X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fdbus-job.c;h=8b5ea2566d22dd6537005d88cf43d670670afba5;hp=e774383793b932bcddbce857867bb44d9263adba;hb=0c13be389faea49fd8a370dc8186e7d5d20e967d;hpb=718db96199eb307751264e4163555662c9a389fa diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c index e77438379..8b5ea2566 100644 --- a/src/core/dbus-job.c +++ b/src/core/dbus-job.c @@ -24,19 +24,35 @@ #include "selinux-access.h" #include "job.h" #include "dbus-job.h" -#include "dbus-client-track.h" +#include "dbus.h" static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType); static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState); +static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) { + int r; + + if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) + return 0; /* One of the job owners is calling us */ + + r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN); + if (r < 0) + return r; + if (r == 0) + return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action"); + + /* Root has called us */ + return 0; +} + static int property_get_unit( sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { _cleanup_free_ char *p = NULL; Job *j = userdata; @@ -52,71 +68,41 @@ static int property_get_unit( return sd_bus_message_append(reply, "(so)", j->unit->id, p); } -static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata) { +int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Job *j = userdata; + int r; assert(bus); assert(message); assert(j); - SELINUX_UNIT_ACCESS_CHECK(j->unit, bus, message, "stop"); + r = verify_sys_admin_or_owner_sync(message, j, error); + if (r < 0) + return r; + + r = mac_selinux_unit_access_check(j->unit, message, "stop", error); + if (r < 0) + return r; + job_finish_and_invalidate(j, JOB_CANCELED, true); - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } const sd_bus_vtable bus_job_vtable[] = { SD_BUS_VTABLE_START(0), - SD_BUS_METHOD("Cancel", NULL, NULL, method_cancel, 0), - SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), 0), - SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, 0), - SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), 0), + SD_BUS_METHOD("Cancel", NULL, NULL, bus_job_method_cancel, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_PROPERTY("Id", "u", NULL, offsetof(Job, id), SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("Unit", "(so)", property_get_unit, 0, SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("JobType", "s", property_get_type, offsetof(Job, type), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("State", "s", property_get_state, offsetof(Job, state), SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE), SD_BUS_VTABLE_END }; -static int foreach_client(Job *j, int (*send_message)(sd_bus *bus, const char *name, Job *j)) { - BusTrackedClient *one_destination = NULL; - Iterator i; - sd_bus *b; - unsigned n, m; - int r; - - assert(j); - assert(send_message); - - n = set_size(j->manager->subscribed); - m = set_size(j->subscribed); - - if (n <= 0 && m <= 0) - return 0; - - if (n == 1 && m == 0) - one_destination = set_first(j->manager->subscribed); - else if (n == 0 && m == 1) - one_destination = set_first(j->subscribed); - else - one_destination = NULL; - - if (one_destination) - return send_message(one_destination->bus, isempty(one_destination->name) ? NULL : one_destination->name, j); - - /* Send to everybody */ - SET_FOREACH(b, j->manager->private_buses, i) { - r = send_message(b, NULL, j); - if (r < 0) - return r; - } - - if (j->manager->api_bus) - return send_message(j->manager->api_bus, NULL, j); - - return 0; -} - -static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_new_signal(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *p = NULL; + Job *j = userdata; int r; assert(bus); @@ -128,10 +114,10 @@ static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { r = sd_bus_message_new_signal( bus, + &m, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", - "JobNew", - &m); + "JobNew"); if (r < 0) return r; @@ -139,11 +125,12 @@ static int send_new_signal(sd_bus *bus, const char *destination, Job *j) { if (r < 0) return r; - return sd_bus_send_to(bus, m, destination, NULL); + return sd_bus_send(bus, m, NULL); } -static int send_changed_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_changed_signal(sd_bus *bus, void *userdata) { _cleanup_free_ char *p = NULL; + Job *j = userdata; assert(bus); assert(j); @@ -165,16 +152,17 @@ void bus_job_send_change_signal(Job *j) { j->in_dbus_queue = false; } - r = foreach_client(j, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal); + r = bus_foreach_bus(j->manager, j->clients, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j); if (r < 0) - log_warning("Failed to send job change signal for %u/%s: %s", j->id, j->unit->id, strerror(-r)); + log_debug_errno(r, "Failed to send job change signal for %u: %m", j->id); j->sent_dbus_new_signal = true; } -static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { +static int send_removed_signal(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *p = NULL; + Job *j = userdata; int r; assert(bus); @@ -184,13 +172,12 @@ static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { if (!p) return -ENOMEM; - r = sd_bus_message_new_signal( bus, + &m, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", - "JobRemoved", - &m); + "JobRemoved"); if (r < 0) return r; @@ -198,7 +185,7 @@ static int send_removed_signal(sd_bus *bus, const char *destination, Job *j) { if (r < 0) return r; - return sd_bus_send_to(bus, m, destination, NULL); + return sd_bus_send(bus, m, NULL); } void bus_job_send_removed_signal(Job *j) { @@ -209,8 +196,7 @@ void bus_job_send_removed_signal(Job *j) { if (!j->sent_dbus_new_signal) bus_job_send_change_signal(j); - r = foreach_client(j, send_removed_signal); + r = bus_foreach_bus(j->manager, j->clients, send_removed_signal, j); if (r < 0) - log_warning("Failed to send job removal signal for %u/%s: %s", j->id, j->unit->id, strerror(-r)); - return; + log_debug_errno(r, "Failed to send job remove signal for %u: %m", j->id); }