chiark / gitweb /
sd-bus: rework credential query logic
[elogind.git] / src / libsystemd / sd-bus / bus-control.c
index 23fb0e7..71fdbcf 100644 (file)
@@ -62,7 +62,7 @@ static int bus_request_name_kernel(sd_bus *bus, const char *name, uint64_t flags
         size = offsetof(struct kdbus_cmd_name, items) + KDBUS_ITEM_SIZE(l);
         n = alloca0_align(size, 8);
         n->size = size;
-        kdbus_translate_request_name_flags(flags, (uint64_t *) &n->flags);
+        n->flags = request_name_flags_to_kdbus(flags);
 
         n->items[0].size = KDBUS_ITEM_HEADER_SIZE + l;
         n->items[0].type = KDBUS_ITEM_NAME;
@@ -223,23 +223,6 @@ _public_ int sd_bus_release_name(sd_bus *bus, const char *name) {
                 return bus_release_name_dbus1(bus, name);
 }
 
-static int kernel_cmd_free(sd_bus *bus, uint64_t offset)
-{
-        struct kdbus_cmd_free cmd;
-        int r;
-
-        assert(bus);
-
-        cmd.flags = 0;
-        cmd.offset = offset;
-
-        r = ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
-        if (r < 0)
-                return -errno;
-
-        return 0;
-}
-
 static int kernel_get_list(sd_bus *bus, uint64_t flags, char ***x) {
         struct kdbus_cmd_name_list cmd = {};
         struct kdbus_name_list *name_list;
@@ -293,7 +276,7 @@ static int kernel_get_list(sd_bus *bus, uint64_t flags, char ***x) {
         r = 0;
 
 fail:
-        kernel_cmd_free(bus, cmd.offset);
+        bus_kernel_cmd_free(bus, cmd.offset);
         return r;
 }
 
@@ -392,15 +375,20 @@ _public_ int sd_bus_list_names(sd_bus *bus, char ***acquired, char ***activatabl
                 return bus_list_names_dbus1(bus, acquired, activatable);
 }
 
-static int bus_populate_creds_from_items(sd_bus *bus,
-                                         struct kdbus_info *info,
-                                         uint64_t mask,
-                                         sd_bus_creds *c) {
+static int bus_populate_creds_from_items(
+                sd_bus *bus,
+                struct kdbus_info *info,
+                uint64_t mask,
+                sd_bus_creds *c) {
 
         struct kdbus_item *item;
         uint64_t m;
         int r;
 
+        assert(bus);
+        assert(info);
+        assert(c);
+
         KDBUS_ITEM_FOREACH(item, info, items) {
 
                 switch (item->type) {
@@ -470,9 +458,9 @@ static int bus_populate_creds_from_items(sd_bus *bus,
 
                 case KDBUS_ITEM_PID_COMM:
                         if (mask & SD_BUS_CREDS_COMM) {
-                                c->comm = strdup(item->str);
-                                if (!c->comm)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->comm, item->str);
+                                if (r < 0)
+                                        return r;
 
                                 c->mask |= SD_BUS_CREDS_COMM;
                         }
@@ -480,9 +468,9 @@ static int bus_populate_creds_from_items(sd_bus *bus,
 
                 case KDBUS_ITEM_TID_COMM:
                         if (mask & SD_BUS_CREDS_TID_COMM) {
-                                c->tid_comm = strdup(item->str);
-                                if (!c->tid_comm)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->tid_comm, item->str);
+                                if (r < 0)
+                                        return r;
 
                                 c->mask |= SD_BUS_CREDS_TID_COMM;
                         }
@@ -490,9 +478,9 @@ static int bus_populate_creds_from_items(sd_bus *bus,
 
                 case KDBUS_ITEM_EXE:
                         if (mask & SD_BUS_CREDS_EXE) {
-                                c->exe = strdup(item->str);
-                                if (!c->exe)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->exe, item->str);
+                                if (r < 0)
+                                        return r;
 
                                 c->mask |= SD_BUS_CREDS_EXE;
                         }
@@ -515,17 +503,17 @@ static int bus_populate_creds_from_items(sd_bus *bus,
                              SD_BUS_CREDS_SESSION | SD_BUS_CREDS_OWNER_UID) & mask;
 
                         if (m) {
-                                c->cgroup = strdup(item->str);
-                                if (!c->cgroup)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->cgroup, item->str);
+                                if (r < 0)
+                                        return r;
 
                                 r = bus_get_root_path(bus);
                                 if (r < 0)
                                         return r;
 
