X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fdbus-job.c;h=8b5ea2566d22dd6537005d88cf43d670670afba5;hp=8e4ffc977d20752387f2c3175e476e45496f0346;hb=b02cb41c78c61c27bf1432e19f241a3c3d47a419;hpb=4f4f70361a64957c45a2d8f40bfb04c77b454697

diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c
index 8e4ffc977..8b5ea2566 100644
--- a/src/core/dbus-job.c
+++ b/src/core/dbus-job.c
@@ -29,6 +29,22 @@
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType);
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState);
 
+static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) {
+        int r;
+
+        if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message)))
+                return 0; /* One of the job owners is calling us */
+
+        r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action");
+
+        /* Root has called us */
+        return 0;
+}
+
 static int property_get_unit(
                 sd_bus *bus,
                 const char *path,
@@ -52,7 +68,7 @@ static int property_get_unit(
         return sd_bus_message_append(reply, "(so)", j->unit->id, p);
 }
 
-static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Job *j = userdata;
         int r;
 
@@ -60,7 +76,11 @@ static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, s
         assert(message);
         assert(j);
 
-        r = selinux_unit_access_check(j->unit, message, "stop", error);
+        r = verify_sys_admin_or_owner_sync(message, j, error);
+        if (r < 0)
+                return r;
+
+        r = mac_selinux_unit_access_check(j->unit, message, "stop", error);
         if (r < 0)
                 return r;
 
@@ -71,7 +91,7 @@ static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, s
 
 const sd_bus_vtable bus_job_vtable[] = {
         SD_BUS_VTABLE_START(0),
-        SD_BUS_METHOD("Cancel", NULL, NULL, method_cancel, 0),
+        SD_BUS_METHOD("Cancel", NULL, NULL, bus_job_method_cancel, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), SD_BUS_VTABLE_PROPERTY_CONST),
@@ -132,9 +152,9 @@ void bus_job_send_change_signal(Job *j) {
                 j->in_dbus_queue = false;
         }
 
-        r = bus_foreach_bus(j->manager, j->subscribed, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j);
+        r = bus_foreach_bus(j->manager, j->clients, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j);
         if (r < 0)
-                log_debug("Failed to send job change signal for %u: %s", j->id, strerror(-r));
+                log_debug_errno(r, "Failed to send job change signal for %u: %m", j->id);
 
         j->sent_dbus_new_signal = true;
 }
@@ -176,7 +196,7 @@ void bus_job_send_removed_signal(Job *j) {
         if (!j->sent_dbus_new_signal)
                 bus_job_send_change_signal(j);
 
-        r = bus_foreach_bus(j->manager, j->subscribed, send_removed_signal, j);
+        r = bus_foreach_bus(j->manager, j->clients, send_removed_signal, j);
         if (r < 0)
-                log_debug("Failed to send job remove signal for %u: %s", j->id, strerror(-r));
+                log_debug_errno(r, "Failed to send job remove signal for %u: %m", j->id);
 }