bus-proxyd: enforce policy for name ownership

[elogind.git] / src / bus-proxyd / bus-proxyd.c

diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c
index 6ff0e8c15451c25ab47cb37f2aac0692d701c599..2f26f81a366ba3136e169d469ee55e9b504448bb 100644 (file)
--- a/src/bus-proxyd/bus-proxyd.c
+++ b/src/bus-proxyd/bus-proxyd.c
@@ -51,6 +51,8 @@ static char *arg_command_line_buffer = NULL;
 static bool arg_drop_privileges = false;
 static char **arg_configuration = NULL;
 
+static Hashmap *names_hash = NULL;
+
 static int help(void) {
 
         printf("%s [OPTIONS...]\n\n"
@@ -186,7 +188,7 @@ static int rename_service(sd_bus *a, sd_bus *b) {
         assert(a);
         assert(b);
 
-        r = sd_bus_get_peer_creds(b, SD_BUS_CREDS_UID|SD_BUS_CREDS_PID|SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_COMM, &creds);
+        r = sd_bus_get_owner_creds(b, SD_BUS_CREDS_UID|SD_BUS_CREDS_PID|SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_COMM, &creds);
         if (r < 0)
                 return r;
 
@@ -454,7 +456,7 @@ static int get_creds_by_name(sd_bus *bus, const char *name, uint64_t mask, sd_bu
 
         assert_return(service_name_is_valid(name), -EINVAL);
 
-        r = sd_bus_get_owner(bus, name, mask, &c);
+        r = sd_bus_get_name_creds(bus, name, mask, &c);
         if (r == -ESRCH || r == -ENXIO)
                 return sd_bus_error_setf(error, SD_BUS_ERROR_NAME_HAS_NO_OWNER, "Name %s is currently not owned by anyone.", name);
         if (r < 0)
@@ -507,7 +509,7 @@ static int peer_is_privileged(sd_bus *bus, sd_bus_message *m) {
         return false;
 }
 
-static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
+static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m, Policy *policy, const struct ucred *ucred) {
         int r;
 
         assert(a);
@@ -644,28 +646,31 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
 
         } else if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "GetConnectionSELinuxSecurityContext")) {
                 _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL;
+                _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
 
-                r = get_creds_by_message(a, m, SD_BUS_CREDS_SELINUX_CONTEXT, &creds, NULL);
+                r = get_creds_by_message(a, m, SD_BUS_CREDS_SELINUX_CONTEXT, &creds, &error);
                 if (r < 0)
-                        return synthetic_reply_method_errno(m, r, NULL);
+                        return synthetic_reply_method_errno(m, r, &error);
 
                 return synthetic_reply_method_return(m, "y", creds->label, strlen(creds->label));
 
         } else if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "GetConnectionUnixProcessID")) {
                 _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL;
+                _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
 
-                r = get_creds_by_message(a, m, SD_BUS_CREDS_PID, &creds, NULL);
+                r = get_creds_by_message(a, m, SD_BUS_CREDS_PID, &creds, &error);
                 if (r < 0)
-                        return synthetic_reply_method_errno(m, r, NULL);
+                        return synthetic_reply_method_errno(m, r, &error);
 
                 return synthetic_reply_method_return(m, "u", (uint32_t) creds->pid);
 
         } else if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "GetConnectionUnixUser")) {
                 _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL;
+                _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
 
-                r = get_creds_by_message(a, m, SD_BUS_CREDS_UID, &creds, NULL);
+                r = get_creds_by_message(a, m, SD_BUS_CREDS_UID, &creds, &error);
                 if (r < 0)
-                        return synthetic_reply_method_errno(m, r, NULL);
+                        return synthetic_reply_method_errno(m, r, &error);
 
                 return synthetic_reply_method_return(m, "u", (uint32_t) creds->uid);
 
@@ -673,7 +678,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                 sd_id128_t server_id;
                 char buf[SD_ID128_STRING_MAX];
 
-                r = sd_bus_get_server_id(a, &server_id);
+                r = sd_bus_get_owner_id(a, &server_id);
                 if (r < 0)
                         return synthetic_reply_method_errno(m, r, NULL);
 
@@ -731,7 +736,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                 struct kdbus_cmd_name_list cmd = {};
                 struct kdbus_name_list *name_list;
                 struct kdbus_cmd_free cmd_free;
-                struct kdbus_cmd_name *name;
+                struct kdbus_name_info *name;
                 _cleanup_strv_free_ char **owners = NULL;
                 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
                 char *arg0;
@@ -744,7 +749,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                 if (!service_name_is_valid(arg0))
                         return synthetic_reply_method_errno(m, -EINVAL, NULL);
 
-                r = sd_bus_get_owner(a, arg0, 0, NULL);
+                r = sd_bus_get_name_creds(a, arg0, 0, NULL);
                 if (r == -ESRCH || r == -ENXIO) {
                         sd_bus_error_setf(&error, SD_BUS_ERROR_NAME_HAS_NO_OWNER, "Could not get owners of name '%s': no such name.", arg0);
                         return synthetic_reply_method_errno(m, r, &error);
@@ -765,8 +770,8 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                         char *n;
 
                         KDBUS_ITEM_FOREACH(item, name, items)
-                                if (item->type == KDBUS_ITEM_NAME)
-                                        entry_name = item->str;
+                                if (item->type == KDBUS_ITEM_OWNED_NAME)
+                                        entry_name = item->name.name;
 
                         if (!streq_ptr(entry_name, arg0))
                                 continue;
@@ -808,7 +813,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                 if (streq(name, "org.freedesktop.DBus"))
                         return synthetic_reply_method_return(m, "b", true);
 