-                                c->cgroup_root = strdup(bus->cgroup_root);
-                                if (!c->cgroup_root)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->cgroup_root, bus->cgroup_root);
+                                if (r < 0)
+                                        return r;
 
                                 c->mask |= m;
                         }
@@ -547,9 +535,9 @@ static int bus_populate_creds_from_items(sd_bus *bus,
 
                 case KDBUS_ITEM_SECLABEL:
                         if (mask & SD_BUS_CREDS_SELINUX_CONTEXT) {
-                                c->label = strdup(item->str);
-                                if (!c->label)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->label, item->str);
+                                if (r < 0)
+                                        return r;
 
                                 c->mask |= SD_BUS_CREDS_SELINUX_CONTEXT;
                         }
@@ -579,9 +567,9 @@ static int bus_populate_creds_from_items(sd_bus *bus,
 
                 case KDBUS_ITEM_CONN_DESCRIPTION:
                         if (mask & SD_BUS_CREDS_DESCRIPTION) {
-                                c->description = strdup(item->str);
-                                if (!c->description)
-                                        return -ENOMEM;
+                                r = free_and_strdup(&c->description, item->str);
+                                if (r < 0)
+                                        return r;
 
                                 c->mask |= SD_BUS_CREDS_DESCRIPTION;
                         }
@@ -589,18 +577,18 @@ static int bus_populate_creds_from_items(sd_bus *bus,
 
                 case KDBUS_ITEM_AUXGROUPS:
                         if (mask & SD_BUS_CREDS_SUPPLEMENTARY_GIDS) {
-                                size_t i, n;
-                                uid_t *u;
+                                size_t n;
+                                uid_t *g;
 
-                                n = (item->size - offsetof(struct kdbus_item, data64)) / sizeof(uint64_t);
-                                u = new(uid_t, n);
-                                if (!u)
-                                        return -ENOMEM;
+                                assert_cc(sizeof(gid_t) == sizeof(uint32_t));
 
-                                for (i = 0; i < n; i++)
-                                        u[i] = (uid_t) item->data64[i];
+                                n = (item->size - offsetof(struct kdbus_item, data32)) / sizeof(uint32_t);
+                                g = newdup(gid_t, item->data32, n);
+                                if (!g)
+                                        return -ENOMEM;
 
-                                c->supplementary_gids = u;
+                                free(c->supplementary_gids);
+                                c->supplementary_gids = g;
                                 c->n_supplementary_gids = n;
 
                                 c->mask |= SD_BUS_CREDS_SUPPLEMENTARY_GIDS;
@@ -642,7 +630,7 @@ static int bus_get_name_creds_kdbus(
         }
 
         cmd->size = size;
-        kdbus_translate_attach_flags(mask, (uint64_t*) &cmd->flags);
+        cmd->flags = attach_flags_to_kdbus(mask);
 
         /* If augmentation is on, and the bus doesn't didn't allow us
          * to get the bits we want, then ask for the PID/TID so that we
@@ -687,6 +675,13 @@ static int bus_get_name_creds_kdbus(
                 c->mask |= SD_BUS_CREDS_UNIQUE_NAME;
         }
 
+        /* If KDBUS_ITEM_OWNED_NAME is requested then we'll get 0 of
+           them in case the service has no names. This does not mean
+           however that the list of owned names could not be
+           acquired. Hence, let's explicitly clarify that the data is
+           complete. */
+        c->mask |= mask & SD_BUS_CREDS_WELL_KNOWN_NAMES;
+
         r = bus_populate_creds_from_items(bus, conn_info, mask, c);
         if (r < 0)
                 goto fail;
@@ -703,7 +698,7 @@ static int bus_get_name_creds_kdbus(
         r = 0;
 
 fail:
-        kernel_cmd_free(bus, cmd->offset);
+        bus_kernel_cmd_free(bus, cmd->offset);
         return r;
 }
 
@@ -885,18 +880,58 @@ _public_ int sd_bus_get_name_creds(
                 return bus_get_name_creds_dbus1(bus, name, mask, creds);
 }
 
-_public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+static int bus_get_owner_creds_kdbus(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
         _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
+        struct kdbus_cmd_info cmd = {
+                .size = sizeof(struct kdbus_cmd_info)
+        };
+        struct kdbus_info *creator_info;
         pid_t pid = 0;
         int r;
 
-        assert_return(bus, -EINVAL);
-        assert_return((mask & ~SD_BUS_CREDS_AUGMENT) <= _SD_BUS_CREDS_ALL, -ENOTSUP);
-        assert_return(ret, -EINVAL);
-        assert_return(!bus_pid_changed(bus), -ECHILD);
+        c = bus_creds_new();
+        if (!c)
+                return -ENOMEM;
 
