udev: support ENV{}=="" global property matches

[elogind.git] / src / core / dbus-manager.c

diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index e792fe7e28332638534691fc64641bd8772278b6..c54abd3b4e820af1ba0bd085c365f6f798558a8d 100644 (file)
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -363,7 +363,7 @@ static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata,
         if (!u)
                 return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", name);
 
-        r = selinux_unit_access_check(u, message, "status", error);
+        r = mac_selinux_unit_access_check(u, message, "status", error);
         if (r < 0)
                 return r;
 
@@ -409,7 +409,7 @@ static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *us
         if (!u)
                 return sd_bus_error_setf(error, BUS_ERROR_NO_UNIT_FOR_PID, "PID %u does not belong to any loaded unit.", pid);
 
-        r = selinux_unit_access_check(u, message, "status", error);
+        r = mac_selinux_unit_access_check(u, message, "status", error);
         if (r < 0)
                 return r;
 
@@ -441,7 +441,7 @@ static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata
         if (r < 0)
                 return r;
 
-        r = selinux_unit_access_check(u, message, "status", error);
+        r = mac_selinux_unit_access_check(u, message, "status", error);
         if (r < 0)
                 return r;
 
@@ -648,7 +648,7 @@ static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, voi
         if (mode < 0)
                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode);
 
-        r = selinux_access_check(message, "start", error);
+        r = mac_selinux_access_check(message, "start", error);
         if (r < 0)
                 return r;
 
@@ -702,7 +702,7 @@ static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata,
         if (!j)
                 return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id);
 
-        r = selinux_unit_access_check(j->unit, message, "status", error);
+        r = mac_selinux_unit_access_check(j->unit, message, "status", error);
         if (r < 0)
                 return r;
 
@@ -742,7 +742,7 @@ static int method_clear_jobs(sd_bus *bus, sd_bus_message *message, void *userdat
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reboot", error);
+        r = mac_selinux_access_check(message, "reboot", error);
         if (r < 0)
                 return r;
 
@@ -759,7 +759,7 @@ static int method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userd
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reload", error);
+        r = mac_selinux_access_check(message, "reload", error);
         if (r < 0)
                 return r;
 
@@ -782,7 +782,7 @@ static int list_units_filtered(sd_bus *bus, sd_bus_message *message, void *userd
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -870,7 +870,7 @@ static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -922,7 +922,7 @@ static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -957,7 +957,7 @@ static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userda
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -985,7 +985,7 @@ static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata, sd_
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -1016,7 +1016,7 @@ static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "start", error);
+        r = mac_selinux_access_check(message, "start", error);
         if (r < 0)
                 return r;
 
@@ -1048,7 +1048,7 @@ static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "stop", error);
+        r = mac_selinux_access_check(message, "stop", error);
         if (r < 0)
                 return r;
 
@@ -1080,7 +1080,7 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata, s
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        r = selinux_access_check(message, "reload", error);
+        r = mac_selinux_access_check(message, "reload", error);
         if (r < 0)
                 return r;
 
@@ -1114,7 +1114,7 @@ static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        r = selinux_access_check(message, "reload", error);
+        r = mac_selinux_access_check(message, "reload", error);
         if (r < 0)
                 return r;
 
@@ -1133,7 +1133,7 @@ static int method_exit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "halt", error);
+        r = mac_selinux_access_check(message, "halt", error);
         if (r < 0)
                 return r;
 
@@ -1153,7 +1153,7 @@ static int method_reboot(sd_bus *bus, sd_bus_message *message, void *userdata, s
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reboot", error);
+        r = mac_selinux_access_check(message, "reboot", error);
         if (r < 0)
                 return r;
 
@@ -1174,7 +1174,7 @@ static int method_poweroff(sd_bus *bus, sd_bus_message *message, void *userdata,
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "halt", error);
+        r = mac_selinux_access_check(message, "halt", error);
         if (r < 0)
                 return r;
 
@@ -1194,7 +1194,7 @@ static int method_halt(sd_bus *bus, sd_bus_message *message, void *userdata, sd_
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "halt", error);
+        r = mac_selinux_access_check(message, "halt", error);
         if (r < 0)
                 return r;
 
@@ -1214,7 +1214,7 @@ static int method_kexec(sd_bus *bus, sd_bus_message *message, void *userdata, sd
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reboot", error);
+        r = mac_selinux_access_check(message, "reboot", error);
         if (r < 0)
                 return r;
 
@@ -1236,7 +1236,7 @@ static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userda
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reboot", error);
+        r = mac_selinux_access_check(message, "reboot", error);
         if (r < 0)
                 return r;
 
@@ -1300,7 +1300,7 @@ static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reload", error);
+        r = mac_selinux_access_check(message, "reload", error);
         if (r < 0)
                 return r;
 
@@ -1326,7 +1326,7 @@ static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void *
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reload", error);
+        r = mac_selinux_access_check(message, "reload", error);
         if (r < 0)
                 return r;
 
@@ -1353,22 +1353,22 @@ static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message
         assert(message);
         assert(m);
 
-        r = selinux_access_check(message, "reload", error);
+        r = mac_selinux_access_check(message, "reload", error);
         if (r < 0)
                 return r;
 
-        r = sd_bus_message_read_strv(message, &plus);
+        r = sd_bus_message_read_strv(message, &minus);
         if (r < 0)
                 return r;
 
-        r = sd_bus_message_read_strv(message, &minus);
+        r = sd_bus_message_read_strv(message, &plus);
         if (r < 0)
                 return r;
 
