#include "bus-control.h"
#include "bus-bloom.h"
#include "bus-util.h"
+#include "capability.h"
#include "cgroup-util.h"
_public_ int sd_bus_get_unique_name(sd_bus *bus, const char **unique) {
assert_return(service_name_is_valid(name), -EINVAL);
assert_return(name[0] != ':', -EINVAL);
+ /* Don't allow requesting the special driver and local names */
+ if (STR_IN_SET(name, "org.freedesktop.DBus", "org.freedesktop.DBus.Local"))
+ return -EINVAL;
+
if (!BUS_IS_OPEN(bus->state))
return -ENOTCONN;
assert_return(service_name_is_valid(name), -EINVAL);
assert_return(name[0] != ':', -EINVAL);
+ /* Don't allow releasing the special driver and local names */
+ if (STR_IN_SET(name, "org.freedesktop.DBus", "org.freedesktop.DBus.Local"))
+ return -EINVAL;
+
if (!BUS_IS_OPEN(bus->state))
return -ENOTCONN;
return bus_release_name_dbus1(bus, name);
}
-static int kernel_cmd_free(sd_bus *bus, uint64_t offset)
-{
- struct kdbus_cmd_free cmd;
- int r;
-
- assert(bus);
-
- cmd.flags = 0;
- cmd.offset = offset;
-
- r = ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
- if (r < 0)
- return -errno;
-
- return 0;
-}
-
static int kernel_get_list(sd_bus *bus, uint64_t flags, char ***x) {
struct kdbus_cmd_name_list cmd = {};
struct kdbus_name_list *name_list;
/* Caller will free half-constructed list on failure... */
+ cmd.size = sizeof(cmd);
cmd.flags = flags;
r = ioctl(bus->input_fd, KDBUS_CMD_NAME_LIST, &cmd);
r = 0;
fail:
- kernel_cmd_free(bus, cmd.offset);
+ bus_kernel_cmd_free(bus, cmd.offset);
return r;
}
c->mask |= SD_BUS_CREDS_TID;
}
- if (mask & SD_BUS_CREDS_PID_STARTTIME && item->pids.starttime > 0) {
- c->pid_starttime = item->pids.starttime;
- c->mask |= SD_BUS_CREDS_PID_STARTTIME;
- }
-
break;
case KDBUS_ITEM_CREDS:
- if (mask & SD_BUS_CREDS_UID && (uid_t) item->creds.uid != (uid_t) -1) {
+ if (mask & SD_BUS_CREDS_UID && (uid_t) item->creds.uid != UID_INVALID) {
c->uid = (uid_t) item->creds.uid;
c->mask |= SD_BUS_CREDS_UID;
}
- if (mask & SD_BUS_CREDS_EUID && (uid_t) item->creds.euid != (uid_t) -1) {
+ if (mask & SD_BUS_CREDS_EUID && (uid_t) item->creds.euid != UID_INVALID) {
c->euid = (uid_t) item->creds.euid;
c->mask |= SD_BUS_CREDS_EUID;
}
- if (mask & SD_BUS_CREDS_SUID && (uid_t) item->creds.suid != (uid_t) -1) {
+ if (mask & SD_BUS_CREDS_SUID && (uid_t) item->creds.suid != UID_INVALID) {
c->suid = (uid_t) item->creds.suid;
c->mask |= SD_BUS_CREDS_SUID;
}
- if (mask & SD_BUS_CREDS_FSUID && (uid_t) item->creds.fsuid != (uid_t) -1) {
+ if (mask & SD_BUS_CREDS_FSUID && (uid_t) item->creds.fsuid != UID_INVALID) {
c->fsuid = (uid_t) item->creds.fsuid;
c->mask |= SD_BUS_CREDS_FSUID;
}
- if (mask & SD_BUS_CREDS_GID && (gid_t) item->creds.gid != (gid_t) -1) {
+ if (mask & SD_BUS_CREDS_GID && (gid_t) item->creds.gid != GID_INVALID) {
c->gid = (gid_t) item->creds.gid;
c->mask |= SD_BUS_CREDS_GID;
}
- if (mask & SD_BUS_CREDS_EGID && (gid_t) item->creds.egid != (gid_t) -1) {
+ if (mask & SD_BUS_CREDS_EGID && (gid_t) item->creds.egid != GID_INVALID) {
c->egid = (gid_t) item->creds.egid;
c->mask |= SD_BUS_CREDS_EGID;
}
- if (mask & SD_BUS_CREDS_SGID && (gid_t) item->creds.sgid != (gid_t) -1) {
