_message *m, void *userdata, s
         if (r < 0)
                 return r;
 
-        n->id = id;
+        n->owner_id = id;
 
         r = ioctl(bus->input_fd, KDBUS_CMD_NAME_ACQUIRE, n);
         if (r < 0) {
@@ -642,7 +643,7 @@ static int driver_release_name(sd_bus *bus, sd_bus_message *m, void *userdata, s
         if (r < 0)
                 return r;
 
-        n->id = id;
+        n->owner_id = id;
 
         r = ioctl(bus->input_fd, KDBUS_CMD_NAME_RELEASE, n);
         if (r < 0) {
@@ -694,8 +695,8 @@ static int driver_start_service_by_name(sd_bus *bus, sd_bus_message *m, void *us
         if (r < 0)
                 return r;
 
-        if (!t[0] || t[1])
-                return -EIO;
+        if (!t || !t[0] || t[1])
+                return sd_bus_error_setf(error, SD_BUS_ERROR_SERVICE_UNKNOWN, "Bus name %s not found.", name);
 
         r = sd_bus_call_method(
                         bus,
@@ -714,6 +715,65 @@ static int driver_start_service_by_name(sd_bus *bus, sd_bus_message *m, void *us
         return sd_bus_reply_method_return(m, "u", BUS_START_REPLY_SUCCESS);
 }
 
+static int driver_update_environment(sd_bus*bus, sd_bus_message *m, void *userdata, sd_bus_error *error) {
+        _cleanup_bus_message_unref_ sd_bus_message *msg = NULL;
+        _cleanup_strv_free_ char **args = NULL;
+        int r;
+
+        r = sd_bus_message_enter_container(m, SD_BUS_TYPE_ARRAY, "{ss}");
+        if (r < 0)
+                return r;
+
+       while ((r = sd_bus_message_enter_container(m, SD_BUS_TYPE_DICT_ENTRY, "ss")) > 0) {
+                _cleanup_free_ char *s = NULL;
+                const char *key;
+                const char *value;
+
+                r = sd_bus_message_read(m, "ss", &key, &value);
+                if (r < 0)
+                        return r;
+
+                s = strjoin(key, "=", value, NULL);
+                if (!s)
+                        return ENOMEM;
+
+                r  = strv_extend(&args, s);
+                if (r < 0)
+                        return r;
+
+                r = sd_bus_message_exit_container(m);
+                if (r < 0)
+                        return r;
+        }
+
+        r = sd_bus_message_exit_container(m);
+        if (r < 0)
+                return r;
+
+        if (!args)
+                return -EINVAL;
+
+        r = sd_bus_message_new_method_call(
+                        bus,
+                        "org.freedesktop.systemd1",
+                        "/org/freedesktop/systemd1",
+                        "org.freedesktop.systemd1.Manager",
+                        "SetEnvironment",
+                        &msg);
+        if (r < 0)
+                return r;
+
+        r = sd_bus_message_append_strv(msg, args);
+        if (r < 0)
+                return r;
+
+        r = sd_bus_call(bus, msg, 0, NULL, NULL);
+        if (r < 0)
+                return r;
+
+        return sd_bus_reply_method_return(m, NULL);
+}
+
 static int driver_unsupported(sd_bus *bus, sd_bus_message *m, void *userdata, sd_bus_error *error) {
         return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "%s() is not supported", sd_bus_message_get_member(m));
 }
@@ -736,7 +796,7 @@ static const sd_bus_vtable driver_vtable[] = {
         SD_BUS_METHOD("RemoveMatch", "s", NULL, driver_remove_match, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("RequestName", "su", "u", driver_request_name, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("StartServiceByName", "su", "u", driver_start_service_by_name, SD_BUS_VTABLE_UNPRIVILEGED),
-        SD_BUS_METHOD("UpdateActivationEnvironment", "a{ss}", NULL, driver_unsupported, SD_BUS_VTABLE_DEPRECATED),
+        SD_BUS_METHOD("UpdateActivationEnvironment", "a{ss}", NULL, driver_update_environment, 0),
         SD_BUS_SIGNAL("NameAcquired", "s", SD_BUS_VTABLE_DEPRECATED),
         SD_BUS_SIGNAL("NameLost", "s", SD_BUS_VTABLE_DEPRECATED),
         SD_BUS_SIGNAL("NameOwnerChanged", "sss", 0),
@@ -748,7 +808,11 @@ static int connect_bus(Context *c) {
 
         assert(c);
 
-        r = sd_bus_default_system(&c->bus);
+        r = cg_pid_get_owner_uid(0, NULL);
+        if (r < 0)
+                r = sd_bus_default_system(&c->bus);
+        else
+                r = sd_bus_default_user(&c->bus);
         if (r < 0) {
                 log_error("Failed to create bus: %s", strerror(-r));
                 return r;
@@ -767,7 +831,7 @@ static int connect_bus(Context *c) {
 
         r = sd_bus_request_name(c->bus, "org.freedesktop.DBus", 0);
         if (r < 0) {
-                log_error("Unable to request name: %s\n", strerror(-r));
+                log_error("Unable to request name: %s", strerror(-r));
                 return r;
         }
 
@@ -828,5 +892,4 @@ finish:
         sd_event_unref(context.event);
 
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
-
 }