-        if (!BUS_IS_OPEN(bus->state))
-                return -ENOTCONN;
+        cmd.flags = attach_flags_to_kdbus(mask);
+
+        /* If augmentation is on, and the bus doesn't didn't allow us
+         * to get the bits we want, then ask for the PID/TID so that we
+         * can read the rest from /proc. */
+        if ((mask & SD_BUS_CREDS_AUGMENT) &&
+            (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
+                     SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
+                     SD_BUS_CREDS_COMM|SD_BUS_CREDS_TID_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
+                     SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
+                     SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
+                     SD_BUS_CREDS_SELINUX_CONTEXT|
+                     SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
+                cmd.flags |= KDBUS_ATTACH_PIDS;
+
+        r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
+        if (r < 0)
+                return -errno;
+
+        creator_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd.offset);
+
+        r = bus_populate_creds_from_items(bus, creator_info, mask, c);
+        bus_kernel_cmd_free(bus, cmd.offset);
+        if (r < 0)
+                return r;
+
+        r = bus_creds_add_more(c, mask, pid, 0);
+        if (r < 0)
+                return r;
+
+        *ret = c;
+        c = NULL;
+        return 0;
+}
+
+static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+        _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
+        pid_t pid = 0;
+        int r;
 
         if (!bus->ucred_valid && !isempty(bus->label))
                 return -ENODATA;
@@ -906,11 +941,20 @@ _public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **r
                 return -ENOMEM;
 
         if (bus->ucred_valid) {
-                pid = c->pid = bus->ucred.pid;
-                c->uid = bus->ucred.uid;
-                c->gid = bus->ucred.gid;
+                if (bus->ucred.pid > 0) {
+                        pid = c->pid = bus->ucred.pid;
+                        c->mask |= SD_BUS_CREDS_PID & mask;
+                }
+
+                if (bus->ucred.uid != (uid_t) -1) {
+                        c->uid = bus->ucred.uid;
+                        c->mask |= SD_BUS_CREDS_UID & mask;
+                }
 
-                c->mask |= (SD_BUS_CREDS_UID | SD_BUS_CREDS_PID | SD_BUS_CREDS_GID) & mask;
+                if (bus->ucred.gid != (gid_t) -1) {
+                        c->gid = bus->ucred.gid;
+                        c->mask |= SD_BUS_CREDS_GID & mask;
+                }
         }
 
         if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
@@ -921,39 +965,6 @@ _public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **r
                 c->mask |= SD_BUS_CREDS_SELINUX_CONTEXT;
         }
 
-        if (bus->is_kernel) {
-                struct kdbus_cmd_info cmd = {};
-                struct kdbus_info *creator_info;
-
-                cmd.size = sizeof(cmd);
-                kdbus_translate_attach_flags(mask, (uint64_t*) &cmd.flags);
-
-                /* If augmentation is on, and the bus doesn't didn't allow us
-                 * to get the bits we want, then ask for the PID/TID so that we
-                 * can read the rest from /proc. */
-                if ((mask & SD_BUS_CREDS_AUGMENT) &&
-                    (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
-                             SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
-                             SD_BUS_CREDS_COMM|SD_BUS_CREDS_TID_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
-                             SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
-                             SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
-                             SD_BUS_CREDS_SELINUX_CONTEXT|
-                             SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
-                        cmd.flags |= KDBUS_ATTACH_PIDS;
-
-                r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
-                if (r < 0)
-                        return -errno;
-
-                creator_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd.offset);
-
-                r = bus_populate_creds_from_items(bus, creator_info, mask, c);
-                kernel_cmd_free(bus, cmd.offset);
-
-                if (r < 0)
-                        return r;
-        }
-
         r = bus_creds_add_more(c, mask, pid, 0);
         if (r < 0)
                 return r;
@@ -963,6 +974,21 @@ _public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **r
         return 0;
 }
 
+_public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+        assert_return(bus, -EINVAL);
+        assert_return((mask & ~SD_BUS_CREDS_AUGMENT) <= _SD_BUS_CREDS_ALL, -ENOTSUP);
+        assert_return(ret, -EINVAL);
+        assert_return(!bus_pid_changed(bus), -ECHILD);
+
+        if (!BUS_IS_OPEN(bus->state))
+                return -ENOTCONN;
+
+        if (bus->is_kernel)
+                return bus_get_owner_creds_kdbus(bus, mask, ret);
+        else
+                return bus_get_owner_creds_dbus1(bus, mask, ret);
+}
+
 static int add_name_change_match(sd_bus *bus,
                                  uint64_t cookie,
                                  const char *name,