+ if (mask & SD_BUS_CREDS_SGID && (gid_t) item->creds.sgid != GID_INVALID) {
c->sgid = (gid_t) item->creds.sgid;
c->mask |= SD_BUS_CREDS_SGID;
}
- if (mask & SD_BUS_CREDS_FSGID && (gid_t) item->creds.fsgid != (gid_t) -1) {
+ if (mask & SD_BUS_CREDS_FSGID && (gid_t) item->creds.fsgid != GID_INVALID) {
c->fsgid = (gid_t) item->creds.fsgid;
c->mask |= SD_BUS_CREDS_FSGID;
}
SD_BUS_CREDS_INHERITABLE_CAPS | SD_BUS_CREDS_BOUNDING_CAPS) & mask;
if (m) {
- c->capability_size = item->size - offsetof(struct kdbus_item, caps.caps);
- c->capability = memdup(item->caps.caps, c->capability_size);
+ if (item->caps.last_cap != cap_last_cap() ||
+ item->size - offsetof(struct kdbus_item, caps.caps) < DIV_ROUND_UP(item->caps.last_cap, 32U) * 4 * 4)
+ return -EBADMSG;
+
+ c->capability = memdup(item->caps.caps, item->size - offsetof(struct kdbus_item, caps.caps));
if (!c->capability)
return -ENOMEM;
c->mask |= SD_BUS_CREDS_AUDIT_SESSION_ID;
}
- if (mask & SD_BUS_CREDS_AUDIT_LOGIN_UID && (uid_t) item->audit.loginuid != (uid_t) -1) {
+ if (mask & SD_BUS_CREDS_AUDIT_LOGIN_UID && (uid_t) item->audit.loginuid != UID_INVALID) {
c->audit_login_uid = (uid_t) item->audit.loginuid;
c->mask |= SD_BUS_CREDS_AUDIT_LOGIN_UID;
}
return 0;
}
-static int bus_get_name_creds_kdbus(
+int bus_get_name_creds_kdbus(
sd_bus *bus,
const char *name,
uint64_t mask,
+ bool allow_activator,
sd_bus_creds **creds) {
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
uint64_t id;
int r;
+ if (streq(name, "org.freedesktop.DBus"))
+ return -ENOTSUP;
+
r = bus_kernel_parse_unique_name(name, &id);
if (r < 0)
return r;
memcpy(cmd->items[0].str, name, l);
}
- cmd->size = size;
- cmd->flags = attach_flags_to_kdbus(mask);
-
- /* If augmentation is on, and the bus doesn't didn't allow us
- * to get the bits we want, then ask for the PID/TID so that we
+ /* If augmentation is on, and the bus didn't provide us
+ * the bits we want, then ask for the PID/TID so that we
* can read the rest from /proc. */
if ((mask & SD_BUS_CREDS_AUGMENT) &&
(mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
SD_BUS_CREDS_SELINUX_CONTEXT|
SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
- cmd->flags |= KDBUS_ATTACH_PIDS;
+ mask |= SD_BUS_CREDS_PID;
+
+ cmd->size = size;
+ cmd->flags = attach_flags_to_kdbus(mask);
r = ioctl(bus->input_fd, KDBUS_CMD_CONN_INFO, cmd);
if (r < 0)
conn_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd->offset);
/* Non-activated names are considered not available */
- if (conn_info->flags & KDBUS_HELLO_ACTIVATOR) {
+ if (!allow_activator && (conn_info->flags & KDBUS_HELLO_ACTIVATOR)) {
if (name[0] == ':')
r = -ENXIO;
else
r = 0;
fail:
- kernel_cmd_free(bus, cmd->offset);
+ bus_kernel_cmd_free(bus, cmd->offset);
return r;
}
if ((mask & SD_BUS_CREDS_PID) ||
((mask & SD_BUS_CREDS_AUGMENT) &&
- (mask & (SD_BUS_CREDS_PID_STARTTIME|
- SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
+ (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
SD_BUS_CREDS_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
reply = sd_bus_message_unref(reply);
}
- if (mask & SD_BUS_CREDS_UID) {
+ if (mask & SD_BUS_CREDS_EUID) {
uint32_t u;
r = sd_bus_call_method(
if (r < 0)
return r;
- c->uid = u;
