X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fdbus-execute.c;h=ecbadd765b5bdebb45d38057322881c8502021be;hp=6d0bdce9dc4551eb4befced6d4801b6718583175;hb=2968644080fd103062f070e83edd620e0a58c44d;hpb=e66cf1a3f94fff48a572f6dbd19b43c9bcf7b8c7

diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index 6d0bdce9d..ecbadd765 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -35,6 +35,7 @@
 #include "capability.h"
 #include "env-util.h"
 #include "af-list.h"
+#include "namespace.h"
 
 #ifdef HAVE_SECCOMP
 #include "seccomp-util.h"
@@ -44,6 +45,9 @@ BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_exec_output, exec_output, ExecOutp
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_input, exec_input, ExecInput);
 
+static BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_protect_home, protect_home, ProtectHome);
+static BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_protect_system, protect_system, ProtectSystem);
+
 static int property_get_environment_files(
                 sd_bus *bus,
                 const char *path,
@@ -87,6 +91,7 @@ static int property_get_rlimit(
 
         struct rlimit *rl;
         uint64_t u;
+        rlim_t x;
 
         assert(bus);
         assert(reply);
@@ -94,7 +99,7 @@ static int property_get_rlimit(
 
         rl = *(struct rlimit**) userdata;
         if (rl)
-                u = (uint64_t) rl->rlim_max;
+                x = rl->rlim_max;
         else {
                 struct rlimit buf = {};
                 int z;
@@ -103,10 +108,14 @@ static int property_get_rlimit(
                 assert(z >= 0);
 
                 getrlimit(z, &buf);
-
-                u = (uint64_t) buf.rlim_max;
+                x = buf.rlim_max;
         }
 
+        /* rlim_t might have different sizes, let's map
+         * RLIMIT_INFINITY to (uint64_t) -1, so that it is the same on
+         * all archs */
+        u = x == RLIM_INFINITY ? (uint64_t) -1 : (uint64_t) x;
+
         return sd_bus_message_append(reply, "t", u);
 }
 
@@ -385,11 +394,9 @@ static int property_get_syscall_filter(
                 if (!name)
                         continue;
 
-                r = strv_push(&l, name);
-                if (r < 0) {
-                        free(name);
-                        return -ENOMEM;
-                }
+                r = strv_consume(&l, name);
+                if (r < 0)
+                        return r;
         }
 #endif
 
@@ -615,7 +622,6 @@ const sd_bus_vtable bus_exec_vtable[] = {
         SD_BUS_PROPERTY("User", "s", NULL, offsetof(ExecContext, user), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("Group", "s", NULL, offsetof(ExecContext, group), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("SupplementaryGroups", "as", NULL, offsetof(ExecContext, supplementary_groups), SD_BUS_VTABLE_PROPERTY_CONST),
-        SD_BUS_PROPERTY("TCPWrapName", "s", NULL, offsetof(ExecContext, tcpwrap_name), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("PAMName", "s", NULL, offsetof(ExecContext, pam_name), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_dirs), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_dirs), SD_BUS_VTABLE_PROPERTY_CONST),
@@ -624,6 +630,8 @@ const sd_bus_vtable bus_exec_vtable[] = {
         SD_BUS_PROPERTY("PrivateTmp", "b", bus_property_get_bool, offsetof(ExecContext, private_tmp), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("PrivateNetwork", "b", bus_property_get_bool, offsetof(ExecContext, private_network), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("PrivateDevices", "b", bus_property_get_bool, offsetof(ExecContext, private_devices), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("ProtectHome", "s", bus_property_get_protect_home, offsetof(ExecContext, protect_home), SD_BUS_VTABLE_PROPERTY_CONST),
+        SD_BUS_PROPERTY("ProtectSystem", "s", bus_property_get_protect_system, offsetof(ExecContext, protect_system), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("SameProcessGroup", "b", bus_property_get_bool, offsetof(ExecContext, same_pgrp), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("UtmpIdentifier", "s", NULL, offsetof(ExecContext, utmp_id), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("SELinuxContext", "(bs)", property_get_selinux_context, 0, SD_BUS_VTABLE_PROPERTY_CONST),
@@ -840,13 +848,51 @@ int bus_exec_context_set_transient_property(
                         strv_free(c->environment);
                         c->environment = e;
 
-                        joined = strv_join(c->environment, " ");
+                        joined = strv_join_quoted(c->environment);
                         if (!joined)
                                 return -ENOMEM;
 
                         unit_write_drop_in_private_format(u, mode, name, "Environment=%s\n", joined);
                 }
 
+                return 1;
+
+        } else if (rlimit_from_string(name) >= 0) {
+                uint64_t rl;
+                rlim_t x;
+
+                r = sd_bus_message_read(message, "t", &rl);
+                if (r < 0)
+                        return r;
+
+                if (rl == (uint64_t) -1)
+                        x = RLIM_INFINITY;
+                else {
+                        x = (rlim_t) rl;
+
+                        if ((uint64_t) x != rl)
+                                return -ERANGE;
+                }
+
+                if (mode != UNIT_CHECK) {
+                        int z;
+
+                        z = rlimit_from_string(name);
+
+                        if (!c->rlimit[z]) {
+                                c->rlimit[z] = new(struct rlimit, 1);
+                                if (!c->rlimit[z])
+                                        return -ENOMEM;
+                        }
+
+                        c->rlimit[z]->rlim_cur = c->rlimit[z]->rlim_max = x;
+
+                        if (x == RLIM_INFINITY)
+                                unit_write_drop_in_private_format(u, mode, name, "%s=infinity\n", name);
+                        else
+                                unit_write_drop_in_private_format(u, mode, name, "%s=%" PRIu64 "\n", name, rl);
+                }
+
                 return 1;
         }