-                r = sd_bus_get_owner(a, name, 0, NULL);
+                r = sd_bus_get_name_creds(a, name, 0, NULL);
                 if (r < 0 && r != -ESRCH && r != -ENXIO)
                         return synthetic_reply_method_errno(m, r, NULL);
 
@@ -834,6 +839,8 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                         return synthetic_reply_method_errno(m, r, NULL);
                 }
 
+                hashmap_remove(names_hash, name);
+
                 return synthetic_reply_method_return(m, "u", BUS_NAME_RELEASED);
 
         } else if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "ReloadConfig")) {
@@ -846,11 +853,15 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
         } else if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "RequestName")) {
                 const char *name;
                 uint32_t flags, param;
+                bool in_queue;
 
                 r = sd_bus_message_read(m, "su", &name, &flags);
                 if (r < 0)
                         return synthetic_reply_method_errno(m, r, NULL);
 
+                if (!policy_check_own(policy, ucred, name))
+                        return synthetic_reply_method_errno(m, -EPERM, NULL);
+
                 if (!service_name_is_valid(name))
                         return synthetic_reply_method_errno(m, -EINVAL, NULL);
                 if ((flags & ~(BUS_NAME_ALLOW_REPLACEMENT|BUS_NAME_REPLACE_EXISTING|BUS_NAME_DO_NOT_QUEUE)) != 0)
@@ -873,7 +884,13 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                         return synthetic_reply_method_errno(m, r, NULL);
                 }
 
-                if (r == 0)
+                in_queue = (r == 0);
+
+                r = hashmap_put(names_hash, name, NULL);
+                if (r < 0)
+                        return synthetic_reply_method_errno(m, r, NULL);
+
+                if (in_queue)
                         return synthetic_reply_method_return(m, "u", BUS_NAME_IN_QUEUE);
 
                 return synthetic_reply_method_return(m, "u", BUS_NAME_PRIMARY_OWNER);
@@ -892,7 +909,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                 if (flags != 0)
                         return synthetic_reply_method_errno(m, -EINVAL, NULL);
 
-                r = sd_bus_get_owner(a, name, 0, NULL);
+                r = sd_bus_get_name_creds(a, name, 0, NULL);
                 if (r >= 0 || streq(name, "org.freedesktop.DBus"))
                         return synthetic_reply_method_return(m, "u", BUS_START_REPLY_ALREADY_RUNNING);
                 if (r != -ESRCH)
@@ -983,7 +1000,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
         }
 }
 
-static int process_hello(sd_bus *a, sd_bus *b, sd_bus_message *m, bool *got_hello) {
+static int process_hello(sd_bus *a, sd_bus *b, sd_bus_message *m, Policy *policy, const struct ucred *ucred, bool *got_hello) {
         _cleanup_bus_message_unref_ sd_bus_message *n = NULL;
         bool is_hello;
         int r;
@@ -1015,6 +1032,11 @@ static int process_hello(sd_bus *a, sd_bus *b, sd_bus_message *m, bool *got_hell
                 return -EIO;
         }
 
+        if (!policy_check_hello(policy, ucred)) {
+                log_error("Policy denied HELLO");
+                return -EPERM;
+        }
+
         *got_hello = true;
 
         if (!a->is_kernel)
@@ -1163,12 +1185,7 @@ int main(int argc, char *argv[]) {
                 sd_is_socket(out_fd, AF_UNIX, 0, 0) > 0;
 
         if (is_unix) {
-                r = getpeercred(in_fd, &ucred);
-                if (r < 0) {
-                        log_error("Failed to get peer creds: %s", strerror(-r));
-                        goto finish;
-                }
-
+                (void) getpeercred(in_fd, &ucred);
                 (void) getpeersec(in_fd, &peersec);
         }
 
@@ -1188,13 +1205,19 @@ int main(int argc, char *argv[]) {
                         goto finish;
         }
 
+        names_hash = hashmap_new(&string_hash_ops);
+        if (!names_hash) {
+                log_oom();
+                goto finish;
+        }
+
         r = sd_bus_new(&a);
         if (r < 0) {
                 log_error("Failed to allocate bus: %s", strerror(-r));
                 goto finish;
         }
 
-        r = sd_bus_set_name(a, "sd-proxy");
+        r = sd_bus_set_description(a, "sd-proxy");
         if (r < 0) {
                 log_error("Failed to set bus name: %s", strerror(-r));
                 goto finish;
@@ -1232,7 +1255,7 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        r = sd_bus_get_server_id(a, &server_id);
+        r = sd_bus_get_owner_id(a, &server_id);
         if (r < 0) {
                 log_error("Failed to get server ID: %s", strerror(-r));
                 goto finish;
@@ -1403,7 +1426,7 @@ int main(int argc, char *argv[]) {
                                 goto finish;
                         }
 
-                        k = process_hello(a, b, m, &got_hello);
+                        k = process_hello(a, b, m, &policy, &ucred, &got_hello);
                         if (k < 0) {
                                 r = k;
                                 log_error("Failed to process HELLO: %s", strerror(-r));
@@ -1420,7 +1443,7 @@ int main(int argc, char *argv[]) {
                                         goto finish;
                                 }
 
-                                k = process_driver(a, b, m);
+                                k = process_driver(a, b, m, &policy, &ucred);
                                 if (k < 0) {
                                         r = k;
                                         log_error("Failed to process driver calls: %s", strerror(-r));
@@ -1516,6 +1539,7 @@ finish:
 
         policy_free(&policy);
         strv_free(arg_configuration);
+        hashmap_free(names_hash);
         free(arg_address);
 
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;