-        if (!strv_env_is_valid(plus))
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
         if (!strv_env_name_or_assignment_is_valid(minus))
                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments");
+        if (!strv_env_is_valid(plus))
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
 
         r = manager_environment_add(m, minus, plus);
         if (r < 0)
@@ -1391,7 +1391,7 @@ static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *us
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -1399,7 +1399,7 @@ static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *us
         if (r < 0)
                 return r;
 
-        h = hashmap_new(string_hash_func, string_compare_func);
+        h = hashmap_new(&string_hash_ops);
         if (!h)
                 return -ENOMEM;
 
@@ -1444,7 +1444,7 @@ static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -1473,7 +1473,7 @@ static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void
 
         /* Anyone can call this method */
 
-        r = selinux_access_check(message, "status", error);
+        r = mac_selinux_access_check(message, "status", error);
         if (r < 0)
                 return r;
 
@@ -1562,9 +1562,6 @@ static int method_enable_unit_files_generic(
                 sd_bus_error *error) {
 
         _cleanup_strv_free_ char **l = NULL;
-#ifdef HAVE_SELINUX
-        char **i;
-#endif
         UnitFileChange *changes = NULL;
         unsigned n_changes = 0;
         UnitFileScope scope;
@@ -1588,18 +1585,9 @@ static int method_enable_unit_files_generic(
         if (r < 0)
                 return r;
 
-#ifdef HAVE_SELINUX
-        STRV_FOREACH(i, l) {
-                Unit *u;
-
-                u = manager_get_unit(m, *i);
-                if (u) {
-                        r = selinux_unit_access_check(u, message, verb, error);
-                        if (r < 0)
-                                return r;
-                }
-        }
-#endif
+        r = mac_selinux_unit_access_check_strv(l, message, m, verb, error);
+        if (r < 0)
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
@@ -1637,9 +1625,6 @@ static int method_mask_unit_files(sd_bus *bus, sd_bus_message *message, void *us
 static int method_preset_unit_files_with_mode(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
 
         _cleanup_strv_free_ char **l = NULL;
-#ifdef HAVE_SELINUX
-        char **i;
-#endif
         UnitFileChange *changes = NULL;
         unsigned n_changes = 0;
         Manager *m = userdata;
@@ -1674,18 +1659,9 @@ static int method_preset_unit_files_with_mode(sd_bus *bus, sd_bus_message *messa
                         return -EINVAL;
         }
 
-#ifdef HAVE_SELINUX
-        STRV_FOREACH(i, l) {
-                Unit *u;
-
-                u = manager_get_unit(m, *i);
-                if (u) {
-                        r = selinux_unit_access_check(u, message, "enable", error);
-                        if (r < 0)
-                                return r;
-                }
-        }
-#endif
+        r = mac_selinux_unit_access_check_strv(l, message, m, "enable", error);
+        if (r < 0)
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
@@ -1720,7 +1696,7 @@ static int method_disable_unit_files_generic(
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        r = selinux_access_check(message, verb, error);
+        r = mac_selinux_access_check(message, verb, error);
         if (r < 0)
                 return r;
 
@@ -1767,7 +1743,7 @@ static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        r = selinux_access_check(message, "enable", error);
+        r = mac_selinux_access_check(message, "enable", error);
         if (r < 0)
                 return r;
 
@@ -1803,7 +1779,7 @@ static int method_preset_all_unit_files(sd_bus *bus, sd_bus_message *message, vo
         if (r == 0)
                 return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
 
-        r = selinux_access_check(message, "enable", error);
+        r = mac_selinux_access_check(message, "enable", error);
         if (r < 0)
                 return r;
 
@@ -1828,6 +1804,52 @@ static int method_preset_all_unit_files(sd_bus *bus, sd_bus_message *message, vo
         return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes);
 }
 
+static int method_add_dependency_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        _cleanup_strv_free_ char **l = NULL;
+        Manager *m = userdata;
+        UnitFileChange *changes = NULL;
+        unsigned n_changes = 0;
+        UnitFileScope scope;
+        int runtime, force, r;
+        char *target;
+        char *type;
+        UnitDependency dep;
+
+        assert(bus);
+        assert(message);
+        assert(m);
+
+        r = bus_verify_manage_unit_files_async(m, message, error);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
+
+        r = sd_bus_message_read_strv(message, &l);
+        if (r < 0)
+                return r;
+
+        r = sd_bus_message_read(message, "ssbb", &target, &type, &runtime, &force);
+        if (r < 0)
+                return r;
+
+        dep = unit_dependency_from_string(type);
+        if (dep < 0)
+                return -EINVAL;
+
+        r = mac_selinux_unit_access_check_strv(l, message, m, "enable", error);
+        if (r < 0)
+                return r;
+
+        scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
+
+        r = unit_file_add_dependency(scope, runtime, NULL, l, target, dep, force, &changes, &n_changes);
+        if (r < 0)
+                return r;
+
+        return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes);
+}
+
 const sd_bus_vtable bus_manager_vtable[] = {
         SD_BUS_VTABLE_START(0),
 
@@ -1918,6 +1940,7 @@ const sd_bus_vtable bus_manager_vtable[] = {
         SD_BUS_METHOD("SetDefaultTarget", "sb", "a(sss)", method_set_default_target, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("GetDefaultTarget", NULL, "s", method_get_default_target, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("PresetAllUnitFiles", "sbb", "a(sss)", method_preset_all_unit_files, SD_BUS_VTABLE_UNPRIVILEGED),
+        SD_BUS_METHOD("AddDependencyUnitFiles", "asssbb", "a(sss)", method_add_dependency_unit_files, SD_BUS_VTABLE_UNPRIVILEGED),
 
         SD_BUS_SIGNAL("UnitNew", "so", 0),
         SD_BUS_SIGNAL("UnitRemoved", "so", 0),