- c->mask |= SD_BUS_CREDS_UID;
+ c->euid = u;
+ c->mask |= SD_BUS_CREDS_EUID;
reply = sd_bus_message_unref(reply);
}
assert_return(service_name_is_valid(name), -EINVAL);
assert_return(bus->bus_client, -ENODATA);
+ if (streq(name, "org.freedesktop.DBus.Local"))
+ return -EINVAL;
+
if (!BUS_IS_OPEN(bus->state))
return -ENOTCONN;
if (bus->is_kernel)
- return bus_get_name_creds_kdbus(bus, name, mask, creds);
+ return bus_get_name_creds_kdbus(bus, name, mask, false, creds);
else
return bus_get_name_creds_dbus1(bus, name, mask, creds);
}
-_public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+static int bus_get_owner_creds_kdbus(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
+ struct kdbus_cmd_info cmd = {
+ .size = sizeof(struct kdbus_cmd_info)
+ };
+ struct kdbus_info *creator_info;
pid_t pid = 0;
int r;
- assert_return(bus, -EINVAL);
- assert_return((mask & ~SD_BUS_CREDS_AUGMENT) <= _SD_BUS_CREDS_ALL, -ENOTSUP);
- assert_return(ret, -EINVAL);
- assert_return(!bus_pid_changed(bus), -ECHILD);
+ c = bus_creds_new();
+ if (!c)
+ return -ENOMEM;
- if (!BUS_IS_OPEN(bus->state))
- return -ENOTCONN;
+ /* If augmentation is on, and the bus doesn't didn't allow us
+ * to get the bits we want, then ask for the PID/TID so that we
+ * can read the rest from /proc. */
+ if ((mask & SD_BUS_CREDS_AUGMENT) &&
+ (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
+ SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
+ SD_BUS_CREDS_COMM|SD_BUS_CREDS_TID_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
+ SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
+ SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
+ SD_BUS_CREDS_SELINUX_CONTEXT|
+ SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
+ mask |= SD_BUS_CREDS_PID;
+
+ cmd.flags = attach_flags_to_kdbus(mask);
+
+ r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
+ if (r < 0)
+ return -errno;
+
+ creator_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd.offset);
+
+ r = bus_populate_creds_from_items(bus, creator_info, mask, c);
+ bus_kernel_cmd_free(bus, cmd.offset);
+ if (r < 0)
+ return r;
+
+ r = bus_creds_add_more(c, mask, pid, 0);
+ if (r < 0)
+ return r;
+
+ *ret = c;
+ c = NULL;
+ return 0;
+}
+
+static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+ _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
+ pid_t pid = 0;
+ int r;
if (!bus->ucred_valid && !isempty(bus->label))
return -ENODATA;
return -ENOMEM;
if (bus->ucred_valid) {
- pid = c->pid = bus->ucred.pid;
- c->uid = bus->ucred.uid;
- c->gid = bus->ucred.gid;
+ if (bus->ucred.pid > 0) {
+ pid = c->pid = bus->ucred.pid;
+ c->mask |= SD_BUS_CREDS_PID & mask;
+ }
+
+ if (bus->ucred.uid != UID_INVALID) {
+ c->euid = bus->ucred.uid;
+ c->mask |= SD_BUS_CREDS_EUID & mask;
+ }
- c->mask |= (SD_BUS_CREDS_UID | SD_BUS_CREDS_PID | SD_BUS_CREDS_GID) & mask;
+ if (bus->ucred.gid != GID_INVALID) {
+ c->egid = bus->ucred.gid;
+ c->mask |= SD_BUS_CREDS_EGID & mask;
+ }
}
if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
c->mask |= SD_BUS_CREDS_SELINUX_CONTEXT;
}
- if (bus->is_kernel) {
- struct kdbus_cmd_info cmd = {};
- struct kdbus_info *creator_info;
-
- cmd.size = sizeof(cmd);
