#include "selinux-access.h"
#include "job.h"
#include "dbus-job.h"
-#include "dbus-client-track.h"
+#include "dbus.h"
static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType);
static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState);
+static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) {
+ int r;
+
+ if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message)))
+ return 0; /* One of the job owners is calling us */
+
+ r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN);
+ if (r < 0)
+ return r;
+ if (r == 0)
+ return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action");
+
+ /* Root has called us */
+ return 0;
+}
+
static int property_get_unit(
sd_bus *bus,
const char *path,
return sd_bus_message_append(reply, "(so)", j->unit->id, p);
}
-static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
Job *j = userdata;
int r;
assert(message);
assert(j);
- r = selinux_unit_access_check(j->unit, bus, message, "stop", error);
+ r = verify_sys_admin_or_owner_sync(message, j, error);
+ if (r < 0)
+ return r;
+
+ r = mac_selinux_unit_access_check(j->unit, message, "stop", error);
if (r < 0)
return r;
const sd_bus_vtable bus_job_vtable[] = {
SD_BUS_VTABLE_START(0),
- SD_BUS_METHOD("Cancel", NULL, NULL, method_cancel, 0),
- SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), 0),
- SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, 0),
- SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), 0),
+ SD_BUS_METHOD("Cancel", NULL, NULL, bus_job_method_cancel, SD_BUS_VTABLE_UNPRIVILEGED),
+ SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), SD_BUS_VTABLE_PROPERTY_CONST),
+ SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, SD_BUS_VTABLE_PROPERTY_CONST),
+ SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("State", "s", property_get_state, offsetof(Job, state), SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
SD_BUS_VTABLE_END
};
-static int foreach_client(Job *j, int (*send_message)(sd_bus *bus, const char *name, Job *j)) {
- BusTrackedClient *one_destination = NULL;
- Iterator i;
- sd_bus *b;
- unsigned n, m;
- int r, ret;
-
- assert(j);
- assert(send_message);
-
- n = set_size(j->manager->subscribed);
- m = set_size(j->subscribed);
-
- if (n <= 0 && m <= 0)
- return 0;
-
- if (n == 1 && m == 0)
- one_destination = set_first(j->manager->subscribed);
- else if (n == 0 && m == 1)
- one_destination = set_first(j->subscribed);
- else
- one_destination = NULL;
-
- if (one_destination)
- return send_message(one_destination->bus, isempty(one_destination->name) ? NULL : one_destination->name, j);
-
- ret = 0;
-
- /* Send to everybody */
- SET_FOREACH(b, j->manager->private_buses, i) {
- r = send_message(b, NULL, j);
- if (r < 0)
- ret = r;
- }
-
- if (j->manager->api_bus) {
- r = send_message(j->manager->api_bus, NULL, j);
- if (r < 0)
- ret = r;
- }
-
- return ret;
-}
-
-static int send_new_signal(sd_bus *bus, const char *destination, Job *j) {
+static int send_new_signal(sd_bus *bus, void *userdata) {
_cleanup_bus_message_unref_ sd_bus_message *m = NULL;
_cleanup_free_ char *p = NULL;
+ Job *j = userdata;
int r;
assert(bus);
r = sd_bus_message_new_signal(
bus,
+ &m,
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "JobNew",
- &m);
+ "JobNew");
if (r < 0)
return r;
if (r < 0)
return r;
- return sd_bus_send_to(bus, m, destination, NULL);
+ return sd_bus_send(bus, m, NULL);
}
-static int send_changed_signal(sd_bus *bus, const char *destination, Job *j) {
+static int send_changed_signal(sd_bus *bus, void *userdata) {
_cleanup_free_ char *p = NULL;
+ Job *j = userdata;
assert(bus);
assert(j);
j->in_dbus_queue = false;
}
- r = foreach_client(j, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal);
+ r = bus_foreach_bus(j->manager, j->clients, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j);
if (r < 0)
- log_debug("Failed to send job change signal for %u: %s", j->id, strerror(-r));
+ log_debug_errno(r, "Failed to send job change signal for %u: %m", j->id);
j->sent_dbus_new_signal = true;
}
-static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) {
+static int send_removed_signal(sd_bus *bus, void *userdata) {
_cleanup_bus_message_unref_ sd_bus_message *m = NULL;
_cleanup_free_ char *p = NULL;
+ Job *j = userdata;
int r;
assert(bus);
if (!p)
return -ENOMEM;
-
r = sd_bus_message_new_signal(
bus,
+ &m,
"/org/freedesktop/systemd1",
"org.freedesktop.systemd1.Manager",
- "JobRemoved",
- &m);
+ "JobRemoved");
if (r < 0)
return r;
if (r < 0)
return r;
- return sd_bus_send_to(bus, m, destination, NULL);
+ return sd_bus_send(bus, m, NULL);
}
void bus_job_send_removed_signal(Job *j) {
if (!j->sent_dbus_new_signal)
bus_job_send_change_signal(j);
- r = foreach_client(j, send_removed_signal);
+ r = bus_foreach_bus(j->manager, j->clients, send_removed_signal, j);
if (r < 0)
- log_debug("Failed to send job remove signal for %u: %s", j->id, strerror(-r));
+ log_debug_errno(r, "Failed to send job remove signal for %u: %m", j->id);
}
~ianmdlvl / elogind.git / blobdiff