chiark
/
gitweb
/
~ianmdlvl
/
elogind.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
bus-proxy: properly check for bus name prefixes when enforcing policy
[elogind.git]
/
src
/
bus-proxyd
/
bus-policy.c
diff --git
a/src/bus-proxyd/bus-policy.c
b/src/bus-proxyd/bus-policy.c
index aea8541d50a2cc6559622065b4807cec5b477b2b..cb0726aa3ffb7e0de28d866049bb21f2b4886de6 100644
(file)
--- a/
src/bus-proxyd/bus-policy.c
+++ b/
src/bus-proxyd/bus-policy.c
@@
-602,14
+602,10
@@
struct policy_check_filter {
int class;
const struct ucred *ucred;
int message_type;
int class;
const struct ucred *ucred;
int message_type;
+ const char *name;
const char *interface;
const char *path;
const char *interface;
const char *path;
- union {
- const char *name;
- const char *member;
- };
- char **names_strv;
- Hashmap *names_hash;
+ const char *member;
};
static int is_permissive(PolicyItem *i) {
};
static int is_permissive(PolicyItem *i) {
@@
-628,13
+624,8
@@
static int check_policy_item(PolicyItem *i, const struct policy_check_filter *fi
case POLICY_ITEM_SEND:
case POLICY_ITEM_RECV:
case POLICY_ITEM_SEND:
case POLICY_ITEM_RECV:
- if (i->name) {
- if (filter->names_hash && !hashmap_contains(filter->names_hash, i->name))
- break;
-
- if (filter->names_strv && !strv_contains(filter->names_strv, i->name))
- break;
- }
+ if (i->name && !streq_ptr(i->name, filter->name))
+ break;
if ((i->message_type != _POLICY_ITEM_CLASS_UNSET) && (i->message_type != filter->message_type))
break;
if ((i->message_type != _POLICY_ITEM_CLASS_UNSET) && (i->message_type != filter->message_type))
break;
@@
-651,16
+642,16
@@
static int check_policy_item(PolicyItem *i, const struct policy_check_filter *fi
return is_permissive(i);
case POLICY_ITEM_OWN:
return is_permissive(i);
case POLICY_ITEM_OWN:
- assert(filter->
member
);
+ assert(filter->
name
);
if (streq(i->name, "*") || streq(i->name, filter->name))
return is_permissive(i);
break;
case POLICY_ITEM_OWN_PREFIX:
if (streq(i->name, "*") || streq(i->name, filter->name))
return is_permissive(i);
break;
case POLICY_ITEM_OWN_PREFIX:
- assert(filter->
member
);
+ assert(filter->
name
);
- if (streq(i->name, "*") || startswith(i->name, filter->name))
+ if (streq(i->name, "*") || s
ervice_name_s
tartswith(i->name, filter->name))
return is_permissive(i);
break;
return is_permissive(i);
break;
@@
-780,8
+771,8
@@
bool policy_check_hello(Policy *p, const struct ucred *ucred) {
bool policy_check_recv(Policy *p,
const struct ucred *ucred,
bool policy_check_recv(Policy *p,
const struct ucred *ucred,
- Hashmap *names,
int message_type,
int message_type,
+ const char *name,
const char *path,
const char *interface,
const char *member) {
const char *path,
const char *interface,
const char *member) {
@@
-789,8
+780,8
@@
bool policy_check_recv(Policy *p,
struct policy_check_filter filter = {
.class = POLICY_ITEM_RECV,
.ucred = ucred,
struct policy_check_filter filter = {
.class = POLICY_ITEM_RECV,
.ucred = ucred,
- .names_hash = names,
.message_type = message_type,
.message_type = message_type,
+ .name = name,
.interface = interface,
.path = path,
.member = member,
.interface = interface,
.path = path,
.member = member,
@@
-801,8
+792,8
@@
bool policy_check_recv(Policy *p,
bool policy_check_send(Policy *p,
const struct ucred *ucred,
bool policy_check_send(Policy *p,
const struct ucred *ucred,
- char **names,
int message_type,
int message_type,
+ const char *name,
const char *path,
const char *interface,
const char *member) {
const char *path,
const char *interface,
const char *member) {
@@
-810,8
+801,8
@@
bool policy_check_send(Policy *p,
struct policy_check_filter filter = {
.class = POLICY_ITEM_SEND,
.ucred = ucred,
struct policy_check_filter filter = {
.class = POLICY_ITEM_SEND,
.ucred = ucred,
- .names_strv = names,
.message_type = message_type,
.message_type = message_type,
+ .name = name,
.interface = interface,
.path = path,
.member = member,
.interface = interface,
.path = path,
.member = member,