- cmd.flags = attach_flags_to_kdbus(mask);
-
- /* If augmentation is on, and the bus doesn't didn't allow us
- * to get the bits we want, then ask for the PID/TID so that we
- * can read the rest from /proc. */
- if ((mask & SD_BUS_CREDS_AUGMENT) &&
- (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
- SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
- SD_BUS_CREDS_COMM|SD_BUS_CREDS_TID_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
- SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
- SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
- SD_BUS_CREDS_SELINUX_CONTEXT|
- SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
- cmd.flags |= KDBUS_ATTACH_PIDS;
-
- r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
- if (r < 0)
- return -errno;
-
- creator_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd.offset);
-
- r = bus_populate_creds_from_items(bus, creator_info, mask, c);
- kernel_cmd_free(bus, cmd.offset);
-
- if (r < 0)
- return r;
- }
-
r = bus_creds_add_more(c, mask, pid, 0);
if (r < 0)
return r;
return 0;
}
+_public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+ assert_return(bus, -EINVAL);
+ assert_return((mask & ~SD_BUS_CREDS_AUGMENT) <= _SD_BUS_CREDS_ALL, -ENOTSUP);
+ assert_return(ret, -EINVAL);
+ assert_return(!bus_pid_changed(bus), -ECHILD);
+
+ if (!BUS_IS_OPEN(bus->state))
+ return -ENOTCONN;
+
+ if (bus->is_kernel)
+ return bus_get_owner_creds_kdbus(bus, mask, ret);
+ else
+ return bus_get_owner_creds_dbus1(bus, mask, ret);
+}
+
static int add_name_change_match(sd_bus *bus,
uint64_t cookie,
const char *name,
assert(bus);
+ /* Monitor streams don't support matches, make this a NOP */
+ if (bus->hello_flags & KDBUS_HELLO_MONITOR)
+ return 0;
+
bloom = alloca0(bus->bloom_size);
sz = ALIGN8(offsetof(struct kdbus_cmd_match, items));
if (c->type - BUS_MATCH_ARG < 3)
name_change_arg[c->type - BUS_MATCH_ARG] = c->value_str;
- snprintf(buf, sizeof(buf), "arg%u", c->type - BUS_MATCH_ARG);
+ snprintf(buf, sizeof(buf), "arg%i", c->type - BUS_MATCH_ARG);
bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, buf, c->value_str);
using_bloom = true;
break;
case BUS_MATCH_ARG_PATH...BUS_MATCH_ARG_PATH_LAST: {
char buf[sizeof("arg")-1 + 2 + sizeof("-slash-prefix")];
- snprintf(buf, sizeof(buf), "arg%u-slash-prefix", c->type - BUS_MATCH_ARG_PATH);
+ snprintf(buf, sizeof(buf), "arg%i-slash-prefix", c->type - BUS_MATCH_ARG_PATH);
bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, buf, c->value_str);
using_bloom = true;
break;
case BUS_MATCH_ARG_NAMESPACE...BUS_MATCH_ARG_NAMESPACE_LAST: {
char buf[sizeof("arg")-1 + 2 + sizeof("-dot-prefix")];
- snprintf(buf, sizeof(buf), "arg%u-dot-prefix", c->type - BUS_MATCH_ARG_NAMESPACE);
+ snprintf(buf, sizeof(buf), "arg%i-dot-prefix", c->type - BUS_MATCH_ARG_NAMESPACE);
bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, buf, c->value_str);
using_bloom = true;
break;
assert(bus);
+ /* Monitor streams don't support matches, make this a NOP */
+ if (bus->hello_flags & KDBUS_HELLO_MONITOR)
+ return 0;
+
zero(m);
m.size = offsetof(struct kdbus_cmd_match, items);
m.cookie = cookie;
~ianmdlvl / elogind.git / blobdiff