sd-bus: store selinux context at connection time

This appears to be the right time to do it for SOCK_STREAM
unix sockets.

Also: condition bus_get_owner_creds_dbus1 was reversed. Split
it out to a separate variable for clarity and fix.

https://bugzilla.redhat.com/show_bug.cgi?id=1224211

diff --git a/src/libelogind/sd-bus/bus-control.c b/src/libelogind/sd-bus/bus-control.c
index 43ddfc651dc273fff596f00d8d9d6fee03031073..11039033588be9488c3ac7526c002ac23473097d 100644 (file)
--- a/src/libelogind/sd-bus/bus-control.c
+++ b/src/libelogind/sd-bus/bus-control.c
@@ -979,8 +979,10 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
         _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
         pid_t pid = 0;
         int r;
+        bool do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT);
 
-        if (!bus->ucred_valid && !isempty(bus->label))
+        /* Avoid allocating anything if we have no chance of returning useful data */
+        if (!bus->ucred_valid && !do_label)
                 return -ENODATA;
 
         c = bus_creds_new();
@@ -1004,7 +1006,7 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
                 }
         }
 
-        if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
+        if (do_label) {
                 c->label = strdup(bus->label);
                 if (!c->label)
                         return -ENOMEM;

diff --git a/src/libelogind/sd-bus/bus-internal.h b/src/libelogind/sd-bus/bus-internal.h
index 1351938c80e7f0294831b441329a4fcd7311b1de..2ee0eabc021487a83fa1482cad782a6551ac79a3 100644 (file)
--- a/src/libelogind/sd-bus/bus-internal.h
+++ b/src/libelogind/sd-bus/bus-internal.h
@@ -261,7 +261,7 @@ struct sd_bus {
         usec_t auth_timeout;
 
         struct ucred ucred;
-        char label[NAME_MAX];
+        char *label;
 
         uint64_t creds_mask;
 

diff --git a/src/libelogind/sd-bus/bus-socket.c b/src/libelogind/sd-bus/bus-socket.c
index 8b15a743c44fccbeb60f090a55283bbd7f8a104c..e182cfacfcc394a3c8854b5fd8298f0c4e63dd68 100644 (file)
--- a/src/libelogind/sd-bus/bus-socket.c
+++ b/src/libelogind/sd-bus/bus-socket.c
@@ -588,10 +588,17 @@ void bus_socket_setup(sd_bus *b) {
 }
 
 static void bus_get_peercred(sd_bus *b) {
+        int r;
+
         assert(b);
 
         /* Get the peer for socketpair() sockets */
         b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
+
+        /* Get the SELinux context of the peer */
+        r = getpeersec(b->input_fd, &b->label);
+        if (r < 0 && r != -EOPNOTSUPP)
+                log_debug_errno(r, "Failed to determine peer security context: %m");
 }
 
 static int bus_socket_start_auth_client(sd_bus *b) {

diff --git a/src/libelogind/sd-bus/sd-bus.c b/src/libelogind/sd-bus/sd-bus.c
index e4044397695c0c07b22f05e1e35ee67fe7cceac4..7005ce34a8d05063ed5f97c9cca8945e496006b5 100644 (file)
--- a/src/libelogind/sd-bus/sd-bus.c
+++ b/src/libelogind/sd-bus/sd-bus.c
@@ -130,6 +130,7 @@ static void bus_free(sd_bus *b) {
         if (b->kdbus_buffer)
                 munmap(b->kdbus_buffer, KDBUS_POOL_SIZE);
 
+        free(b->label);
         free(b->rbuffer);
         free(b->unique_name);
         free(b->auth_buffer);